3

I'm trying to install a client certificate in Chrome based on these instructions from Google. The cert is for a VPN and uses RSA encryption, meeting the one qualifier from that documentation (RSA only). It was generated by easy-rsa for use on on an OpenVPN network, and has worked fine using third party software ("OpenVPN connect") for the better part of a year, but recently this mysteriously started causing DNS problems,1 so I am now trying the Chrome built-in instead.

However, when I go to chrome://settings/certificates and try to import the client cert (the CA cert for which is installed already under "Authorities"), I am told "The Private Key for this Client Certificate is missing or invalid". The key is in a separate file in the same directory with the same basename and the extension .key, but is not in the Chrome file picker.

I tried appending the key (both it and the cert are in PEM) to the cert, this made no difference.


  1. Note VPN is not being used to tunnel the internet, i.e., my default route is still through the local wifi router. The VPN route is just for other nodes on that private subnet. Neither the server nor client config push any settings related to DNS. But this is all not very relevant to my question.

1 Answer 1

8

Chrome, like most browsers, expects the private key to be securely stored in a PKCS#12 file along with the public certificate.

You will need to convert the two files you have into a single PKCS#12 file (sometimes known as a PFX file).

You can use OpenSSL to convert:

openssl pkcs12 -export -out myCert.p12 -inkey myCert.key -in myCert.crt -certfile caCert.crt

Note: You may have the certificates held in files that end in .pem or .cer - simply change the command above to use the appropriate filenames.

You should now be able to import it to your browser.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .