1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
|
.\"
.\" certmgr manual page.
.\" Copyright 2004-2005 Novell
.\" Copyright 2010 Pablo Ruiz
.\" Author:
.\" Sebastien Pouliot <sebastien@ximian.com>
.\" Pablo Ruiz Garcia <pruiz@netway.org>
.\"
.TH Mono "certmgr"
.SH NAME
certmgr \- Mono Certificate Manager (CLI version)
.SH SYNOPSIS
.PP
.B certmgr [action] [object type] [options] store [filename]
or
.B certmgr -ssl [options] url
.SH DESCRIPTION
This tool allows to list, add, remove or extract certificates, certificate
revocation lists (CRL) or certificate trust lists (CTL) to/from a
certificate store. Certificate stores are used to build and validate
certificate chains for Authenticode(r) code signing validation and SSL
server certificates.
.SH STORES
The
.I store
represents the certificate store to use. It can be one of the
following:
.TP
.I "My"
This is the personal certificate store.
.TP
.I "AddressBook"
This is the store for other people.
.TP
.I "CA"
This is a store for intermediate certificate authorities.
.TP
.I "Trust"
This is for trusted roots.
.TP
.I "Disallowed"
This is for untrusted roots
.SH ACTIONS
.TP
.I "-list"
List the certificates, CTL or CTL in the specified store.
.TP
.I "-add"
Add a certificate, CRL or CTL to specified store. If filename is a pkcs12
or pfx file, and it contains a private key, it will be imported to local key
pair container.
.TP
.I "-del"
Remove a certificate, CRL or CTL from specified store. You must specify the
object to be removed with it's hash value (and not a filename). This hash
value is shown when doing a
.B -list
on the store.
.TP
.I "-put"
Copy a certificate, CRL or CTL from a store to a file.
.TP
.I "-ssl"
Download and add the certificates from a SSL session. You'll be asked to
confirm the addition of every certificate received from the server. Note
that SSL/TLS protocols do not requires a server to send the root certificate.
This action assumes a certificate (-c) object type and will import the
certificates in appropriate stores (i.e. server certificate in the
OtherPeople store, the root certificate in the Trust store and any other
intermediate certificates in the IntermediateCA store).
.TP
.I "-importKey"
Allows importing a private key from a pkcs12 file into a local key pair
store. (Useful when you already have the key's corresponding certificate
installed at the specific store.)
.SH OBJECT TYPES
.TP
.I "-c", "-cert", "-certificate"
Add, Delete or Put certificates. That is the specified file must/will contain
X.509 certificates in DER binary encoding.
.TP
.I "-crl"
Add, Delete or Put certificate revocation lists (CRL). That is the specified
file must/will contain X.509 CRL in DER binary encoding.
.TP
.I "-ctl"
Add, Delete or Put certificate trust lists (CRL). UNSUPPORTED.
.SH OPTIONS
.TP
.I "-m"
Use the machine's certificate stores (instead of the default user's stores).
.TP
.I "-v"
More details displayed on the console.
.TP
.I "-p password"
Use the specified password when accessing a pkcs12 file.
.TP
.I "-help", "-h", "-?", "/?"
Display help about this tool.
.SH FILES
.B WARNING: This details the current behavior of Mono and could change between releases.
The only safe way to interact with certificate stores is to use the certmgr
tool. The current releases of Mono keeps all the user certificate stores in
separates directories under
.I ~/.config/.mono/certs/
.TP
For example the trusted root certificates for a user would be kept under
.I ~/.config/.mono/certs/Trust/
.TP
Certificates files are kept in DER (binary) format (extension .cer).
.TP
The filenames either start with
.I tbp
(thumbprint) or
.I ski
(subject key identifier).
.TP
The rest of the filename is the base64-encoded value (tbp or ski).
.TP
Private key data is stored under
.I ~/.config/.mono/keypairs/
.SH EXAMPLES
.TP
.B mono certmgr.exe -list -c -m Trust
List all certificates in the machine Trust store. This will display the hash
value for each certificate. This value can be used to identify uniquely a
certificate for some operations (e.g. delete). E.g.
.B Unique Hash: FFA3AC0084DA1673B5A031EBB2156B3E8FBBF6D8
.TP
.B mono certmgr.exe -del -c -m Trust FFA3AC0084DA1673B5A031EBB2156B3E8FBBF6D8
Remove the certificate, represented by the hash value, from the machine Trust
store. Note that the machine store is normally restricted. The following
error message will appear if the current user doesn't have the minimum access
rights to remove the certificate:
.B Access to the machine 'Trust' certificate store has been denied.
.TP
.B certmgr -ssl https://www.verisign.com
Import certificates from www.verisign.com used for HTTP over SSL. See KNOWN
ISSUES (MD2) if you're downloading from www.verisign.com.
.TP
.B certmgr -ssl ldaps://www.nldap.com:636
Import the certificates from www.nldap.com used for secure LDAP. This works
even if we don't know how to speak LDAP because we stop the communication
shortly after the SSL handshake (which gives us the certificate).
.SH KNOWN ISSUES
.TP
.B MD2
Some Certificate Authorities (CA) old root certificates use the MD2 hash
algorithm. MD2 is old enough not to be part of the standard .NET framework.
This makes it impossible to validate a digital signature made with MD2. For
this reason MD2 is included in the Mono.Security.dll assembly. However the
machine.config file must be updated so the OID for MD2 is known at runtime.
To correct this insert the following XML snippet inside the <configuration>
element of your machine.config file.
<mscorlib>
<cryptographySettings>
<cryptoNameMapping>
<cryptoClasses>
<cryptoClass monoMD2="Mono.Security.Cryptography.MD2Managed, Mono.Security, Version=1.0.5000.0, Culture=neutral, PublicKeyToken=0738eb9f132ed756" />
</cryptoClasses>
<nameEntry name="MD2" class="monoMD2" />
</cryptoNameMapping>
<oidMap>
<oidEntry OID="1.2.840.113549.2.2" name="MD2" />
</oidMap>
</cryptographySettings>
</mscorlib>
.SH AUTHOR
Written by Sebastien Pouliot
Minor additions by Pablo Ruiz García
.SH COPYRIGHT
Copyright (C) 2004-2005 Novell.
.SH MAILING LISTS
Visit http://lists.ximian.com/mailman/listinfo/mono-list for details.
.SH WEB SITE
Visit http://www.mono-project.com for details
.SH SEE ALSO
.BR makecert(1), setreg(1)
|
