title: CURL NSS client certificate not found myCert
body: <p>I'm trying to use curl to access a https address passing it my certificate and validating the server's certificate with my own truststore (we have our own CA). I am for now running as root.</p>
  
  <pre><code>curl -v --cert /home/cdfoote/myCertificate.pem:mypassword --cacert /home/cdfoote/truststore.pem https://host.com:8444
  </code></pre>
  
  <p>This gives me the error:</p>
  
  <pre><code>Unable to load client cert -8018
  NSS error -8018
  </code></pre>
  
  <p>Googling that and determining that my curl was compiled with nss I've converted my certificate to a .pfx (I started with a .jks) and imported it into the nss db via:</p>
  
  <pre><code>pk12util -i /home/cdfoote/myCertificate.pfx -d /etc/pki/nssdb
  </code></pre>
  
  <p>I see it when I list all certs in the db:</p>
  
  <pre><code>certutil -L -d /etc/pki/nssdb
  </code></pre>
  
  <p>I see its details when I list it by nickname:</p>
  
  <pre><code>certutil -L -d /etc/pki/nssdb -n myCert
  </code></pre>
  
  <p>I've made the db available via:</p>
  
  <pre><code>export SSL_DIR=/etc/pki/nssdb
  </code></pre>
  
  <p>Now, the curl command I'm running is:</p>
  
  <pre><code>curl -v --cert myCert --cacert /home/cdfoote/truststore.pem https://host.com:8444
  </code></pre>
  
  <p>The response is:</p>
  
  <pre><code>About to connect to https//host.com port 8444 (#0)
  Trying ipaddress
  Connected to host.com (ipaddress) port 8444(#0)
  Initializing NSS with certpath: sql:/etc/pki/nssdb
  CAfile: /home/cdfoote/truststore.pem
  CApath: none
  NSS: client certificate not found: myCert
  SSL connection using TLS_DHE_RSA_WITH_AES_256_CBC_SHA
  Server certificate:
  ...
  {
      "status" : "403 - Forbidden",
  ...
  </code></pre>
  
  <p>A few questions:</p>
  
  <ol>
  <li><p>Does 'CApath: none' indicate the truststore is not found even though the 'CAfile' is correct? If so, any ideas why it isn't found?</p></li>
  <li><p>Any idea why 'myCert' is not found even though NSS is initialized to the correct 'certpath' (and it listed fine)? </p></li>
  <li><p>On another box, where apparently curl is compiled with openssl rather than NSS, the original curl command above works. Is there any way I can run curl that way without recompiling it?</p></li>
  </ol>
  
  <p>Thanks in advance,
  Craig</p>