Re: Renewing DCM cert

Hello Justin,

Am 17.01.2022 um 16:39 schrieb Justin Taylor <jtaylor.0ab@xxxxxxxxx>:

I generated a certificate renewal using Digital Certificate Manager (DCM) and sent it to IT. They sent back a .PFX file. My notes expect a .CRT file, but I tried to proceed anyway. My notes say that I during the import I should get a "Automatically Renewed Certificate" checkbox. That checkbox didn't appear.

Leaving Windows Nomenclature aside, you sent a certificate request in PEM format and expected a PEM formatted signed request (aka: certificate) to come back. Instead you got a PKCS#12 container back.

See here for details:
- https://en.wikipedia.org/wiki/PKCS_12
- https://en.wikipedia.org/wiki/Privacy-Enhanced_Mail

Unfortunately, Windows is rather dumb and relies on extension names for treating file content properly. But since you're trying to get it into IBM i, this isn't of interest here.

You can either ask IT to provide your cert in PEM format, or convert PKCS#12 to PEM on the command line with OpenSSL:

openssl pkcs12 -in certarch.p12 -out cert.pem -clcerts -nokeys
openssl pkcs12 -in certarch.p12 -out key.pem -nocerts -nodes

Is that related to the .PFX file or did they disregard my renewal request
and get a new cert?

Without analyzing that file, it's not possible to say. Maybe call them and ask the people who created it instead of people who have no idea what your IT guys do? :-)

:wq! PoC