Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am trying to use certutil to add a client certificate to the firefox db: The purpose of this certificate is to authenticate with a server - the server asks for credentials, this certificate contains the credentials.

certutil -A -n "My Certificate" -d /myfirefoxprofile/ -t "CT,," -a -i /mycertificate.pfx 

However this gives me the error:

certutil: could not obtain certificate from file: security library: improperly formatted DER-encoded message.

Am I doing something obviously wrong?

This is on ubuntu 10.10

share|improve this question
    
Why not import the certificate using Firefox GUI ? –  harrymc Nov 12 '10 at 17:33
    
i have had to tackle this before...it's way easier to require a user to run a certificate generation and import script(click here or bundle it in an installer) to identify themselves to a web-app than it is to have a 10+ click 2 page installation document with screenshots –  hbdgaf Nov 12 '10 at 17:51
add comment

1 Answer 1

It looks like you need to convert PFX to PEM...directions with openssl switches here: http://support.citrix.com/article/CTX106028

to be clear as evidently somehow i was confusing:

convert from pfx to pem then rerun your import command with the new file(edit: and the modified options below). it looks to me like the firefox cert import is choking on the pfx filetype(edit: and the appropriate import options were not specified). the directions linked to are not for firefox import, but for certificate conversion.

additional edit after question edit:

the -t needs the u option to be used as a client certificate. the -u flag needs the C option...certutil flags are documented here: http://www.mozilla.org/projects/security/pki/nss/tools/certutil.html

you may also want to look here: http://www.phocean.net/2008/11/16/how-to-stop-firefox-from-prompting-for-the-client-certificate.html
as the browser may prompt on using the certificate

certutil -A -n "My Certificate" -d /myfirefoxprofile/ -t "CTu,," -u "c" -a -i /mycertificate.pem

should do it

share|improve this answer
    
How does this help with adding the certificate to firefox? –  Derek Ekins Nov 12 '10 at 15:22
    
see edited answer –  hbdgaf Nov 12 '10 at 15:23
    
When I import the pem file that was generated the certificate shows up as an authority but NOT as a certificate that can be used to identify me. –  Derek Ekins Nov 12 '10 at 15:34
    
what exactly are you trying to do...i thought you were trying to add your cert as a CA so you could force firefox to trust additional sites with self signed keys, clarify question plz –  hbdgaf Nov 12 '10 at 15:36
    
Updated question –  Derek Ekins Nov 12 '10 at 15:41
show 2 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.