Client SSL Certificate on Linux: Chrome, Chromium, Firefox

This guide continues the article Configuring Client Certificate Authentication on Nginx. You have a user1.p12 file with the certificate and private key, and its password. Now it needs to be installed in the browser.

Unlike Windows or macOS, Linux has no shared system store for client certificates. Each application uses its own NSS Shared Database:

So Chromium-based browsers need to be set up once, and Firefox separately.

Chrome, Chromium and other Chromium-based browsers

Using the browser UI

1. Open Settings → Privacy and security → Security → Manage certificates (or type chrome://certificate-manager in the address bar).
2. Go to Your certificates (in older versions, the Your certificates tab of the Manage certificates dialog).
3. Click Import, select user1.p12 and enter its password.

The certificate appears in the list. Restart the browser to make sure it picks up the change, then open the site. The browser will ask you to choose a certificate; pick the one you installed.

From the command line

You need the NSS tools package. On Debian/Ubuntu/Mint:

sudo apt update
sudo apt install libnss3-tools

On Fedora/CentOS/RHEL:

sudo dnf install nss-tools

On Arch Linux the tools are part of the nss package.

If the database does not exist yet (the browser has never been started), create it:

mkdir -p $HOME/.pki/nssdb
certutil -d sql:$HOME/.pki/nssdb -N --empty-password

Import the PKCS#12 certificate from a .p12 or .pfx file. The tool will ask for the file password:

pk12util -d sql:$HOME/.pki/nssdb -i user1.p12

List installed certificates (-L) and private keys (-K):

certutil -d sql:$HOME/.pki/nssdb -L
certutil -d sql:$HOME/.pki/nssdb -K

Delete a certificate together with its private key. Take the certificate name from the certutil -L output:

certutil -d sql:$HOME/.pki/nssdb -F -n "Certificate Name"

For Chromium from Snap or Flatpak browsers, use the database path from the table above.

Firefox

Using the browser UI

1. Open the menu and choose Settings.
2. Go to Privacy & Security, find the Certificates section and click View Certificates… You can also open about:preferences#privacy directly.
3. On the Your Certificates tab click Import…, select user1.p12 and enter its password.

The certificate appears in the list. On the first visit to the site Firefox asks which certificate to use. If you check Remember this decision, the choice is saved on the Authentication Decisions tab, where it can also be reset.

From the command line

Firefox uses the same NSS database format, so the libnss3-tools / nss-tools utilities work here too. You only need the profile directory. Find it on the about:profiles page: the Root Directory line of the default profile. Usually it is:

• $HOME/.mozilla/firefox/xxxxxxxx.default-release for Firefox from distribution packages or from Mozilla;
• $HOME/snap/firefox/common/.mozilla/firefox/xxxxxxxx.default for Firefox from Snap (the default on Ubuntu);
• $HOME/.var/app/org.mozilla.firefox/.mozilla/firefox/xxxxxxxx.default-release for Firefox from Flatpak.

Close Firefox before importing so that it does not hold the database open.

PROFILE=$HOME/.mozilla/firefox/xxxxxxxx.default-release
pk12util -d sql:$PROFILE -i user1.p12
certutil -d sql:$PROFILE -L

If the Firefox database has a Primary Password, pk12util asks for it first and then for the .p12 password.

Deleting works the same way as for Chromium:

certutil -d sql:$PROFILE -F -n "Certificate Name"

Troubleshooting

• The browser does not offer a certificate. Check that the certificate is signed by the CA set in ssl_client_certificate in the nginx configuration, and that the CA and the client have different Organization Name fields.
• The wrong certificate was selected. Chromium remembers the choice until the browser restarts, so close all its windows. In Firefox, remove the entry on the Authentication Decisions tab.
• Password error on import. Make sure the password is correct. If the file was created by a very old OpenSSL version with outdated algorithms, recreate it with a current version.
• Checking without a browser. If curl --cert user1.crt --key user1.key https://example.com works but the browser does not, the problem is in the certificate installation, not in the server configuration.

Guides for other systems: Windows, macOS, Android and iOS.