Partners







News‎ > ‎

Guide: UK e-Science Certificates and Google Chrome

posted Aug 5, 2010 3:36 AM by Peter Wright

This guide shows how to use a UK e-Science certificate with Google Chrome under Linux and has been tested with Google Chrome 6.0.472.14 dev channel build.

As per the instructions on http://code.google.com/p/chromium/wiki/LinuxCertManagement if you're using Ubuntu run:

sudo apt-get install libnss3-tools

Now we'll download, convert and insert the CA certificates:

# Convert CA PEMs into DER
curl "http://ca.grid-support.ac.uk/pub/certs/new-escience-root.pem" | openssl x509 -inform pem  -outform der -out root.der
curl "http://ca.grid-support.ac.uk/pub/certs/new-escience-ca.pem" | openssl x509 -inform pem  -outform der -out ca.der

# Make Chrome trust the e-Science CA
certutil -d sql:$HOME/.pki/nssdb -A -t "C,," -n "UK e-Science Root" -i root.der
certutil -d sql:$HOME/.pki/nssdb -A -t "C,," -n "UK e-Science CA" -i ca.der

Finally we can import your user certificate; this is stored in user-cert.p12 on my system (as exported from Firefox certificate store). If you do not wish to authenticate via your e-Science Certificate--for example if you simply wanted Chrome to trust the UK e-Science CA--then you can skip this step.

# Import personal certificate
pk12util -d sql:$HOME/.pki/nssdb -i user-cert.p12

Now we're done you can view your certificate store:

#List the store contents
certutil -d sql:$HOME/.pki/nssdb -L

Certificate Nickname Trust Attributes
SSL,S/MIME,JAR/XPI
UK e-Science Root C,,
UK e-Science CA C,,
your name here - eScienceCA u,u,u


Now you should be able to go directly to a site which requires your e-Science certificate and Chrome should now trust webservers which use e-Science server certificates.