Let's say I have an user certificate (PKCS#12) at http://example.com/example.p12

When I point Firefox to that URL, it does nothing. It doesn't install the certificate, it doesn't show a dialog box, it doesn't show an error, it doesn't even reset the former page.

Firebug tells me that the certificate was received with Content-Type: application/x-x509-user-cert, which seems to be the correct MIME type.

What am I doing wrong? How could I make firefox import the certificate?

Note: If I import the certificate manually (downloading it then importing it from the Preferences>Advanced>Encryption>View Certificates>Your Certificates>Import...) it works perfectly.


PKCS#12 isn't a format for certificates, but a container for certificates (and private keys). It shouldn't be served with application/x-x509-user-cert.

It's very unusual to make a PKCS#12 file available for download. Even if they are password protected, they usually need to be protected.

Typically, you'd want to import a certificate into your browser using application/x-x509-user-cert when the key-pair was generated within the browser. In this situation, you only import the certificate itself (not the PKCS#12 file) and associate it back with the private key used for the certificate request. The private key never left the browser. (You can then export it to PKCS#12 from the browser if needed, to back it up and/or import it explicitly from the file in another browser, as you've already done manually.

  • <keygen> is not supported on IE. I had the following workflow: user sends form, server generates private key and certificate and puts them in a PKCS#12 containter, server gives user a one-time link to the certificate, user clicks link and the certificate is imported. Unfortunately the last part only works in Opera. I have also tried to use application/x-pkcs12 instead of application/x-x509-user-cert, but it still doesn't work – user49740 May 21 '12 at 10:41
  • I know keygen isn't supported on IE, but your question is tagged with Firefox. In IE, the equivalent can be done through ActiveX controls. Is it what you're after? (It's generally considered bad practice for CAs to generate the user's private key too.) You might be interested in this, btw. – Bruno May 21 '12 at 12:32
  • In the meantime I implemented a keygen-based solution which fails on IE [for obvious reasons] and on Chrome [When the certificate is returned, Chrome returns an ERR_CERT_INVALID]. Thanks for the link, I will look there and implement something for IE using ActiveX. I still have no idea what to do with chrome, though – user49740 May 21 '12 at 15:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.