Grid certificate installation ==> any advice / proper instructions ?

[mulders]

With Chrome on a Windows computer I was able to install a new Grid certificate without any problem after a few clicks... but with Safari on a Mac it has been a total disaster. Also tried with Chrome and Mozilla ... still total failure. Official CERN help and CMS twiki instructions are useless ==> does anyone know a good explanation how to do this? ... it is really frustrating to get stuck with this already in the first pre-exercise :-1 :-1 :-1

[4quarks]

Hey Martijn,
It is a .p12 file, isn't it? You need a .pem file to install the certificate into your browser. Can you please try to run the following commands in order to extract the certificate and key from the .p12 file. I am not sure if it works on iOS...

$ openssl pkcs12 -in my_certificate.p12 -clcerts -nokeys -out usercert.pem
$ openssl pkcs12 -in my_certificate.p12 -nocerts -out userkey.pem
$ chmod go-r userkey.pem
$ chmod go-r usercert.pem

[lecriste]

On a Mac it was easy for me with Firefox, more cumbersome with Safari, didn't try with Chrome.
Which problem have you with Firefox?

[clelange]

There is a conceptual difference in how Safari/Chrome and Firefox handle certificates on macOS:

• Safari/Chrome use the system KeyChain
• Firefox handles its own certificates

I don't know how this is done on Linux/Windows. @mulders could you elaborate on what you did on Mac?

[mulders]

Well, following the links from the 1st exercise to the CMS web pages it says you are on your own, go to the CERN page
https://ca.cern.ch/ca/ which is self-explanatory and in case of questions ask the helpdesk ... here I click on the first link "get a new CERN GRID certificat" , make up a password for it, download the certificate and click on the link provided to go the help pages at https://ca.cern.ch/ca/Help/ ==> now it becomes completely unclear what to do next

[mulders]

The file that was downloaded is myCertificate.p12

[mulders]

If I double-click this file, it offers to install it in my System (or login or iCloud) keychain... so I chose "System"

[mulders]

Now if I try to open https://cmsweb.cern.ch/das/ in Safari, it starts looking in my "login" keychain, without success

[mulders]

Ok, I double-clicked the p12 file again and also installed it in my "login" keychain ... makes no difference... it askes a couple of times for my Mac "login" password and then gives up

[mulders]

Hey Martijn,
It is a .p12 file, isn't it? You need a .pem file to install the certificate into your browser. Can you please try to run the following commands in order to extract the certificate and key from the .p12 file. I am not sure if it works on iOS...

$ openssl pkcs12 -in my_certificate.p12 -clcerts -nokeys -out usercert.pem
$ openssl pkcs12 -in my_certificate.p12 -nocerts -out userkey.pem
$ chmod go-r userkey.pem
$ chmod go-r usercert.pem

Hi @paucutrina ... I confirm that I can do this... but what do I do with the two .pem files created? They are now in my Downloads folder...

[4quarks]

Go to firefox --> preferences --> pivacy and security --> view certificates --> your certificates --> import --> select the .pem file

[4quarks]

On Chrome you can go to Settings --> Privacy and security --> security --> Manage certificates --> Import --> select .p12 file