How do I make a digital certificate available to LibreOffice Writer for digital signatures?

Question

I obtained a client certificate from CAcert through Firefox. I want to use that certificate to sign a document created with LibreOffice Writer.

In Writer, I click File > Digital Signatures... to get the Digital Signatures dialog which is supposed to show the list of certificates available. The list is empty.

How can I make the certificate, which I obtained via Firefox, available to Writer?

Solution 1

Part One: With Firefox, back up the certificate as a .p12 file.

1. In Firefox, click Edit > Preferences to display the Preferences dialog.

2. On the Preferences dialog, click the Advanced button.

3. On the Advanced form, click the the View Certificates button to display the Certificate Manager dialog.

4. On the Certificate Manager dialog, click the Your Certificates tab.

5. Expand the relevant certificate authority name and click the relevant certificate to select it.

6. Click the Backup button to display a Save As dialog titled File Name to Backup.

7. On the File Name to Backup dialog, in the Name text box, type the name you want to give to the backup copy of the file.

8. Select the folder in which you want to save the file.

9. Click the Save button to display the Choose a Certificate Backup Password dialog.

10. Type your chosen password twice. Click the OK button.

11. An Alert dialog will appear, informing you that your certificates and private keys were successfully backed up. Click the OK button.

12. Close the other two open dialogs.

Part 2: With Thunderbird, import the .p12 file to Thunderbirds certificate store.

1. In Thunderbird, click Edit > Prefereces, to display the Thunderbird Preferences dialog.

2. Click the Advanced button on the top menu.

3. On the Advanced form, click the Certificates tab.

4. Click the View Certificates button to display the Certificate Manager dialog.

5. Click the Your Certificates tab.

6. Click the Import button to display the Certificates to Import dialog.

7. Find the .p12 file which you backed from Firefox, click it and click the Open button to display the Password Entry dialog.

8. Type the password you used to backup the file from Firefox and click the OK button.

9. An Alert dialog will appear, indicating that the operation was successfull.

10. Close the other two open dialogs.

Part 3: In Thunderbird, edit the root certificate of your certificate authority to make it trusted for identifying websites, mail users and software makers.

1. Display the Certificate Manager dialog as described in Part 2.

2. On the Certificate Manager dialog, click the Authorities tab.

3. In the list of root certificates, click on your certificate authority's certificate to select it.

4. Click the Edit Trust... button to display the Edit Trust Settings dialog.

5. Check the three checkboxes to make your certificate authority trusted for websites, email and software.

6. Click the OK button.

7. Close all open dialogs.

Part 4: In LibreOffice Writer, verify that the certificate is available for digital signatures.

1. Close all Writer windows which may have been running.

2. Open an existing Writer document (because you can only view the certificates from a file which is saved to disk).

3. Click File > Digital Signatures... to display the Digital Signatures dialog.

4. Click the Sign Document button to display the Select Certificate dialog.

Your certificate will appear in the list of certificates.

Solution 2

For me the Firefox certificate path did not work (probably because the certificate physically resided on smart card reader - hardware dongle). Here are the steps to make it visible for LibreOffice Writer:

# Create local NSS database:
sudo apt-get install libnss3-tools
mkdir -p $HOME/.pki/nssdb
certutil -N -d sql:$HOME/.pki/nssdb

# Import the root (signing) certificates if necessary. For example:
certutil -d sql:$HOME/.pki/nssdb -A -t "CT,C,C" -n "InfoNotary CSP Root" -i in-csp-root.cer

# Allow the certificate from smart card (in this case of type OpenSC) to be accessed:
modutil -dbdir sql:$HOME/.pki/nssdb -add "OpenSC" -libfile /usr/lib/onepin-opensc-pkcs11.so -mechanisms FRIENDLY

# Alternatively, for smart cards of type Bit4id use:
modutil -dbdir sql:$HOME/.pki/nssdb -add "Bit4id" -libfile /usr/lib/libbit4ipki.so -mechanisms FRIENDLY

Then in LibreOffice Writer: menu Tools > Options > Security > Certificate Path select directory '~/.pki/nssdb'.

Solution 3

If you have Thunderbird installed, you need to import the certificate into Thunderbird's certificates store.

Solution 4

Another option is to use TinyCA to generate your own certificate.

If your Certificate does not show up in Libreoffice check:

Tools => Options => Security => Certificate Path

(Thunderbird is the default certificate store):

View more solutions

Comments

[Geoffrey]

Thanks. I wrote a step-by-step explanation in my answer.

[tohuwawohu]

Well done - very nice explanation!

[GUI Junkie]

Great, just discovered that the trust is NOT the same in Firefox as in Thunderbird.

[Akronix]

And how can I add signatures to the Select Certificate dialog in Libreoffice?

[Tobi Obadiah]

Did not work for me.

[tim_uni]

Unfortunately, part 3 step 5 of this answer does only include two checkboxes for me (mail and websites), so there seems to be no option to allow external applications to use the certificate anymore.