Exporting a personal certificate from a key repository

 

Perform the following steps on the machine from which you want to export the personal certificate:

  1. Start the iKeyman GUI using either the gsk7ikm command (on UNIX) or the strmqikm command (on Windows).

  2. From the Key Database File menu, click Open. The Open window displays.

  3. Click Key database type and select CMS (Certificate Management System).

  4. Click Browse to navigate to the directory that contains the key database files.

  5. Select the key database file to which you want to add the certificate, for example key.kdb.

  6. Click Open. The Password Prompt window displays.

  7. Type the password you set when you created the key database and click OK. The name of your key database file displays in the File Name field.

  8. In the Key database content field, select Personal Certificates and select the certificate you want to export.

  9. Click Export/Import. The Export/Import key window displays.

  10. Select Export Key.

  11. Select the Key file type of the certificate you want to export, for example PKCS12.

  12. Type the file name and location to which you want to export the certificate, or click Browse to select the name and location.

  13. Click OK. The Password Prompt window displays. Note that when you export (rather than extract) a certificate, both the public and private parts of the certificate are included. This is why the exported file is protected by a password. When you extract a certificate, only the public part of the certificate is included, so a password is not required.

  14. Type a password in the Password field, and type it again in the Confirm Password field.

  15. Click OK. The certificate is exported to the file you specified.

Use the following commands to export a personal certificate using IKEYCMD:

To export a personal certificate using GSKCapiCmd, use the following command: 

gsk7capicmd -cert -export -db filename -pw password -label label -type cms
        -target filename -target_pw password -target_type pkcs12 
        -encryption strong | weak -fips

where:

-db filename is the fully qualified path name of the CMS key database.
-encryption is the strength of encryption used in certificate export command. The value can be strong or weak. The default is strong.
-fips specifies that the command is run in FIPS mode. This mode disables the use of the BSafe cryptographic library. Only the ICC component is used and this component must be successfully initialized in FIPS mode. When in FIPS mode, the ICC component uses algorithms that have been FIPS 140-2 validated. If the ICC component does not initialize in FIPS mode, the gsk7capicmd command fails.
-pw password is the password for the CMS key database.
-label label is the label attached to the certificate.
-type cms is the type of the database.
-target filename is the name of the destination file.
-target_pw password is the password for encrypting the certificate.
-target_type pkcs12 is the type of the certificate.

 

Parent topic:

Transferring certificates


sy12340_