0

I have a certificate file (with extension .cer) that has content which looks something like this.

-----BEGIN CERTIFICATE-----
lots of data here
-----END CERTIFICATE-----

It is our signing certificate. I am sharing it with a third party so that they can import it in the gpg public keyring. They are using below command to import it

gpg --import signing_cert.cer

But it gives this error.

gpg: please see http://www.gnupg.org/faq.html for more information
gpg: no valid OpenPGP data found.
gpg: Total number processed: 0

Looks like it might certificate format used in both Windows and gpg is different. Is there a way for my signing certificate to be imported into gpg public keyring. Any help is highly appreciated.

5
  • 2
    Sounds wrong in the first place. .cer and .asc are no formats but file extensions. Your .cer file contains a PEM encoded certificate and should have a .pem file extension. So what do you need for which scenario?
    – cornelinux
    May 20, 2016 at 17:28
  • I have a signing certificate with me. I want to share it with a third party. They are asking me to share it in .asc format so that they can import it into their pgp keyring. I asked them if they can use the .cer file that I am sharing. But they are insisting that they need a .asc file. I am not able to find any command that will convert the .cer file to .asc for me.
    – user55926
    May 23, 2016 at 5:48
  • @cornelinux: I have updated the question, could you provide some help
    – user55926
    May 24, 2016 at 11:30
  • 1
    What are they trying to accomplish? I presume you don't use either this certificate or the key associated with it to make PGP signatures. So why do they want to import it into their PGP keyring? What do they think that will do for them? Whatever they're trying to do, there's probably a good way to do it, but you haven't told us why they're trying to do this, and it's definitely not obvious. Did you ask them why they want to import a certificate that isn't used to make or verify PGP or GPG signatures into their PGP keyring? May 24, 2016 at 12:23
  • they are trying to add our trust our certificate.
    – user55926
    May 24, 2016 at 13:17

3 Answers 3

2

That does not look like an OpenPGP/GPG key.

-----BEGIN CERTIFICATE-----
<...alphabet soup...>
-----END CERTIFICATE-----

...is the standard framing for a PEM-encoded X.509 certificate, which is not compatible with OpenPGP/GPG certificates. They are two different certificate systems. You can view the contents of a X.509 certificate in a human-readable form with:

openssl x509 -in <filename> -noout -text

An ASCII-armored OpenPGP/GPG public key would begin like this:

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG/MacGPG2 v2.0.14 (Darwin)

The Version: line indicates the name and version of the OpenPGP compatible software that was used to create or export the key.

1

from my article.

https://www.pengdows.com/2020/06/27/convert-a-x-509-pki-certificate-to-gpg/

Steps

Break the pfx (p12) into pem files that can be used. For some reason, GPG cant handle standard encoding.

openssl pkcs12 -in sectigo.pfx  -nokeys -out gpg-certs.pem
openssl pkcs12 -in sectigo.pfx -nocerts -out gpg-key.pem

Combine the keys into something GPG recognizes

openssl pkcs12 -export -in gpg-certs.pem -inkey gpg-key.pem -out gpg-key.p12

Import into GPG

gpgsm --import gpg-key.p12

At this point we have the p12 imported, and we can see it in Kleopatra, but we can’t use it for PGP operations.

cat gpg-key.pem | PEM2OPENPGP_USAGE_FLAGS=authenticate pem2openpgp "Your Name <[email protected]>" > key.pgp

Now!!!! we have a pgp key and you import key.pgp into gpg and it will absolutely have the same key ask your certificate.

gpg --import key.pgp
-1

I believe you can't convert .crt to GPG certificate. Please have a look at the link

https://security.stackexchange.com/questions/84904/how-do-i-convert-a-gpg-certificate-to-a-crt-certificate-that-can-be-imported-int

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .