pki-pkcs12(1)

📦
version 11.7.1 · 4 versions
, in centos-stream 9

💅 pki-pkcs12(1) — PKI PKCS #12 Management Commands

okay bestie, sit down, because this is the pki-pkcs12 page from the PKI manual and it's literally your whole cheat sheet for wrangling certs and keys inside a PKCS #12 file. 🎀

✨ NAME ✨

pki-pkcs12 — the command-line interface for managing certificates and keys in a PKCS #12 file. that's it, that's the vibe. 🦋

🌸 SYNOPSIS 🌸

pki [CLI-options] pkcs12
pki [CLI-options] pkcs12-export [command-options]
pki [CLI-options] pkcs12-import [command-options]
pki [CLI-options] pkcs12-cert [command-options]
pki [CLI-options] pkcs12-key [command-options]

💖 DESCRIPTION 💖

so the pki pkcs12 commands give you command-line interfaces to manage certificates and keys in a PKCS #12 file. that's the whole assignment, and they ate. 👑

  • pki [CLI-options] pkcs12-export [command-options] — this one exports all certificates and keys from an NSS database into a PKCS #12 file. packing up and moving out 🧳
  • pki [CLI-options] pkcs12-import [command-options] — this one imports all certificates and keys from a PKCS #12 file into an NSS database. unpacking szn 📦
  • pki [CLI-options] pkcs12-cert [command-options] — this one manages individual certificates in a PKCS #12 file. see pki-pkcs12-cert(1) for the deets.
  • pki [CLI-options] pkcs12-key [command-options] — this one imports individual keys in a PKCS #12 file. see pki-pkcs12-key(1). 🔑

⭐ OPTIONS ⭐

the CLI options are described in pki(1) — go read that one, bestie, it's giving main character energy too.

🦋 OPERATIONS 🦋

to see what PKCS #12 commands you actually have, just type pki pkcs12. and to see each command's usage, type pki pkcs12-<command> --help. like pki pkcs12-export --help, iykyk 😌

all pki pkcs12 commands require a PKCS #12 file and its password. here's the tea:

  • the PKCS #12 file goes in with the --pkcs12-file parameter.
  • the password can be given either directly with the --pkcs12-password parameter, or in a file with the --pkcs12-password-file parameter.

some pki pkcs12 commands also need an NSS database and its password:

  • the NSS database location goes with the -d parameter (default: ~/.dogtag/nssdb).
  • the NSS database password goes with the -c or the -C parameter.

🌈 Exporting all certificates and keys into a PKCS #12 file

to export all certificates and keys from an NSS database into a PKCS #12 file:

$ pki <NSS database location> <NSS database password> pkcs12-export \
    <PKCS #12 file> <PKCS #12 password> [nicknames...]
  • by default the command exports all certificates in the NSS database. if you only want certain ones, pass the certificate nicknames as separate arguments. 💅
  • by default the command always creates a new PKCS #12 file. to export into an existing PKCS #12 file, specify the --append parameter. no cap, that's how you don't nuke your old file.
  • by default the command includes the certificate chain. to export without the certificate chain, specify the --no-chain parameter.
  • by default the command includes the key of each certificate. to export without the key, specify the --no-key parameter.
  • by default the command includes the trust flags of each certificate. to export without the trust flags, specify the --no-trust-flags parameter.

🎀 Importing certificates and keys from a PKCS #12 file

to import certificates and keys from a PKCS #12 file into an NSS database:

$ pki <NSS database location> <NSS database password> pkcs12-import \
    <PKCS #12 file> <PKCS #12 password>
  • by default the command includes all certificates in the PKCS #12 file. to import without the CA certificates (aka the certificates without keys), specify the --no-ca-certs parameter. to import without the user certificates (aka the certificates with keys), specify the --no-user-certs parameter. 🧚
  • by default the command skips a certificate if it already exists in the NSS database. to overwrite the nickname, the key, and the trust flags of existing certificates, specify the --overwrite parameter. this one is a little spicy, so know what you're doing 🔥
  • by default the command includes the trust flags of each certificate. to import without the trust flags, specify the --no-trust-flags parameter.

👑 SEE ALSO 👑

pki-pkcs12-cert(1), pki-pkcs12-key(1)

🙈 AUTHORS 🙈

Endi S. Dewata <edewata@redhat.com>.

Copyright (c) 2016 Red Hat, Inc. This is licensed under the GNU General Public License, version 2 (GPLv2). a copy of this license is available at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.

and that's the whole page, bestie 🫶 this one's from PKI, dated Oct 28, 2016 — mwah, go export something iconic ✨🍓

📦 where this page comes from