2

I have the file with X.509 certificates and the following preamble:

# This is a bundle of X.509 certificates of public Certificate
# Authorities.  It was generated from the Mozilla root CA list.
# These certificates are in the OpenSSL "TRUSTED CERTIFICATE"
# format and have trust bits set accordingly.
# An exception are auxiliary certificates, without positive or negative
# trust, but are used to assist in finding a preferred trust path.
# Those neutral certificates use the plain BEGIN CERTIFICATE format.

I tried to import it from command line but it fails:

$ sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain /Users/dzieciou/projects/mg/etc/pki/tls/certs/megabundle.crt

readFile: short read
***Error reading file /Users/dzieciou/projects/mg/etc/pki/tls/certs/
Error reading file /Users/dzieciou/projects/mg/etc/pki/tls/certs/megabundle.crt

I was able to import those certificates into Firefox on MacOS but Firefox does not use the system keychain.

|improve this question
  • Shouldn't you point to the cert (whole path to certificate) instead of pointing to the directory? – Mateusz Szlosek Feb 11 at 10:53
  • @MateuszSzlosek I've updated my question. You're right. It should be the file. But the problem persists. – dzieciou Feb 11 at 10:55
  • Is there a specific application or tool that you want to use these certificates with? Adding them to the Keychain will affect most graphical browsers and applications but may not be found by open source tools. – Graham Miln Feb 11 at 11:00
  • 1
    @GrahamMiln I want it to be used with python setuptools, which in turn uses system provided certificate database: python.org/dev/peps/pep-0476 – dzieciou Feb 11 at 11:04
  • Got it. I need to openssl x509 -in mycert.crt -out mycert.pem -outform PEM – dzieciou Feb 11 at 11:15
0

Keychain Access

You can import a wide range of certificate formats with macOS's Keychain application.

  1. Open Applications > Utilities > Keychain Access.app
  2. Select the menu item: File > Import Items…

Default Keychain

The imported items will appear in the current default keychain. If this is not what you want, be sure to change the default before importing.

|improve this answer
  • An error has occurred. Unable to import an item. The contents of this item cannot be retrieved. – dzieciou Feb 11 at 11:06
0

I resolved it by converting it first to PEM format…

openssl x509 -in megabundle.crt -out megabundle.pem -outform PEM

…and then importing using the command in the question.

|improve this answer

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.