Importing Admin Certificate into PKI CLI

Overview

This page describes the process to import the admin certificate into PKI CLI such that the certificate can be used to execute admin operations from the command line.

This document assumes that the admin certificate and the key are stored in a PKCS #12 file (e.g. ~/.dogtag/pki-tomcat/ca_admin_cert.p12) after CA installation, and the PKCS #12 file is protected with a password specified in the pki_client_pkcs12_password parameter during installation.

Importing Admin Certificate

By default the PKI CLI uses an NSS database at ~/.dogtag/nssdb.

To import the PKCS #12 file into this NSS database, store the password for the PKCS #12 file in a file (e.g. pkcs12_password.txt), then execute the following command:

$ pki pkcs12-import \
    --pkcs12 ~/.dogtag/pki-tomcat/ca_admin_cert.p12 \
    --pkcs12-password-file pkcs12_password.txt

The certificate can be used by specifying a -n <nickname> parameter, for example:

$ pki -n caadmin ca-user-find