Exporting a personal certificate from a key repository

Follow this procedure to exporting a personal certificate.

Using iKeyman

If you need to manage SSL certificates in a way that is FIPS compliant, use the runmqakm command. iKeyman does not provide a FIPS-compliant option.

Perform the following steps on the machine from which you want to export the personal certificate:

Start the iKeyman GUI using the strmqikm command (on Windows UNIX and Linux® ).
From the Key Database File menu, click Open. The Open window opens.
Click Key database type and select CMS (Certificate Management System).
Click Browse to navigate to the directory that contains the key database files.
Select the key database file from which you want to export the certificate, for example key.kdb.
Click Open. The Password Prompt window opens.
Type the password you set when you created the key database and click OK. The name of your key database file is displayed in the File Name field.
In the Key database content field, select Personal Certificates and select the certificate you want to export.
Click Export/Import. The Export/Import key window opens.
Select Export Key.
Select the Key file type of the certificate you want to export, for example PKCS12.
Type the file name and location to which you want to export the certificate, or click Browse to select the name and location.
Click OK. The Password Prompt window opens. Note that when you export (rather than extract) a certificate, both the public and private parts of the certificate are included. This is why the exported file is protected by a password. When you extract a certificate, only the public part of the certificate is included, so a password is not required.
Type a password in the Password field, and type it again in the Confirm Password field.
Click OK. The certificate is exported to the file you specified.

Using the command line

Use the following commands to export a personal certificate using iKeycmd:

On UNIX, Linux and Windows:


runmqckm -cert -export -db filename -pw password -label label -type cms
        -target filename -target_pw password -target_type pkcs12

where:

-db filename is the fully qualified path name of the CMS key database.

-pw password is the password for the CMS key database.

-label label is the label attached to the certificate.

-type cms is the type of the database.

-target filename is the fully qualified path name of the destination file.

-target_pw password is the password for encrypting the certificate.

-target_type pkcs12 is the type of the certificate.