Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to use certutil to add a client certificate to the firefox db: The purpose of this certificate is to authenticate with a server - the server asks for credentials, this certificate contains the credentials.

certutil -A -n "My Certificate" -d /myfirefoxprofile/ -t "CT,," -a -i /mycertificate.pfx 

However this gives me the error:

certutil: could not obtain certificate from file: security library: improperly formatted DER-encoded message.

Am I doing something obviously wrong?

This is on ubuntu 10.10

share|improve this question
    
Why not import the certificate using Firefox GUI ? – harrymc Nov 12 '10 at 17:33
    
i have had to tackle this before...it's way easier to require a user to run a certificate generation and import script(click here or bundle it in an installer) to identify themselves to a web-app than it is to have a 10+ click 2 page installation document with screenshots – RobotHumans Nov 12 '10 at 17:51

It looks like you need to convert PFX to PEM...directions with openssl switches here: http://support.citrix.com/article/CTX106028

to be clear as evidently somehow i was confusing:

convert from pfx to pem then rerun your import command with the new file(edit: and the modified options below). it looks to me like the firefox cert import is choking on the pfx filetype(edit: and the appropriate import options were not specified). the directions linked to are not for firefox import, but for certificate conversion.

additional edit after question edit:

the -t needs the u option to be used as a client certificate. the -u flag needs the C option...certutil flags are documented here: http://www.mozilla.org/projects/security/pki/nss/tools/certutil.html

you may also want to look here: http://www.phocean.net/2008/11/16/how-to-stop-firefox-from-prompting-for-the-client-certificate.html
as the browser may prompt on using the certificate

certutil -A -n "My Certificate" -d /myfirefoxprofile/ -t "CTu,," -u "c" -a -i /mycertificate.pem

should do it

share|improve this answer
    
How does this help with adding the certificate to firefox? – Derek Ekins Nov 12 '10 at 15:22
    
see edited answer – RobotHumans Nov 12 '10 at 15:23
    
When I import the pem file that was generated the certificate shows up as an authority but NOT as a certificate that can be used to identify me. – Derek Ekins Nov 12 '10 at 15:34
    
what exactly are you trying to do...i thought you were trying to add your cert as a CA so you could force firefox to trust additional sites with self signed keys, clarify question plz – RobotHumans Nov 12 '10 at 15:36
    
Updated question – Derek Ekins Nov 12 '10 at 15:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .