Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I'm getting this message when I'm trying to add a certificate to Firefox's "your certificate tab". I generated and signed it before by a server which also is a CA.

Failed to decode the file. Either it is not in PKCS #12 format, has been corrupted, or the password you entered was incorrect.

It asks me to enter a password and then this message is alerted. what's wrong? I'm following this tutorial.

UPDATE #1

commands I used :

 openssl genrsa -out rootCA.key 2048
 openssl req -x509 -new -nodes -key rootCA.key -days 1024 -out rootCA.pem       
 openssl genrsa -out device.key 2048     
 openssl req -new -key device.key -out device.csr       
 openssl x509 -req -in device.csr -CA rootCA.pem \
        -CAkey rootCA.key -CAcreateserial -out device.crt -days 500

The added certificate is device.crt, there's PKS12 which Firefox request on your certificates tab. Should I change its format?

share|improve this question
1  
We can hardly help you without seeing the certificate file you're trying to import, or without knowing exactly how you generated it (i.e. copy-paste the commands that you ran). Please edit your question accordingly. –  Gilles Apr 27 '13 at 19:46
    
They're in the tutorial :D , I'll put them now –  Nancy Smith Apr 28 '13 at 7:31
add comment

1 Answer

up vote 2 down vote accepted

1: Confirming type of certificate file

It sounds like the file you're trying to import is not in fact a .pk12 file. I would run this command to confirm the type of file you're importing:

openssl pkcs12 -info -in keyStore.p12

You should see something along these lines:

Enter Import Password:
MAC Iteration 2048
MAC verified OK
PKCS7 Encrypted data: pbeWithSHA1And40BitRC2-CBC, Iteration 2048
Certificate bag
Bag Attributes
    localKeyID: 74 FF 2A 04 58 90 06 B5 A0 5C EF DA C0 9B 6C AD 91 BD 1F 54 
    friendlyName: [friendly name]
subject=/C=US/ST=NY/O=My Company/OU=dept/CN=blah.blah.com
issuer=/O=My Company/OU=dept/emailAddress=blah@blah.com/L=My Town/ST=NY/C=US/CN=blah.blah.com
-----BEGIN CERTIFICATE-----

!!!REMOVED CERTIFICATE!!!!

-----END CERTIFICATE-----
Certificate bag
Bag Attributes: <No Attributes>
subject=/O=My Company/OU=dept/emailAddress=blah@blah.com/L=My Town/ST=NY/C=US/CN=blah.blah.com
issuer=/O=My Company/OU=dept/emailAddress=blah@blah.com/L=My Town/ST=NY/C=US/CN=blah.blah.com
-----BEGIN CERTIFICATE-----

!!!REMOVED CERTIFICATE!!!

-----END CERTIFICATE-----
PKCS7 Data
Shrouded Keybag: pbeWithSHA1And3-KeyTripleDES-CBC, Iteration 2048
Bag Attributes
    localKeyID: 74 FF 2A 04 58 90 06 B5 A0 5C EF DA C0 9B 6C AD 91 BD 1F 54 
    friendlyName: [friendly name]
Key Attributes: <No Attributes>
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
-----BEGIN ENCRYPTED PRIVATE KEY-----

!!!REMOVED CERTIFICATE!!!

-----END ENCRYPTED PRIVATE KEY-----

The OP ran the above command and got this error:

your command didn't work 
3077953260:error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag:tasn_dec.c:1320: 3077953260:error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error:tasn_dec.c:382:Type=PKCS12

This error was telling the OP that the .crt file they had wasn't a pkcs12/pfx file.

At this point the OP shared another question: "Failed to sign CSR with the CA root key" they had asked related to this same issue.

After reading one of the comments the OP was in fact attempting to load a .crt file into a dialog within Firefox that was expecting a pkcs12/pfx formatted certificate. See below for how to convert a .crt to a pkcs12/pfx cert.

2. Firefox "Your Certificates" Dialog

I found this question on the Firefox support forum titled: Installing certificates in .crt format into "Your certificates" that states as follows:

I have a certificate in the .crt format which needs to be in the "Your Certificates" tab.

Firefox only allows certificates in the .p12 and .pfx formats there.

How do I import this certificate into the "Your certificates" tab?

I tried to see if I can convert .crt into .p12 but no luck. (the same certificate I was able to convert to .p7b and .spc format)

Since it sounds like you have a .crt file you may be able to convert it to a pkcs12/pfx file using openssl:

openssl pkcs12 -export -in certificate.cer -inkey privateKey.key \
      -out certificate.pfx -certfile CACert.cer

NOTE: In that example CACert.cer would be the CA's .crt file. That command is mixing together your .crt file and the CA's .crt file into a pkcs12/pfx file.

The OP ran this command:

sudo openssl pkcs12 -export -in certs/device.crt -inkey private/device.key -out safaa.pfx -certfile certs/myca.crt

References

share|improve this answer
    
no , it's a signed crt . your command didn't work ` 3077953260:error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag:tasn_dec.c:1320: 3077953260:error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error:tasn_dec.c:382:Type=PKCS12` –  Nancy Smith Apr 27 '13 at 9:06
    
I'm telling you that the file suffix is "crt" , check my question [here] , device.crt the file I'm giving to the browser , it's like my question is not clear , I don't know about p7b file you are talking about (unix.stackexchange.com/questions/73836/…) –  Nancy Smith Apr 27 '13 at 9:46
    
ok , I'm still reading and trying , some links say that I have to make an openssl.cnf and edit it , some say that I have to work in etc/pki/ path , some say I have to edit apache configurations "ss.cnf" . a missing puzzle that I can't find because I'm not fully aware of the whole picture –  Nancy Smith Apr 27 '13 at 10:17
1  
what do mean by CACert.cer ? if certificate.cer stands for device.crt and privateKey.key stands for device.key , what's the third parameter in my case ? –  Nancy Smith Apr 28 '13 at 11:11
    
sudo openssl pkcs12 -export -in certs/device.crt -inkey private/device.key -out safaa.pfx -certfile certs/myca.crt It works , thanks –  Nancy Smith Apr 28 '13 at 11:34
show 5 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.