SSL on console

[Fernando Fuentes]

Hello all.

I have configured SSL to my dirsrv and works just fine but when I try to 
configure the ssl portion for the console, Under Admin Server -> 
Encryption... I cant find my CA there. How can import it for the Admin 
console?

Using Fedore389 Admin Server 1.1.46

TIA!

[Fernando Fuentes]

By the way I follow thsi steps and I had no success.
https://access.redhat.com/documentation/en-us/red_hat_directory_server/9....

It wont allow me to enable it because there is no certificate for the 
console. Funny part is that the instructions say to only import a CA

On 8/21/19 5:45 PM, Fernando Fuentes wrote:
>  Hello all.
>
>  I have configured SSL to my dirsrv and works just fine but when I try 
>  to configure the ssl portion for the console, Under Admin Server -> 
>  Encryption... I cant find my CA there. How can import it for the Admin 
>  console?
>
>  Using Fedore389 Admin Server 1.1.46
>
>  TIA!
>  _______________________________________________
>  389-users mailing list -- 389-users(a)lists.fedoraproject.org
>  To unsubscribe send an email to 389-users-leave(a)lists.fedoraproject.org
>  Fedora Code of Conduct: 
>  https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives: 
>  https://lists.fedoraproject.org/archives/list/[e-mail]...

[Fernando Fuentes]

I think I found my problem. The server does not like the certificate 
because it was not generated inside fedora389 and it does not hold the key.

300 Dollars wasted...

Before I called this one the quits... Is there a way to import a key and 
cert generated at the OS level and not inside Fedora389?

Thanks!


On 8/21/19 8:16 PM, Fernando Fuentes wrote:
>  By the way I follow thsi steps and I had no success.
>
> https://access.redhat.com/documentation/en-us/red_hat_directory_server/9....
>
>
>
>  It wont allow me to enable it because there is no certificate for the 
>  console. Funny part is that the instructions say to only import a CA
>
>  On 8/21/19 5:45 PM, Fernando Fuentes wrote:
> > Hello all.
> >
> > I have configured SSL to my dirsrv and works just fine but when I try 
> > to configure the ssl portion for the console, Under Admin Server -> 
> > Encryption... I cant find my CA there. How can import it for the 
> > Admin console?
> >
> > Using Fedore389 Admin Server 1.1.46
> >
> > TIA!
> > _______________________________________________
> > 389-users mailing list -- 389-users(a)lists.fedoraproject.org
> > To unsubscribe send an email to 389-users-leave(a)lists.fedoraproject.org
> > Fedora Code of Conduct: 
> > https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives: 
> > https://lists.fedoraproject.org/archives/list/[e-mail]...
>  _______________________________________________
>  389-users mailing list -- 389-users(a)lists.fedoraproject.org
>  To unsubscribe send an email to 389-users-leave(a)lists.fedoraproject.org
>  Fedora Code of Conduct: 
>  https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives: 
>  https://lists.fedoraproject.org/archives/list/[e-mail]...

[Vandenburgh, Steve Y]

Yes.

If the cert and key are in PEM format, use openssl to create a PKCS12 (.p12) file.  Then
use pk12util to import the certificate into a NSS certificate database
(cert9.db,key4.db).


-----Original Message-----
From: Fernando Fuentes <ffuentes(a)aasteel.com&gt;
Sent: Wednesday, August 21, 2019 7:26 PM
To: 389-users(a)lists.fedoraproject.org
Subject: [389-users] Re: SSL on console

I think I found my problem. The server does not like the certificate because it was not
generated inside fedora389 and it does not hold the key.

300 Dollars wasted...

Before I called this one the quits... Is there a way to import a key and cert generated at
the OS level and not inside Fedora389?

Thanks!


On 8/21/19 8:16 PM, Fernando Fuentes wrote:
>  By the way I follow thsi steps and I had no success.
>  https://access.redhat.com/documentation/en-us/red_hat_directory_server
>  /9.0/html/administration_guide/managing_ssl
>
>
>  It wont allow me to enable it because there is no certificate for the
>  console. Funny part is that the instructions say to only import a CA
>
>  On 8/21/19 5:45 PM, Fernando Fuentes wrote:
> > Hello all.
> >
> > I have configured SSL to my dirsrv and works just fine but when I try
> > to configure the ssl portion for the console, Under Admin Server ->
> > Encryption... I cant find my CA there. How can import it for the
> > Admin console?
> >
> > Using Fedore389 Admin Server 1.1.46
> >
> > TIA!
> > _______________________________________________
> > 389-users mailing list -- 389-users(a)lists.fedoraproject.org To
> > unsubscribe send an email to 389-users-leave(a)lists.fedoraproject.org
> > Fedora Code of Conduct:
> > https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > List Guidelines:
> > https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives:
> > https://lists.fedoraproject.org/archives/list/[e-mail]
> > roject.org
>  _______________________________________________
>  389-users mailing list -- 389-users(a)lists.fedoraproject.org To
>  unsubscribe send an email to 389-users-leave(a)lists.fedoraproject.org
>  Fedora Code of Conduct:
>  https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines:
>  https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
>  https://lists.fedoraproject.org/archives/list/[e-mail]
>  oject.org
>  
_______________________________________________
389-users mailing list -- 389-users(a)lists.fedoraproject.org To unsubscribe send an email
to 389-users-leave(a)lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/[e-mail]...
This communication is the property of CenturyLink and may contain confidential or
privileged information. Unauthorized use of this communication is strictly prohibited and
may be unlawful. If you have received this communication in error, please immediately
notify the sender by reply e-mail and destroy all copies of the communication and any
attachments.

[Fernando Fuentes]

Thanks for your reply! 

Is there a how to for this procedure? 

Thanks! 

⁣Get BlueMail for Android ​

On Aug 21, 2019, 9:36 PM, at 9:36 PM, "Vandenburgh, Steve Y"
<steve.vandenburgh(a)centurylink.com&gt; wrote:
> Yes.
>
> If the cert and key are in PEM format, use openssl to create a PKCS12
> (.p12) file.  Then use pk12util to import the certificate into a NSS
> certificate database (cert9.db,key4.db).
>
>
> -----Original Message-----
> From: Fernando Fuentes <ffuentes(a)aasteel.com&gt;
> Sent: Wednesday, August 21, 2019 7:26 PM
> To: 389-users(a)lists.fedoraproject.org
> Subject: [389-users] Re: SSL on console
>
> I think I found my problem. The server does not like the certificate
> because it was not generated inside fedora389 and it does not hold the
> key.
>
> 300 Dollars wasted...
>
> Before I called this one the quits... Is there a way to import a key
> and cert generated at the OS level and not inside Fedora389?
>
> Thanks!
>
>
> On 8/21/19 8:16 PM, Fernando Fuentes wrote:
> > By the way I follow thsi steps and I had no success.
> >
> https://access.redhat.com/documentation/en-us/red_hat_directory_server
> > /9.0/html/administration_guide/managing_ssl
> >
> >
> > It wont allow me to enable it because there is no certificate for the
> > console. Funny part is that the instructions say to only import a CA
> >
> > On 8/21/19 5:45 PM, Fernando Fuentes wrote:
> >> Hello all.
> >>
> >> I have configured SSL to my dirsrv and works just fine but when I
> try
> >> to configure the ssl portion for the console, Under Admin Server ->
> >> Encryption... I cant find my CA there. How can import it for the
> >> Admin console?
> >>
> >> Using Fedore389 Admin Server 1.1.46
> >>
> >> TIA!
> >> _______________________________________________
> >> 389-users mailing list -- 389-users(a)lists.fedoraproject.org To
> >> unsubscribe send an email to 389-users-leave(a)lists.fedoraproject.org
> >> Fedora Code of Conduct:
> >> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> >> List Guidelines:
> >> https://fedoraproject.org/wiki/Mailing_list_guidelines
> >> List Archives:
> >>
> https://lists.fedoraproject.org/archives/list/[e-mail]
> >> roject.org
> > _______________________________________________
> > 389-users mailing list -- 389-users(a)lists.fedoraproject.org To
> > unsubscribe send an email to 389-users-leave(a)lists.fedoraproject.org
> > Fedora Code of Conduct:
> > https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > List Guidelines:
> > https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives:
> >
> https://lists.fedoraproject.org/archives/list/[e-mail]
> > oject.org
> _______________________________________________
> 389-users mailing list -- 389-users(a)lists.fedoraproject.org To
> unsubscribe send an email to 389-users-leave(a)lists.fedoraproject.org
> Fedora Code of Conduct:
> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedoraproject.org/archives/list/[e-mail]...
> This communication is the property of CenturyLink and may contain
> confidential or privileged information. Unauthorized use of this
> communication is strictly prohibited and may be unlawful. If you have
> received this communication in error, please immediately notify the
> sender by reply e-mail and destroy all copies of the communication and
> any attachments.
> _______________________________________________
> 389-users mailing list -- 389-users(a)lists.fedoraproject.org
> To unsubscribe send an email to 389-users-leave(a)lists.fedoraproject.org
> Fedora Code of Conduct:
> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedoraproject.org/archives/list/[e-mail]...

[Marc Muehlfeld]

Hi Fernando,

On 8/22/19 5:21 AM, Fernando Fuentes wrote:
>  Is there a how to for this procedure? 
## Convert to PKCS#12:
# openssl pkcs12 -export -out demo.p12 -inkey 
pki/private/demo.example.com.key -in pki/issued/demo.example.com.crt
Enter pass phrase for pki/private/demo.example.com.key:
Enter Export Password:
Verifying - Enter Export Password:

# Import to DS NSS DB:
# pk12util -i demo.p12 -d /etc/dirsrv/slapd-instance_name/ -W password
Enter Password or Pin for "NSS Certificate DB":
pk12util: no nickname for cert in PKCS12 file.
pk12util: using nickname: demo.example.com
pk12util: PKCS12 IMPORT SUCCESSFUL


## Display the imported cert:
# certutil -d /etc/dirsrv/slapd-instance_name/ -L

Certificate Nickname                                         Trust 
Attributes
 
SSL,S/MIME,JAR/XPI

demo.example.com                                             u,u,u


## Display the imported private key:
# certutil -d /etc/dirsrv/slapd-instance_name/ -K
certutil: Checking token "NSS Certificate DB" in slot "NSS User Private 
Key and Certificate Services"
Enter Password or Pin for "NSS Certificate DB":
< 0> rsa      ec30598b2107c71dd69494d51d7de6ef0e57ffbe   demo.example.com



Please let me know if it works, and DS does not complain about it when 
you use the key/cert.


Regards,
Marc



-- 
Marc Muehlfeld (Senior Technical Writer)
Customer Content Services
_______________________________________________________________________________
Red Hat GmbH, Werner-von-Siemens-Ring 14, 85630 Grasbrunn, Germany
http://www.de.redhat.com/, Registered seat: Grasbrunn,
Commercial register: Amtsgericht Muenchen, HRB 153243,
Managing Directors: Charles Cachera, Michael O'Neill,
Tom Savage, Eric Shander

[Fernando Fuentes]

Marc,

Thank you!
I will report back soon.

Regards,

Fernando Fuentes
Supervisor & Senior Systems Administrator
Email: ffuentes(a)aasteel.com
  
American Alloy Steel, Inc.
Houston, Texas
Website: http://www.aasteel.com
  
Phone: [phone]
Fax:   [phone]

On 8/22/19 2:31 AM, Marc Muehlfeld wrote:
>  Hi Fernando,
>
>  On 8/22/19 5:21 AM, Fernando Fuentes wrote:
> > Is there a how to for this procedure?
>
>  ## Convert to PKCS#12:
>  # openssl pkcs12 -export -out demo.p12 -inkey 
>  pki/private/demo.example.com.key -in pki/issued/demo.example.com.crt
>  Enter pass phrase for pki/private/demo.example.com.key:
>  Enter Export Password:
>  Verifying - Enter Export Password:
>
>  # Import to DS NSS DB:
>  # pk12util -i demo.p12 -d /etc/dirsrv/slapd-instance_name/ -W password
>  Enter Password or Pin for "NSS Certificate DB":
>  pk12util: no nickname for cert in PKCS12 file.
>  pk12util: using nickname: demo.example.com
>  pk12util: PKCS12 IMPORT SUCCESSFUL
>
>
>  ## Display the imported cert:
>  # certutil -d /etc/dirsrv/slapd-instance_name/ -L
>
>  Certificate Nickname                                         Trust 
>  Attributes
>
>  SSL,S/MIME,JAR/XPI
>
>  demo.example.com                                             u,u,u
>
>
>  ## Display the imported private key:
>  # certutil -d /etc/dirsrv/slapd-instance_name/ -K
>  certutil: Checking token "NSS Certificate DB" in slot "NSS User 
>  Private Key and Certificate Services"
>  Enter Password or Pin for "NSS Certificate DB":
>  < 0> rsa      ec30598b2107c71dd69494d51d7de6ef0e57ffbe demo.example.com
>
>
>
>  Please let me know if it works, and DS does not complain about it when 
>  you use the key/cert.
>
>
>  Regards,
>  Marc
>
>
>

[Fernando Fuentes]

Marc,

Here is what I get:

[root@hypersouth SSL]# pk12util -i hypersouth-net.p12 
/etc/dirsrv/slapd-hypersouth/ -W password
pk12util: function failed: SEC_ERROR_LEGACY_DATABASE: The 
certificate/key database is in an old, unsupported format.
[root@hypersouth SSL]#

Regards,

Fernando Fuentes
Supervisor & Senior Systems Administrator
Email: ffuentes(a)aasteel.com
  
American Alloy Steel, Inc.
Houston, Texas
Website: http://www.aasteel.com
  
Phone: [phone]
Fax:   [phone]

On 8/22/19 2:31 AM, Marc Muehlfeld wrote:
>  Hi Fernando,
>
>  On 8/22/19 5:21 AM, Fernando Fuentes wrote:
> > Is there a how to for this procedure?
>
>  ## Convert to PKCS#12:
>  # openssl pkcs12 -export -out demo.p12 -inkey 
>  pki/private/demo.example.com.key -in pki/issued/demo.example.com.crt
>  Enter pass phrase for pki/private/demo.example.com.key:
>  Enter Export Password:
>  Verifying - Enter Export Password:
>
>  # Import to DS NSS DB:
>  # pk12util -i demo.p12 -d /etc/dirsrv/slapd-instance_name/ -W password
>  Enter Password or Pin for "NSS Certificate DB":
>  pk12util: no nickname for cert in PKCS12 file.
>  pk12util: using nickname: demo.example.com
>  pk12util: PKCS12 IMPORT SUCCESSFUL
>
>
>  ## Display the imported cert:
>  # certutil -d /etc/dirsrv/slapd-instance_name/ -L
>
>  Certificate Nickname                                         Trust 
>  Attributes
>
>  SSL,S/MIME,JAR/XPI
>
>  demo.example.com                                             u,u,u
>
>
>  ## Display the imported private key:
>  # certutil -d /etc/dirsrv/slapd-instance_name/ -K
>  certutil: Checking token "NSS Certificate DB" in slot "NSS User 
>  Private Key and Certificate Services"
>  Enter Password or Pin for "NSS Certificate DB":
>  < 0> rsa      ec30598b2107c71dd69494d51d7de6ef0e57ffbe demo.example.com
>
>
>
>  Please let me know if it works, and DS does not complain about it when 
>  you use the key/cert.
>
>
>  Regards,
>  Marc
>
>
>

[Fernando Fuentes]

I caught my mistake and corrected but now I get:

[root@hypersouth SSL]# pk12util -i hypersouth-net.p12 -d 
/etc/dirsrv/slapd-hypersouth/ -W password
Enter Password or Pin for "NSS Certificate DB":
pk12util: PKCS12 decode not verified: SEC_ERROR_BAD_PASSWORD: The 
security password entered is incorrect.
pk12util: PKCS12 decode validate bags failed: SEC_ERROR_INVALID_ARGS: 
security library: invalid arguments.
[root@hypersouth SSL]#

Fernando Fuentes
Supervisor & Senior Systems Administrator
Email: ffuentes(a)aasteel.com
  
American Alloy Steel, Inc.
Houston, Texas
Website: http://www.aasteel.com
  
Phone: [phone]
Fax:   [phone]

On 8/22/19 11:13 AM, Fernando Fuentes wrote:
>  Marc,
>
>  Here is what I get:
>
>  [root@hypersouth SSL]# pk12util -i hypersouth-net.p12 
>  /etc/dirsrv/slapd-hypersouth/ -W password
>  pk12util: function failed: SEC_ERROR_LEGACY_DATABASE: The 
>  certificate/key database is in an old, unsupported format.
>  [root@hypersouth SSL]#
>
>  Regards,
>
>  Fernando Fuentes
>  Supervisor & Senior Systems Administrator
>  Email: ffuentes(a)aasteel.com
>
>  American Alloy Steel, Inc.
>  Houston, Texas
>  Website: http://www.aasteel.com
>
>  Phone: [phone]
>  Fax:   [phone]
>
>  On 8/22/19 2:31 AM, Marc Muehlfeld wrote:
> > Hi Fernando,
> >
> > On 8/22/19 5:21 AM, Fernando Fuentes wrote:
> >> Is there a how to for this procedure?
> >
> > ## Convert to PKCS#12:
> > # openssl pkcs12 -export -out demo.p12 -inkey 
> > pki/private/demo.example.com.key -in pki/issued/demo.example.com.crt
> > Enter pass phrase for pki/private/demo.example.com.key:
> > Enter Export Password:
> > Verifying - Enter Export Password:
> >
> > # Import to DS NSS DB:
> > # pk12util -i demo.p12 -d /etc/dirsrv/slapd-instance_name/ -W password
> > Enter Password or Pin for "NSS Certificate DB":
> > pk12util: no nickname for cert in PKCS12 file.
> > pk12util: using nickname: demo.example.com
> > pk12util: PKCS12 IMPORT SUCCESSFUL
> >
> >
> > ## Display the imported cert:
> > # certutil -d /etc/dirsrv/slapd-instance_name/ -L
> >
> > Certificate Nickname Trust Attributes
> >
> > SSL,S/MIME,JAR/XPI
> >
> > demo.example.com u,u,u
> >
> >
> > ## Display the imported private key:
> > # certutil -d /etc/dirsrv/slapd-instance_name/ -K
> > certutil: Checking token "NSS Certificate DB" in slot "NSS User 
> > Private Key and Certificate Services"
> > Enter Password or Pin for "NSS Certificate DB":
> > < 0> rsa      ec30598b2107c71dd69494d51d7de6ef0e57ffbe demo.example.com
> >
> >
> >
> > Please let me know if it works, and DS does not complain about it 
> > when you use the key/cert.
> >
> >
> > Regards,
> > Marc
> >
> >
> >
>  _______________________________________________
>  389-users mailing list -- 389-users(a)lists.fedoraproject.org
>  To unsubscribe send an email to 389-users-leave(a)lists.fedoraproject.org
>  Fedora Code of Conduct: 
>  https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives: 
>  https://lists.fedoraproject.org/archives/list/[e-mail]...

[Fernando Fuentes]

So I finally got it to take by doing the following:

[root@hypersouth ~]# openssl pkcs12 -export -out hypersouth-net.p12 
-inkey /etc/pki/tls/private/hypersouth_auth-2019.key -in 
/etc/pki/tls/certs/hypersouth.aasteel.net.pem -certfile 
/etc/pki/ca-trust/source/anchors/RapidSSLCA.crt
Enter pass phrase for /etc/pki/tls/private/hypersouth_auth-2019.key:
Enter Export Password:
Verifying - Enter Export Password:

[root@hypersouth ~]# ls
anaconda-ks.cfg  hypersouth-net.p12 SSL

[root@hypersouth ~]# certutil -A -n hypersouthCert -i 
/etc/pki/tls/certs/hypersouth.aasteel.net.pem -t "TCu,Cu,Tuw" -d 
/etc/dirsrv/slapd-hypersouth/
Notice: Trust flag u is set automatically if the private key is present.


[root@hypersouth ~]# certutil -A -n RapidSSLCA -i 
/etc/pki/ca-trust/source/anchors/RapidSSLCA.crt -t "TCu,Cu,Tuw" -d 
/etc/dirsrv/slapd-hypersouth/
Notice: Trust flag u is set automatically if the private key is present.

[root@hypersouth ~]# pk12util -i hypersouth-net.p12 -d 
/etc/dirsrv/slapd-hypersouth/
Enter Password or Pin for "NSS Certificate DB":
Enter password for PKCS12 file:
pk12util: PKCS12 IMPORT SUCCESSFUL


Fernando Fuentes
Supervisor & Senior Systems Administrator
Email: ffuentes(a)aasteel.com
  
American Alloy Steel, Inc.
Houston, Texas
Website: http://www.aasteel.com
  
Phone: [phone]
Fax:   [phone]

On 8/22/19 11:25 AM, Fernando Fuentes wrote:
>  I caught my mistake and corrected but now I get:
>
>  [root@hypersouth SSL]# pk12util -i hypersouth-net.p12 -d 
>  /etc/dirsrv/slapd-hypersouth/ -W password
>  Enter Password or Pin for "NSS Certificate DB":
>  pk12util: PKCS12 decode not verified: SEC_ERROR_BAD_PASSWORD: The 
>  security password entered is incorrect.
>  pk12util: PKCS12 decode validate bags failed: SEC_ERROR_INVALID_ARGS: 
>  security library: invalid arguments.
>  [root@hypersouth SSL]#
>
>  Fernando Fuentes
>  Supervisor & Senior Systems Administrator
>  Email: ffuentes(a)aasteel.com
>
>  American Alloy Steel, Inc.
>  Houston, Texas
>  Website: http://www.aasteel.com
>
>  Phone: [phone]
>  Fax:   [phone]
>
>  On 8/22/19 11:13 AM, Fernando Fuentes wrote:
> > Marc,
> >
> > Here is what I get:
> >
> > [root@hypersouth SSL]# pk12util -i hypersouth-net.p12 
> > /etc/dirsrv/slapd-hypersouth/ -W password
> > pk12util: function failed: SEC_ERROR_LEGACY_DATABASE: The 
> > certificate/key database is in an old, unsupported format.
> > [root@hypersouth SSL]#
> >
> > Regards,
> >
> > Fernando Fuentes
> > Supervisor & Senior Systems Administrator
> > Email: ffuentes(a)aasteel.com
> >
> > American Alloy Steel, Inc.
> > Houston, Texas
> > Website: http://www.aasteel.com
> >
> > Phone: [phone]
> > Fax:   [phone]
> >
> > On 8/22/19 2:31 AM, Marc Muehlfeld wrote:
> >> Hi Fernando,
> >>
> >> On 8/22/19 5:21 AM, Fernando Fuentes wrote:
> >>> Is there a how to for this procedure?
> >>
> >> ## Convert to PKCS#12:
> >> # openssl pkcs12 -export -out demo.p12 -inkey 
> >> pki/private/demo.example.com.key -in pki/issued/demo.example.com.crt
> >> Enter pass phrase for pki/private/demo.example.com.key:
> >> Enter Export Password:
> >> Verifying - Enter Export Password:
> >>
> >> # Import to DS NSS DB:
> >> # pk12util -i demo.p12 -d /etc/dirsrv/slapd-instance_name/ -W password
> >> Enter Password or Pin for "NSS Certificate DB":
> >> pk12util: no nickname for cert in PKCS12 file.
> >> pk12util: using nickname: demo.example.com
> >> pk12util: PKCS12 IMPORT SUCCESSFUL
> >>
> >>
> >> ## Display the imported cert:
> >> # certutil -d /etc/dirsrv/slapd-instance_name/ -L
> >>
> >> Certificate Nickname Trust Attributes
> >>
> >> SSL,S/MIME,JAR/XPI
> >>
> >> demo.example.com u,u,u
> >>
> >>
> >> ## Display the imported private key:
> >> # certutil -d /etc/dirsrv/slapd-instance_name/ -K
> >> certutil: Checking token "NSS Certificate DB" in slot "NSS User 
> >> Private Key and Certificate Services"
> >> Enter Password or Pin for "NSS Certificate DB":
> >> < 0> rsa      ec30598b2107c71dd69494d51d7de6ef0e57ffbe demo.example.com
> >>
> >>
> >>
> >> Please let me know if it works, and DS does not complain about it 
> >> when you use the key/cert.
> >>
> >>
> >> Regards,
> >> Marc
> >>
> >>
> >>
> > _______________________________________________
> > 389-users mailing list -- 389-users(a)lists.fedoraproject.org
> > To unsubscribe send an email to 389-users-leave(a)lists.fedoraproject.org
> > Fedora Code of Conduct: 
> > https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives: 
> > https://lists.fedoraproject.org/archives/list/[e-mail]...
>  _______________________________________________
>  389-users mailing list -- 389-users(a)lists.fedoraproject.org
>  To unsubscribe send an email to 389-users-leave(a)lists.fedoraproject.org
>  Fedora Code of Conduct: 
>  https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives: 
>  https://lists.fedoraproject.org/archives/list/[e-mail]...