Chapter 4. Converting certificate formats to work with IdM

Procedure

1. Convert the certificate to the PEM format:

   • If your certificate is in the DER format:

     $ openssl x509 -in cert.crt -inform der -outform pem -out cert.pem

     Copy to Clipboard Toggle word wrap

   • If your file is in the PKCS #12 format, whose common filename extensions are .pfx and .p12, and contains a certificate, a private key, and possibly other data, extract the certificate using the openssl pkcs12 utility. When prompted, enter the password protecting the private key stored in the file:

     $ openssl pkcs12 -in cert_and_key.p12 -clcerts -nokeys -out cert.pem
     Enter Import Password:

     Copy to Clipboard Toggle word wrap

2. Obtain the administrator’s credentials:

   $ kinit admin

   Copy to Clipboard Toggle word wrap

3. Add the certificate to the user account using the IdM CLI following one of the following methods:

   • Remove the first and last lines (-----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----) of the PEM file using the sed utility before adding the string to the ipa user-add-cert command:

     $ ipa user-add-cert some_user --certificate="$(sed -e '/BEGIN CERTIFICATE/d;/END CERTIFICATE/d' cert.pem)"

     Copy to Clipboard Toggle word wrap

   • Copy and paste the contents of the certificate file without the first and last lines (-----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----) into the ipa user-add-cert command:

     $ ipa user-add-cert some_user --certificate=MIIDlzCCAn+gAwIBAgIBATANBgkqhki...

     Copy to Clipboard Toggle word wrap
     Note

     You cannot pass a PEM file containing the certificate as input to the ipa user-add-cert command directly, without first removing the first and last lines (-----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----):

     $ ipa user-add-cert some_user --cert=some_user_cert.pem

     Copy to Clipboard Toggle word wrap

     This command results in the "ipa: ERROR: Base64 decoding failed: Incorrect padding" error message.

4. To check if the certificate was accepted by the system:

   [idm_user@r8server]$ ipa user-show some_user

   Copy to Clipboard Toggle word wrap

Procedure

1. Using the CLI, convert the certificate to the PEM format:

   • If your certificate is in the DER format:

     $ openssl x509 -in cert.crt -inform der -outform pem -out cert.pem

     Copy to Clipboard Toggle word wrap

   • If your file is in the PKCS #12 format, whose common filename extensions are .pfx and .p12, and contains a certificate, a private key, and possibly other data, extract the certificate using the openssl pkcs12 utility. When prompted, enter the password protecting the private key stored in the file:

     $ openssl pkcs12 -in cert_and_key.p12 -clcerts -nokeys -out cert.pem
     Enter Import Password:

     Copy to Clipboard Toggle word wrap
2. Open the certificate in an editor and copy the contents. You can include the "-----BEGIN CERTIFICATE-----" and "-----END CERTIFICATE-----" header and footer lines but you do not have to, as both the PEM and base64 formats are accepted by the IdM web UI.
3. In the IdM web UI, log in as security officer.
4. Go to Identity Users some_user.
5. Click Add next to Certificates.
6. Paste the PEM-formatted contents of the certificate into the window that opens.
7. Click Add.

Procedure

1. Use the pk12util command to export the certificate from the NSS database to the PKCS12 format. For example, to export the certificate with the some_user nickname from the NSS database stored in the ~/certdb directory into the ~/some_user.p12 file:

   $ pk12util -d ~/certdb -o ~/some_user.p12 -n some_user
   Enter Password or Pin for "NSS Certificate DB":
   Enter password for PKCS12 file:
   Re-enter password:
   pk12util: PKCS12 EXPORT SUCCESSFUL

   Copy to Clipboard Toggle word wrap

2. Set appropriate permissions for the .p12 file:

   # chmod 600 ~/some_user.p12

   Copy to Clipboard Toggle word wrap

   Because the PKCS #12 file also contains the private key, it must be protected to prevent other users from using the file. Otherwise, they would be able to impersonate the user.