Mono(certmgr)

💖 NAME 💖

certmgr — the Mono Certificate Manager, but make it CLI. Bestie, this is your little command-line bestie for wrangling certs. 💅

This page lives in the Mono(certmgr) manual, so like… that's the whole vibe, iykyk.

---

✨ SYNOPSIS ✨

certmgr [action] [object type] [options] store [filename] or certmgr
-ssl [options] url

---

🌸 DESCRIPTION 🌸

Okay so listen. This tool lets you list, add, remove or extract certificates, certificate revocation lists (CRL) or certificate trust lists (CTL) to/from a certificate store. That's it, that's the job. 🫶

And why do we care about certificate stores at all? Because stores are literally what gets used to build and validate certificate chains for Authenticode(r) code signing validation and SSL server certificates. So like, they're the backbone, no cap. 👑

---

🎀 STORES 🎀

The store is the certificate store you're gonna be working with, bestie. It can be one of these:

• My — this is the personal certificate store. It's giving main character energy.
• AddressBook — this is the store for other people. Not you. Them.
• CA — this is a store for intermediate certificate authorities.
• Trust — this one's for trusted roots. Precious cargo honestly.
• Disallowed — and this one is for untrusted roots. The naughty corner. 💀

---

🔥 ACTIONS 🔥

• -list — Lists the certificates, CTL or CTL in the store you specified. (Yes, the original says CTL twice. We don't ask questions, we just list. 💀)
• -add — Adds a certificate, CRL or CTL to the store you specified. And here's the tea: if filename is a pkcs12 or pfx file and it contains a private key, that key gets imported into the local key pair container. Iconic behaviour tbh.
• -del — Removes a certificate, CRL or CTL from the store you specified. ⚠️ Heads up bestie: you have to specify the object you're removing with its hash value, NOT a filename. You'll see that hash value whenever you do a -list on the store. It's right there, babe.
• -put — Copies a certificate, CRL or CTL from a store out to a file. Extract era. 💖
• -ssl — Downloads and adds the certificates from an SSL session. You'll get asked to confirm adding every single certificate that comes back from the server — yes, all of them, we're being thorough. 🌈 Note that SSL/TLS protocols do not require a server to send the root certificate. This action assumes a -c certificate object type and will import the certificates into the appropriate stores, which means: the server certificate goes into the OtherPeople store, the root certificate goes into the Trust store, and any other intermediate certificates go into the IntermediateCA store. Organized queen. 👑
• -importKey — Lets you import a private key from a pkcs12 file into a local key pair store. Super useful when you already have the key's corresponding certificate installed at that specific store. 🎀

---

🦋 OBJECT TYPES 🦋

• -c , -cert , -certificate — Add, Delete or Put certificates. Which means the file you specify must/will contain X.509 certificates in DER binary encoding. Binary. Not vibes.
• -crl — Add, Delete or Put certificate revocation lists (CRL). The file you specify must/will contain X.509 CRL in DER binary encoding.
• -ctl — Add, Delete or Put certificate trust lists (CRL). UNSUPPORTED. Like, it's in the docs but it is NOT supported. Do not come for me. 🙈

---

💅 OPTIONS 💅

• -m — Use the machine's certificate stores instead of the default user's stores. Big machine energy.
• -v — More details get displayed on the console. Verbose babe. 🗣️
• -p password — Use the password you specify when accessing a pkcs12 file. Secrets stay secret. 🤫
• -help , -h , -? , /? — Display help about this tool. When in doubt, ask. 🫶

---

⭐ FILES ⭐

WARNING: This details the current behavior of Mono and could change between releases. The only safe way to interact with certificate stores is to use the certmgr tool.

Okay so here's the layout, bestie. The current releases of Mono keep all the user certificate stores in separate directories under:

~/.config/.mono/certs/

For example, the trusted root certificates for a user would be kept under:

~/.config/.mono/certs/Trust/

Certificate files are kept in DER (binary) format, with the extension .cer.

The filenames either start with:

tbp (thumbprint) or ski (subject key identifier).

And the rest of the filename? That's the base64-encoded value (the tbp or the ski).

Private key data is stored under:

~/.config/.mono/keypairs/

---

🌈 EXAMPLES 🌈

List all certs in the machine Trust store

mono certmgr.exe -list -c -m Trust

This lists all certificates in the machine Trust store, and it displays the hash value for each certificate. That value is what you use to uniquely identify a certificate for certain operations (like, say, deleting one). E.g.:

Unique Hash: FFA3AC0084DA1673B5A031EBB2156B3E8FBBF6D8

Delete a cert by hash

mono certmgr.exe -del -c -m Trust
FFA3AC0084DA1673B5A031EBB2156B3E8FBBF6D8

This removes the certificate represented by that hash value from the machine Trust store. And ngl, the machine store is normally restricted. If the current user doesn't have the minimum access rights to remove the certificate, you'll get this error message:

Access to the machine 'Trust' certificate store has been denied.

Import certs from a website over HTTPS

certmgr -ssl https://www.verisign.com

This imports the certificates from www.verisign.com used for HTTP over SSL. And if you're downloading from www.verisign.com, go peek at KNOWN ISSUES (MD2) below, because yeah. 😭

Import certs from a secure LDAP server

certmgr -ssl ldaps://www.nldap.com:636

This imports the certificates from www.nldap.com used for secure LDAP. And the wild part? This works even if we don't know how to speak LDAP, because we stop the communication shortly after the SSL handshake — which is exactly where we get the certificate anyway. Slay. 💅

---

💀 KNOWN ISSUES 💀

MD2

Some Certificate Authorities (CA) old root certificates use the MD2 hash algorithm. And MD2 is old enough that it's not part of the standard .NET framework. Which makes it, unfortunately, impossible to validate a digital signature made with MD2. For this reason MD2 is included in the Mono.Security.dll assembly. However, the machine.config file must be updated so the OID for MD2 is known at runtime.

To correct this, insert the following XML snippet inside the <configuration> element of your machine.config file:

  <mscorlib>
    <cryptographySettings>
      <cryptoNameMapping>
        <cryptoClasses>
          <cryptoClass
monoMD2="Mono.Security.Cryptography.MD2Managed, Mono.Security,
Version=1.0.5000.0, Culture=neutral,
PublicKeyToken=0738eb9f132ed756" />
        </cryptoClasses>
        <nameEntry name="MD2" class="monoMD2" />
      </cryptoNameMapping>
      <oidMap>
        <oidEntry OID="1.2.840.113549.2.2" name="MD2" />
      </oidMap>
    </cryptographySettings>
  </mscorlib>

---

👑 AUTHOR 👑

Written by Sebastien Pouliot

Minor additions by Pablo Ruiz García

---

🫶 COPYRIGHT 🫶

Copyright (C) 2004-2005 Novell.

---

🍓 MAILING LISTS 🍓

Visit http://lists.ximian.com/mailman/listinfo/mono-list for details.

---

🧚 WEB SITE 🧚

Visit http://www.mono-project.com for details

---

💜 SEE ALSO 💜

makecert(1), setreg(1)

---

Okay bestie that's the whole page, we ate and left no crumbs. 💅✨ This was the Mono(certmgr) manual page — go forth and manage those certificates, you absolute icon. 🎀🦋