5

I have a GPG certificate from someone used for email

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG/MacGPG2 v2.0.14 (Darwin)

I would like to import that into Windows Certificate Manager

Imgur

So I can use it in Thunderbird, which uses Certificate Manager

Imgur

Which can only import *.crt, *.cert, *.cer, *.pem, *.der.

I couldn't find anything relevant https://duckduckgo.com/?q=convert+gpg+to+crt

I found this

http://www.sysmic.org/dotclear/index.php?post/2010/03/24/Convert-keys-betweens-GnuPG,-OpenSsh-and-OpenSSL

But I don't have access to OpenPGP2SSH.

I found MonkeySphere and compiled it from source, but it's giving an error.

C:>gpg --export --export-options export-reset-subkey-passwd,export-minimal,no-export-attributes  --no-armor 999999 > \cygwin\tmp\george.pub.key
$ openpgp2ssh 9999999 < george.pub.key  > george.ssh.key
We only support RSA keys (this key used algorithm 17).
We only support RSA keys (this key used algorithm 16).
No matching key found.
Improve this question
  • What is the reason you're trying to do this? If you want to sent encrypted mail to somebody using OpenPGP and convert his key to X.509, you will still not be able to send OpenPGP encrypted messages to him (so he's able to read it). – Jens Erat Mar 30 '15 at 22:16
  • I want to send an encrypted email and check the box in Thunderbird to encrypt it. They already have my public cert as all emails are signed, so once I have their public cert (in a format Thunderbird can use), then I can encrypt it and send to them for them to read. I don't want to use OpenPGP because Thunderbird S/MIME is easier and seamless. – Chloe Mar 30 '15 at 23:29
  • The sysmic link about key conversion is about converting (private) keys between different key formats, not about converting certificates/signatures between different systems. Why would anyone convert a key(pair) for re-use in a different system? Perhaps to have fewer keys to protect? I dont know. – MattBianco Mar 31 '15 at 7:18
  • 2
    Install Enigmail instead, which is an OpenPGP implementation for Thunderbird. The Windows certificate store wouldn't have helped anyway, as Thunderbird manages his own. – Jens Erat Mar 31 '15 at 7:28
  • 1
    Have a look at your own screenshot, it shows the Thunderbird Certificate Manager (and a Thunderbird icon in the title bar). Even the Mozilla products Thunderbird and Firefox do not have a common certificate store, horrible usability issue when you want to manage certificates... – Jens Erat Apr 1 '15 at 7:23
7

Short answer: you can't, because they are two different and incompatible key+certificate systems.

Longer answer:

  • Windows Certificate Manager uses X.509 certificates, each of which must be signed by a Certification Authority whose root certificate is considered valid by Windows. Thunderbird will use the public key stored in your recipient's certificate to encrypt content.
  • OpenPGP and GPG use their own certificate format that is unrelated to X.509, and use their own encryption and signing mechanisms which are incompatible with S/MIME.

SSH is unrelated to either, so of no help to you.

Improve this answer
  • Ok. I was planning to use a self-signed certificate. I don't remember how postmaster@example.com got in there, but obviously it doesn't need to be a certificate authority. I don't know why they are incompatible. The keys are just numbers. – Chloe Apr 1 '15 at 5:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.