$company allows Mac users to request a client certificate via Symantec PKI to connect to their SSL VPN server. This process involves going to a specific Symantec website (has some sort of ID to identify $company) and entering your name ("Common Name") and Email address. Once approved by a company admin it gives you a link which downloads a
.cer file, and when this is imported into
Keychain there is a user-named Certificate and a private key linked to it.
Where did that private key come from? It doesn't appear in the
.cer file (which appears to be 3 certificates bundled in PKCS#7 format). Is there some trigger when imported that tells
Keychain to go and fetch a private key from the PKI server? Is there any generic tool (e.g.
openssl) to do that on Linux?
.cer file contains a certificate with
CN=MyNameHere (the user), an Issuing CA certificate belonging to $company, and an Intermediate CA certificate also belonging to $company.
Here's an article explaining how to export the private key under windows, but unfortunately doesn't explain how the private key got there either.
Here's another doc from a Mac perspective about exporting the private key, but again doesn't go into how the key gets there in the first place.