= Using PKI PKCS7 CLI =

== Importing Certificate Chain into NSS Database ==

To import a PKCS #7 file that contains a certificate chain into NSS database (default: `~/.dogtag/nssdb`):

----
$ pki pkcs7-import --pkcs7 cert_chain.p7b
----

Optionally, the nickname and the trust flags for the leaf certificate can be specified as follows:

----
$ pki pkcs7-import --pkcs7 cert_chain.p7b --trust-flags <trust flags> <nickname>
----

== Exporting Certificate Chain from NSS Database ==

To export a certificate chain from NSS database into a PKCS #7 file:

----
$ pki pkcs7-export <nickname> --pkcs7 cert_chain.p7b
----

== Listing Certificates in PKCS #7 File ==

To list the certificates in a PKCS #7 file:

----
$ pki pkcs7-cert-find --pkcs7 cert_chain.p7b
  Serial Number: 0x1
  Subject DN: CN=CA Signing Certificate,O=EXAMPLE
  Issuer DN: CN=CA Signing Certificate,O=EXAMPLE

  Serial Number: 0x5
  Subject DN: CN=localhost.localdomain
  Issuer DN: CN=CA Signing Certificate,O=EXAMPLE
----

== Importing Certificates into PKCS #7 File ==

To import a certificate into a new PKCS #7 file:

----
$ pki pkcs7-cert-import --pkcs7 cert_chain.p7b --input-file ca_signing.crt
----

To append a certificate into an existing PKCS #7 file:

----
$ pki pkcs7-cert-import --pkcs7 cert_chain.p7b --input-file sslserver.crt --append
----

*Note:* The `pki pkcs7-cert-import` command can import a file that contains
a single PEM certificate, multiple PEM certificates, or PKCS #7 data.

== Exporting Certificates from PKCS #7 File ==

To export certificates from a PKCS #7 file into a series of PEM certificates
in a single file:

----
$ pki pkcs7-cert-export --pkcs7 cert_chain.p7b --output-file cert_chain.crt
----

To export certificates from a PKCS #7 file into PEM certificates in separate files:

----
$ pki pkcs7-cert-export --pkcs7 cert_chain.p7b --output-prefix cert- --output-suffix .crt
Exported cert-0.crt: CN=CA Signing Certificate,O=EXAMPLE
Exported cert-1.crt: CN=localhost.localdomain
----
