PKICertImport(1)

📦
version 11.7.1 · 3 versions
, in centos-stream 9, ubuntu jammy

💖 PKICertImport 💖

okay so bestie, welcome to PKICertImport — the PKI certificate import tool that's literally here to safely validate and import your certificates into the NSS database. no cap, it's giving "trust but verify" main character energy. 🎀

✨ NAME ✨

PKICertImport — used to safely validate and import certificates into the NSS database. periodt. 💅

🌸 SYNOPSIS 🌸

PKICertImport -d NSS-database -i certificate -n nickname -t trust -u usage [-h token] [-f password-file] [-a]

Validate and import a certificate into the specified NSS database. It verifies signature, trust chain, trust, and usage flags. If a certificate is not valid, it will not be added to the NSS database or specified token. like, at all. not even a little. 🚫✨

🦋 DESCRIPTION 🦋

The certificate import utility validates signature, trust chain, trust, and usage flags before importing a certificate into the specified NSS database. This ensures that no certificate is used before its authenticity has been verified. honestly iconic behavior. 👑

Unlike certutil, only one invocation is necessary to both validate and import certificates. one and done, bestie. 💅

See certutil for more information about the parameters to PKICertImport.

⭐ OPTIONS ⭐

here's the PKICertImport parameter lineup, bestie:

  • -a, --ascii — the certificate is encoded in ASCII (PEM) format instead of binary format. optional. ✨
  • -i certificate, --certificate certificate — path to the certificate to import. required. 🔥
  • -c, --chain — import an entire PKCS12 chain; requires --pkcs12. optional. 🎀
  • --chain-trust trust — trust flags to assign intermediate certificates; requires --chain.
  • --chain-usage usage — usage to validate intermediate certificates against; requires --chain.
  • -d NSS-database, --database NSS-database — the directory containing the NSS database. this is usually the client's personal directory. required. 📁
  • -f password-file, --password password-file — the path to a file containing the password to the NSS database. optional. 🔑
  • -h token, --hsm token — name of the token. if not specified, the default token is the internal database slot. optional. 🧚
  • -l, --leaf-only — import only the leaf certificate from a PKCS12 chain; requires --pkcs12. optional. 🍓
  • -n nickname, --nickname nickname — nickname for the certificate in the NSS database. required. 💖
  • -p, --pkcs12 — the input certificate is a .p12/PKCS12 file. optional. 🦋
  • -w password-file, --pkcs12-password password-file — password file for the PKCS12 chain; requires --pkcs12.
  • -t trust, --trust trust — trust flags for the certificate. see certutil for more information about the available trust flags. required. 🛡️
  • -u usage, --usage usage — usage to validate the certificate against. see certutil for more information about available usage flags. required. ✅

💀 UNSAFE OPTIONS 💀

okay so these exist, but the name is literally UNSAFE, so like... be aware. 🙈

  • --unsafe-keep-keys — keep the keys in the NSS DB in the event of a verification failure.
  • --unsafe-trust-then-verify — specify trust when importing the certificate instead of after verifying certificates. this enables importing a new root certificate instead of requiring the chain to have an existing, trusted root.

🌈 ENVIRONMENT 🌈

  • VERBOSE — when specified, see all internal commands being executed as part of this command. iykyk, it's the "show me everything" mode. 🔍

🎀 EXAMPLES 🎀

to import a server certificate:

PKICertImport -d . -n "example.com" -i example-com.crt -t ,, -u V

to import a CA certificate (root or intermediate):

PKICertImport -d . -n "MyCA Cert" -i ca-cert.crt -t CT,C,C -u L

to import a leaf client certificate from a PKCS12 chain:

PKICertImport -d . -n "Nick Named" -i nick-named.p12 -t ,, -u C --pkcs12 --leaf

to import the entire chain of a client certificate:

PKICertImport -d . -n "Nick Named" -i nick-named.p12 -t ,, -u C --pkcs12 --chain --chain-trust CT,C,C --chain-usage L

👑 AUTHORS 👑

Alexander Scheel lt;ascheel@redhat.comgt;. 🫶

Copyright (c) 2019 Red Hat, Inc. This is licensed under the GNU General Public License, version 2 (GPLv2). A copy of this license is available at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.

and that's the whole page bestie — brought to you by PKI, dated Jan 30, 2019. go validate those certs, you got this 💅✨🦋

📦 where this page comes from