Convert to pdf - self signed certificate

kristopher · June 9, 2020, 7:34am

Hi,

I want to use libfreoffice to convert html file to pdf. I execeute command like below.
Because img src is refere to domain with untrusted certificate than image isn’t convert properly. The problem doesn’t occur for trusted certificate. For domain https://test.com I have self-signed certificate - there is no possibility use signed certificate in this case.

/opt/libreoffice6.3/program/soffice.bin --headless --norestore --writer --convert-to pdf sample.html

There is html file which I try convert to pdf:

<!DOCTYPE html>
<html>
  <title>Page Title</title>
  <body>
    This is just a simple Hello World
  <img src='https://test.com/test.img'>
  </body>
</html>

I found that LibreOffice use nss. On server where LibreOffice is installed I found following nss database:

/etc/pki/nssdb
/root/.pki/nssdb
/etc/openldap/cert

Each of this database is empty. How LibreOffice verifiy signed certificate? Which store is used?
I tried import my self-signed certificate to this database but html still isn’t properly converted.
What should I do to allow libfreoffice use my self-signed certificate or is it possible tell libfreoffice to ignore untrusted certificate? I use libfreoffice on Centos7 withouth GUI.
Thank you in advance.

kristopher · June 18, 2020, 8:20am

I resolved my problem in the following way:

Create new directory for my NssDB and create nss database with empty password

mkdir /root/MyNssDB

certutil -N -d /root/MyNssDB/ (set empty password)

Import all certificates existing in chain of certificates for domain https://test.com. I extracted this certificates with command openssl s_client -showcerts -connect test.com:443 -servername test.com. I save each certificate in separate file.

$ certutil -A -n "cert1" -t "P,," -i cert1.crt -d /root/MyNssDB

$ certutil -A -n "cert2" -t "P,," -i cert2.crt -d /root/MyNssDB

set MOZILLA_CERTIFICATE_FOLDER environment

$ export MOZILLA_CERTIFICATE_FOLDER=sql:/root/MyNssDB