Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to use certutil to add a client certificate to the firefox db: The purpose of this certificate is to authenticate with a server - the server asks for credentials, this certificate contains the credentials.

certutil -A -n "My Certificate" -d /myfirefoxprofile/ -t "CT,," -a -i /mycertificate.pfx 

However this gives me the error:

certutil: could not obtain certificate from file: security library: improperly formatted DER-encoded message.

Am I doing something obviously wrong?

This is on ubuntu 10.10

share|improve this question
Why not import the certificate using Firefox GUI ? – harrymc Nov 12 '10 at 17:33
i have had to tackle this's way easier to require a user to run a certificate generation and import script(click here or bundle it in an installer) to identify themselves to a web-app than it is to have a 10+ click 2 page installation document with screenshots – RobotHumans Nov 12 '10 at 17:51

It looks like you need to convert PFX to PEM...directions with openssl switches here:

to be clear as evidently somehow i was confusing:

convert from pfx to pem then rerun your import command with the new file(edit: and the modified options below). it looks to me like the firefox cert import is choking on the pfx filetype(edit: and the appropriate import options were not specified). the directions linked to are not for firefox import, but for certificate conversion.

additional edit after question edit:

the -t needs the u option to be used as a client certificate. the -u flag needs the C option...certutil flags are documented here:

you may also want to look here:
as the browser may prompt on using the certificate

certutil -A -n "My Certificate" -d /myfirefoxprofile/ -t "CTu,," -u "c" -a -i /mycertificate.pem

should do it

share|improve this answer
How does this help with adding the certificate to firefox? – Derek Ekins Nov 12 '10 at 15:22
see edited answer – RobotHumans Nov 12 '10 at 15:23
When I import the pem file that was generated the certificate shows up as an authority but NOT as a certificate that can be used to identify me. – Derek Ekins Nov 12 '10 at 15:34
what exactly are you trying to do...i thought you were trying to add your cert as a CA so you could force firefox to trust additional sites with self signed keys, clarify question plz – RobotHumans Nov 12 '10 at 15:36
Updated question – Derek Ekins Nov 12 '10 at 15:41

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.