Publishing your X.509 certificate

How to put your S/MIME certificate on to your website

One of the issues faced by people using S/MIME (and in particular those used to using PGP) is one of getting their public key, their certificate to other people.  In PGP you simply export your public key to a text file and bung it on a web page. Others come along and download it, and install it into PGP. Simple. So how do we do it with S/MIME, or more correctly, your X.509 certificate.

Extracting the X.509 certificate

The first problem is extracting your certificate into a format that can be used by others. You don't want to give away your private key, just the public part.

Internet Explorer

Incredibly, this is easy in IE :-)

• Go to the menu option Tools then Internet Options.
• Select the Content tabgroup, and click on the Certificates button.
• Highlight the cert you want to export from your personal list, then click the button Export...
• Within the Export Wizard choose No to the private key option, then choose Base-64 encoded X.509.
• Microsoft call this a CER file, but it is also PEM format (not that you need to worry about this).
• Choose your filename, and go for it.

-----BEGIN CERTIFICATE-----
OIoinwoeifnowiec98ycojknIUhcwoueUBCEIUbiwevoiwnef
-----END CERTIFICATE-----

There will actually be quite a few more lines between the BEGIN and END lines within your file.

That's the file to put on to your web server, see MIME type below.

Netscape and Mozilla derivatives

Things aren't so easy if you use Netscape 4, or one of the Mozilla based browsers (Netscape 6/7, Beonex etc). As things stand with Mozilla v1.1 you cannot export your public certificate. If someone knows how to do this as part of the UI, please let me know.

By far the simplest way is to export/backup your certificate into a PKCS#12 file (.p12) and import it into IE on a windows machine, then follow the actions above. If you don't have access to a Windows machine, read on.

Another method is to use something like OpenSSL (http://www.openssl.org/), which can read PKCS#12 files, and pull them apart, saving your public certificate. OpenSSL compiles easily on numerous UNIX systems, and also Windows (if you have Dev Studio). I believe it's pre-installed on Linux and FreeBSD. Once compiled into the openssl binary, you can use it to extract the public key from your exported/backed up PKCS#12 file.

The following command line parameters should do the trick

openssl pkcs12 -in exportFile.p12 -out MyCert.pem -clcerts -nokeys

This will create the PEM formatted file... but it does contain some extra information before the BEGIN CERTIFICATE line. You can safely remove the lines but do not remove the BEGIN CERTIFICATE line!

Publishing on a web site

It's simple enough to upload the page to your web site of choice and then create a link to it, but not all web sites will correctly set the MIME type for the created file. If you have a nice ISP, they may have already got this set up in their server, and it should recognise a file extension of .PEM or .CER although they probably do not.

You could ask them to do so, or you could ask them what file extension they have registered for this MIME type, but either way the correct MIME type for this file is application/x-x509-email-cert.