mirror of
https://repo.dactyloidae.xyz/Dactyloidae/UXP.git
synced 2026-09-20 15:27:32 +09:00
re-introduce old nss im too tired for this
This commit is contained in:
wuggy
parent
3c46be320d
commit
3a838106b9
2871 changed files with 1374431 additions and 1762417 deletions
|
|
@ -208,7 +208,7 @@ If this option is not used, the validity check defaults to the current system ti
|
|||
<listitem><para><command>sql:</command> requests the newer database</para></listitem>
|
||||
<listitem><para><command>dbm:</command> requests the legacy database</para></listitem>
|
||||
</itemizedlist>
|
||||
<para>If no prefix is specified the default type is retrieved from NSS_DEFAULT_DB_TYPE. If NSS_DEFAULT_DB_TYPE is not set then <command>sql:</command> is the default.</para>
|
||||
<para>If no prefix is specified the default type is retrieved from NSS_DEFAULT_DB_TYPE. If NSS_DEFAULT_DB_TYPE is not set then <command>dbm:</command> is the default.</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
|
|
@ -848,13 +848,13 @@ Comma separated list of one or more of the following:
|
|||
<para>
|
||||
These databases must be created before certificates or keys can be generated.
|
||||
</para>
|
||||
<programlisting>certutil -N -d directory</programlisting>
|
||||
<programlisting>certutil -N -d [sql:]directory</programlisting>
|
||||
|
||||
<para><command>Creating a Certificate Request</command></para>
|
||||
<para>
|
||||
A certificate request contains most or all of the information that is used to generate the final certificate. This request is submitted separately to a certificate authority and is then approved by some mechanism (automatically or by human review). Once the request is approved, then the certificate is generated.
|
||||
</para>
|
||||
<programlisting>$ certutil -R -k key-type-or-id [-q pqgfile|curve-name] -g key-size -s subject [-h tokenname] -d directory [-p phone] [-o output-file] [-a]</programlisting>
|
||||
<programlisting>$ certutil -R -k key-type-or-id [-q pqgfile|curve-name] -g key-size -s subject [-h tokenname] -d [sql:]directory [-p phone] [-o output-file] [-a]</programlisting>
|
||||
<para>
|
||||
The <option>-R</option> command options requires four arguments:
|
||||
</para>
|
||||
|
|
@ -886,7 +886,7 @@ Comma separated list of one or more of the following:
|
|||
<para>
|
||||
For example:
|
||||
</para>
|
||||
<programlisting>$ certutil -R -k rsa -g 1024 -s "CN=John Smith,O=Example Corp,L=Mountain View,ST=California,C=US" -d $HOME/nssdb -p 650-555-0123 -a -o cert.cer
|
||||
<programlisting>$ certutil -R -k rsa -g 1024 -s "CN=John Smith,O=Example Corp,L=Mountain View,ST=California,C=US" -d sql:$HOME/nssdb -p 650-555-0123 -a -o cert.cer
|
||||
|
||||
Generating key. This may take a few moments...
|
||||
|
||||
|
|
@ -896,7 +896,7 @@ Generating key. This may take a few moments...
|
|||
<para>
|
||||
A valid certificate must be issued by a trusted CA. This can be done by specifying a CA certificate (<option>-c</option>) that is stored in the certificate database. If a CA key pair is not available, you can create a self-signed certificate using the <option>-x</option> argument with the <option>-S</option> command option.
|
||||
</para>
|
||||
<programlisting>$ certutil -S -k rsa|dsa|ec -n certname -s subject [-c issuer |-x] -t trustargs -d directory [-m serial-number] [-v valid-months] [-w offset-months] [-p phone] [-1] [-2] [-3] [-4] [-5 keyword] [-6 keyword] [-7 emailAddress] [-8 dns-names] [--extAIA] [--extSIA] [--extCP] [--extPM] [--extPC] [--extIA] [--extSKID]</programlisting>
|
||||
<programlisting>$ certutil -S -k rsa|dsa|ec -n certname -s subject [-c issuer |-x] -t trustargs -d [sql:]directory [-m serial-number] [-v valid-months] [-w offset-months] [-p phone] [-1] [-2] [-3] [-4] [-5 keyword] [-6 keyword] [-7 emailAddress] [-8 dns-names] [--extAIA] [--extSIA] [--extCP] [--extPM] [--extPC] [--extIA] [--extSKID]</programlisting>
|
||||
<para>
|
||||
The series of numbers and <option>--ext*</option> options set certificate extensions that can be added to the certificate when it is generated by the CA. Interactive prompts will result.
|
||||
</para>
|
||||
|
|
@ -916,17 +916,17 @@ The interative prompts for key usage and whether any extensions are critical and
|
|||
<para>
|
||||
When a certificate request is created, a certificate can be generated by using the request and then referencing a certificate authority signing certificate (the <emphasis>issuer</emphasis> specified in the <option>-c</option> argument). The issuing certificate must be in the certificate database in the specified directory.
|
||||
</para>
|
||||
<programlisting>certutil -C -c issuer -i cert-request-file -o output-file [-m serial-number] [-v valid-months] [-w offset-months] -d directory [-1] [-2] [-3] [-4] [-5 keyword] [-6 keyword] [-7 emailAddress] [-8 dns-names]</programlisting>
|
||||
<programlisting>certutil -C -c issuer -i cert-request-file -o output-file [-m serial-number] [-v valid-months] [-w offset-months] -d [sql:]directory [-1] [-2] [-3] [-4] [-5 keyword] [-6 keyword] [-7 emailAddress] [-8 dns-names]</programlisting>
|
||||
<para>
|
||||
For example:
|
||||
</para>
|
||||
<programlisting>$ certutil -C -c "my-ca-cert" -i /home/certs/cert.req -o cert.cer -m 010 -v 12 -w 1 -d $HOME/nssdb -1 nonRepudiation,dataEncipherment -5 sslClient -6 clientAuth -7 jsmith@example.com</programlisting>
|
||||
<programlisting>$ certutil -C -c "my-ca-cert" -i /home/certs/cert.req -o cert.cer -m 010 -v 12 -w 1 -d sql:$HOME/nssdb -1 nonRepudiation,dataEncipherment -5 sslClient -6 clientAuth -7 jsmith@example.com</programlisting>
|
||||
|
||||
<para><command>Listing Certificates</command></para>
|
||||
<para>
|
||||
The <option>-L</option> command option lists all of the certificates listed in the certificate database. The path to the directory (<option>-d</option>) is required.
|
||||
</para>
|
||||
<programlisting>$ certutil -L -d /home/my/sharednssdb
|
||||
<programlisting>$ certutil -L -d sql:/home/my/sharednssdb
|
||||
|
||||
Certificate Nickname Trust Attributes
|
||||
SSL,S/MIME,JAR/XPI
|
||||
|
|
@ -939,7 +939,7 @@ Certificate Authority - Example Domain CT,C,C</programlist
|
|||
Using additional arguments with <option>-L</option> can return and print the information for a single, specific certificate. For example, the <option>-n</option> argument passes the certificate name, while the <option>-a</option> argument prints the certificate in ASCII format:
|
||||
</para>
|
||||
<programlisting>
|
||||
$ certutil -L -d $HOME/nssdb -a -n my-ca-cert
|
||||
$ certutil -L -d sql:$HOME/nssdb -a -n my-ca-cert
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIB1DCCAT2gAwIBAgICDkIwDQYJKoZIhvcNAQEFBQAwFTETMBEGA1UEAxMKRXhh
|
||||
bXBsZSBDQTAeFw0xMzAzMTMxOTEwMjlaFw0xMzA2MTMxOTEwMjlaMBUxEzARBgNV
|
||||
|
|
@ -954,7 +954,7 @@ ob2rb8XRVVJkzXdXxlk4uo3UtNvw8sAz7sWD71qxKaIHU5q49zijfg==
|
|||
-----END CERTIFICATE-----
|
||||
</programlisting>
|
||||
<para>For a human-readable display</para>
|
||||
<programlisting>$ certutil -L -d $HOME/nssdb -n my-ca-cert
|
||||
<programlisting>$ certutil -L -d sql:$HOME/nssdb -n my-ca-cert
|
||||
Certificate:
|
||||
Data:
|
||||
Version: 3 (0x2)
|
||||
|
|
@ -1027,7 +1027,7 @@ Certificate:
|
|||
<para>
|
||||
To list all keys in the database, use the <option>-K</option> command option and the (required) <option>-d</option> argument to give the path to the directory.
|
||||
</para>
|
||||
<programlisting>$ certutil -K -d $HOME/nssdb
|
||||
<programlisting>$ certutil -K -d sql:$HOME/nssdb
|
||||
certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and Certificate Services "
|
||||
< 0> rsa 455a6673bde9375c2887ec8bf8016b3f9f35861d Thawte Freemail Member's Thawte Consulting (Pty) Ltd. ID
|
||||
< 1> rsa 40defeeb522ade11090eacebaaf1196a172127df Example Domain Administrator Cert
|
||||
|
|
@ -1057,7 +1057,7 @@ certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and
|
|||
<para>
|
||||
The devices that can be used to store certificates -- both internal databases and external devices like smart cards -- are recognized and used by loading security modules. The <option>-U</option> command option lists all of the security modules listed in the <filename>secmod.db</filename> database. The path to the directory (<option>-d</option>) is required.
|
||||
</para>
|
||||
<programlisting>$ certutil -U -d /home/my/sharednssdb
|
||||
<programlisting>$ certutil -U -d sql:/home/my/sharednssdb
|
||||
|
||||
slot: NSS User Private Key and Certificate Services
|
||||
token: NSS Certificate DB
|
||||
|
|
@ -1071,51 +1071,51 @@ certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and
|
|||
<para>
|
||||
Existing certificates or certificate requests can be added manually to the certificate database, even if they were generated elsewhere. This uses the <option>-A</option> command option.
|
||||
</para>
|
||||
<programlisting>certutil -A -n certname -t trustargs -d directory [-a] [-i input-file]</programlisting>
|
||||
<programlisting>certutil -A -n certname -t trustargs -d [sql:]directory [-a] [-i input-file]</programlisting>
|
||||
<para>
|
||||
For example:
|
||||
</para>
|
||||
<programlisting>$ certutil -A -n "CN=My SSL Certificate" -t ",," -d /home/my/sharednssdb -i /home/example-certs/cert.cer</programlisting>
|
||||
<programlisting>$ certutil -A -n "CN=My SSL Certificate" -t ",," -d sql:/home/my/sharednssdb -i /home/example-certs/cert.cer</programlisting>
|
||||
<para>
|
||||
A related command option, <option>-E</option>, is used specifically to add email certificates to the certificate database. The <option>-E</option> command has the same arguments as the <option>-A</option> command. The trust arguments for certificates have the format <emphasis>SSL,S/MIME,Code-signing</emphasis>, so the middle trust settings relate most to email certificates (though the others can be set). For example:
|
||||
</para>
|
||||
<programlisting>$ certutil -E -n "CN=John Smith Email Cert" -t ",P," -d /home/my/sharednssdb -i /home/example-certs/email.cer</programlisting>
|
||||
<programlisting>$ certutil -E -n "CN=John Smith Email Cert" -t ",P," -d sql:/home/my/sharednssdb -i /home/example-certs/email.cer</programlisting>
|
||||
|
||||
<para><command>Deleting Certificates to the Database</command></para>
|
||||
<para>
|
||||
Certificates can be deleted from a database using the <option>-D</option> option. The only required options are to give the security database directory and to identify the certificate nickname.
|
||||
</para>
|
||||
<programlisting>certutil -D -d directory -n "nickname"</programlisting>
|
||||
<programlisting>certutil -D -d [sql:]directory -n "nickname"</programlisting>
|
||||
<para>
|
||||
For example:
|
||||
</para>
|
||||
<programlisting>$ certutil -D -d /home/my/sharednssdb -n "my-ssl-cert"</programlisting>
|
||||
<programlisting>$ certutil -D -d sql:/home/my/sharednssdb -n "my-ssl-cert"</programlisting>
|
||||
|
||||
<para><command>Validating Certificates</command></para>
|
||||
<para>
|
||||
A certificate contains an expiration date in itself, and expired certificates are easily rejected. However, certificates can also be revoked before they hit their expiration date. Checking whether a certificate has been revoked requires validating the certificate. Validation can also be used to ensure that the certificate is only used for the purposes it was initially issued for. Validation is carried out by the <option>-V</option> command option.
|
||||
</para>
|
||||
<programlisting>certutil -V -n certificate-name [-b time] [-e] [-u cert-usage] -d directory</programlisting>
|
||||
<programlisting>certutil -V -n certificate-name [-b time] [-e] [-u cert-usage] -d [sql:]directory</programlisting>
|
||||
<para>
|
||||
For example, to validate an email certificate:
|
||||
</para>
|
||||
<programlisting>$ certutil -V -n "John Smith's Email Cert" -e -u S,R -d /home/my/sharednssdb</programlisting>
|
||||
<programlisting>$ certutil -V -n "John Smith's Email Cert" -e -u S,R -d sql:/home/my/sharednssdb</programlisting>
|
||||
|
||||
<para><command>Modifying Certificate Trust Settings</command></para>
|
||||
<para>
|
||||
The trust settings (which relate to the operations that a certificate is allowed to be used for) can be changed after a certificate is created or added to the database. This is especially useful for CA certificates, but it can be performed for any type of certificate.
|
||||
</para>
|
||||
<programlisting>certutil -M -n certificate-name -t trust-args -d directory</programlisting>
|
||||
<programlisting>certutil -M -n certificate-name -t trust-args -d [sql:]directory</programlisting>
|
||||
<para>
|
||||
For example:
|
||||
</para>
|
||||
<programlisting>$ certutil -M -n "My CA Certificate" -d /home/my/sharednssdb -t "CT,CT,CT"</programlisting>
|
||||
<programlisting>$ certutil -M -n "My CA Certificate" -d sql:/home/my/sharednssdb -t "CT,CT,CT"</programlisting>
|
||||
|
||||
<para><command>Printing the Certificate Chain</command></para>
|
||||
<para>
|
||||
Certificates can be issued in <emphasis>chains</emphasis> because every certificate authority itself has a certificate; when a CA issues a certificate, it essentially stamps that certificate with its own fingerprint. The <option>-O</option> prints the full chain of a certificate, going from the initial CA (the root CA) through ever intermediary CA to the actual certificate. For example, for an email certificate with two CAs in the chain:
|
||||
</para>
|
||||
<programlisting>$ certutil -d /home/my/sharednssdb -O -n "jsmith@example.com"
|
||||
<programlisting>$ certutil -d sql:/home/my/sharednssdb -O -n "jsmith@example.com"
|
||||
"Builtin Object Token:Thawte Personal Freemail CA" [E=personal-freemail@thawte.com,CN=Thawte Personal Freemail CA,OU=Certification Services Division,O=Thawte Consulting,L=Cape Town,ST=Western Cape,C=ZA]
|
||||
|
||||
"Thawte Personal Freemail Issuing CA - Thawte Consulting" [CN=Thawte Personal Freemail Issuing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA]
|
||||
|
|
@ -1126,11 +1126,11 @@ certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and
|
|||
<para>
|
||||
The device which stores certificates -- both external hardware devices and internal software databases -- can be blanked and reused. This operation is performed on the device which stores the data, not directly on the security databases, so the location must be referenced through the token name (<option>-h</option>) as well as any directory path. If there is no external token used, the default value is internal.
|
||||
</para>
|
||||
<programlisting>certutil -T -d directory -h token-name -0 security-officer-password</programlisting>
|
||||
<programlisting>certutil -T -d [sql:]directory -h token-name -0 security-officer-password</programlisting>
|
||||
<para>
|
||||
Many networks have dedicated personnel who handle changes to security tokens (the security officer). This person must supply the password to access the specified token. For example:
|
||||
</para>
|
||||
<programlisting>$ certutil -T -d /home/my/sharednssdb -h nethsm -0 secret</programlisting>
|
||||
<programlisting>$ certutil -T -d sql:/home/my/sharednssdb -h nethsm -0 secret</programlisting>
|
||||
|
||||
<para><command>Upgrading or Merging the Security Databases</command></para>
|
||||
<para>
|
||||
|
|
@ -1139,19 +1139,19 @@ certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and
|
|||
<para>
|
||||
The <option>--upgrade-merge</option> command must give information about the original database and then use the standard arguments (like <option>-d</option>) to give the information about the new databases. The command also requires information that the tool uses for the process to upgrade and write over the original database.
|
||||
</para>
|
||||
<programlisting>certutil --upgrade-merge -d directory [-P dbprefix] --source-dir directory --source-prefix dbprefix --upgrade-id id --upgrade-token-name name [-@ password-file]</programlisting>
|
||||
<programlisting>certutil --upgrade-merge -d [sql:]directory [-P dbprefix] --source-dir directory --source-prefix dbprefix --upgrade-id id --upgrade-token-name name [-@ password-file]</programlisting>
|
||||
<para>
|
||||
For example:
|
||||
</para>
|
||||
<programlisting>$ certutil --upgrade-merge -d /home/my/sharednssdb --source-dir /opt/my-app/alias/ --source-prefix serverapp- --upgrade-id 1 --upgrade-token-name internal</programlisting>
|
||||
<programlisting>$ certutil --upgrade-merge -d sql:/home/my/sharednssdb --source-dir /opt/my-app/alias/ --source-prefix serverapp- --upgrade-id 1 --upgrade-token-name internal</programlisting>
|
||||
<para>
|
||||
The <option>--merge</option> command only requires information about the location of the original database; since it doesn't change the format of the database, it can write over information without performing interim step.
|
||||
</para>
|
||||
<programlisting>certutil --merge -d directory [-P dbprefix] --source-dir directory --source-prefix dbprefix [-@ password-file]</programlisting>
|
||||
<programlisting>certutil --merge -d [sql:]directory [-P dbprefix] --source-dir directory --source-prefix dbprefix [-@ password-file]</programlisting>
|
||||
<para>
|
||||
For example:
|
||||
</para>
|
||||
<programlisting>$ certutil --merge -d /home/my/sharednssdb --source-dir /opt/my-app/alias/ --source-prefix serverapp-</programlisting>
|
||||
<programlisting>$ certutil --merge -d sql:/home/my/sharednssdb --source-dir /opt/my-app/alias/ --source-prefix serverapp-</programlisting>
|
||||
|
||||
<para><command>Running certutil Commands from a Batch File</command></para>
|
||||
<para>
|
||||
|
|
@ -1207,16 +1207,17 @@ BerkeleyDB. These new databases provide more accessibility and performance:</par
|
|||
|
||||
<para>Because the SQLite databases are designed to be shared, these are the <emphasis>shared</emphasis> database type. The shared database type is preferred; the legacy format is included for backward compatibility.</para>
|
||||
|
||||
<para>By default, the tools (<command>certutil</command>, <command>pk12util</command>, <command>modutil</command>) assume that the given security databases use the SQLite type.
|
||||
Using the legacy databases must be manually specified by using the <command>dbm:</command> prefix with the given security directory. For example:</para>
|
||||
<para>By default, the tools (<command>certutil</command>, <command>pk12util</command>, <command>modutil</command>) assume that the given security databases follow the more common legacy type.
|
||||
Using the SQLite databases must be manually specified by using the <command>sql:</command> prefix with the given security directory. For example:</para>
|
||||
|
||||
<programlisting>$ certutil -L -d dbm:/home/my/sharednssdb</programlisting>
|
||||
<programlisting>$ certutil -L -d sql:/home/my/sharednssdb</programlisting>
|
||||
|
||||
<para>To set the legacy database type as the default type for the tools, set the <envar>NSS_DEFAULT_DB_TYPE</envar> environment variable to <envar>dbm</envar>:</para>
|
||||
<programlisting>export NSS_DEFAULT_DB_TYPE="dbm"</programlisting>
|
||||
<para>To set the shared database type as the default type for the tools, set the <envar>NSS_DEFAULT_DB_TYPE</envar> environment variable to <envar>sql</envar>:</para>
|
||||
<programlisting>export NSS_DEFAULT_DB_TYPE="sql"</programlisting>
|
||||
|
||||
<para>This line can be set added to the <filename>~/.bashrc</filename> file to make the change permanent.</para>
|
||||
|
||||
<para>Most applications do not use the shared database by default, but they can be configured to use them. For example, this how-to article covers how to configure Firefox and Thunderbird to use the new shared NSS databases:</para>
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
<para>
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><title>CERTUTIL</title><meta name="generator" content="DocBook XSL Stylesheets Vsnapshot"><link rel="home" href="index.html" title="CERTUTIL"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">CERTUTIL</th></tr></table><hr></div><div class="refentry"><a name="certutil"></a><div class="titlepage"></div><div class="refnamediv"><h2>Name</h2><p>certutil — Manage keys and certificate in both NSS databases and other NSS tokens</p></div><div class="refsynopsisdiv"><h2>Synopsis</h2><div class="cmdsynopsis"><p><code class="command">certutil</code> [<em class="replaceable"><code>options</code></em>] [[<em class="replaceable"><code>arguments</code></em>]]</p></div></div><div class="refsection"><a name="idm45463138886352"></a><h2>STATUS</h2><p>This documentation is still work in progress. Please contribute to the initial review in <a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=836477" target="_top">Mozilla NSS bug 836477</a>
|
||||
<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><title>CERTUTIL</title><meta name="generator" content="DocBook XSL Stylesheets Vsnapshot"><link rel="home" href="index.html" title="CERTUTIL"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">CERTUTIL</th></tr></table><hr></div><div class="refentry"><a name="certutil"></a><div class="titlepage"></div><div class="refnamediv"><h2>Name</h2><p>certutil — Manage keys and certificate in both NSS databases and other NSS tokens</p></div><div class="refsynopsisdiv"><h2>Synopsis</h2><div class="cmdsynopsis"><p><code class="command">certutil</code> [<em class="replaceable"><code>options</code></em>] [[<em class="replaceable"><code>arguments</code></em>]]</p></div></div><div class="refsection"><a name="idm46274732654912"></a><h2>STATUS</h2><p>This documentation is still work in progress. Please contribute to the initial review in <a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=836477" target="_top">Mozilla NSS bug 836477</a>
|
||||
</p></div><div class="refsection"><a name="description"></a><h2>Description</h2><p>The Certificate Database Tool, <span class="command"><strong>certutil</strong></span>, is a command-line utility that can create and modify certificate and key databases. It can specifically list, generate, modify, or delete certificates, create or change the password, generate new public and private key pairs, display the contents of the key database, or delete key pairs within the key database.</p><p>Certificate issuance, part of the key and certificate management process, requires that keys and certificates be created in the key database. This document discusses certificate and key database management. For information on the security module database management, see the <span class="command"><strong>modutil</strong></span> manpage.</p></div><div class="refsection"><a name="options"></a><h2>Command Options and Arguments</h2><p>Running <span class="command"><strong>certutil</strong></span> always requires one and only one command option to specify the type of certificate operation. Each command option may take zero or more arguments. The command option <code class="option">-H</code> will list all the command options and their relevant arguments.</p><p><span class="command"><strong>Command Options</strong></span></p><div class="variablelist"><dl class="variablelist"><dt><span class="term">-A </span></dt><dd><p>Add an existing certificate to a certificate database. The certificate database should already exist; if one is not present, this command option will initialize one by default.</p></dd><dt><span class="term">-B</span></dt><dd><p>Run a series of commands from the specified batch file. This requires the <code class="option">-i</code> argument.</p></dd><dt><span class="term">-C </span></dt><dd><p>Create a new binary certificate file from a binary certificate request file. Use the <code class="option">-i</code> argument to specify the certificate request file. If this argument is not used, <span class="command"><strong>certutil</strong></span> prompts for a filename. </p></dd><dt><span class="term">-D </span></dt><dd><p>Delete a certificate from the certificate database.</p></dd><dt><span class="term">--rename </span></dt><dd><p>Change the database nickname of a certificate.</p></dd><dt><span class="term">-E </span></dt><dd><p>Add an email certificate to the certificate database.</p></dd><dt><span class="term">-F</span></dt><dd><p>Delete a private key and the associated certificate from a database. Specify the key to delete with the -n argument or the -k argument. Specify the database from which to delete the key with the
|
||||
<code class="option">-d</code> argument.
|
||||
</p><p>
|
||||
|
|
@ -6,11 +6,11 @@ Some smart cards do not let you remove a public key you have generated. In such
|
|||
Use the -h tokenname argument to specify the certificate database on a particular hardware or software token.</p></dd><dt><span class="term">-M </span></dt><dd><p>Modify a certificate's trust attributes using the values of the -t argument.</p></dd><dt><span class="term">-N</span></dt><dd><p>Create new certificate and key databases.</p></dd><dt><span class="term">-O </span></dt><dd><p>Print the certificate chain.</p></dd><dt><span class="term">-R</span></dt><dd><p>Create a certificate request file that can be submitted to a Certificate Authority (CA) for processing into a finished certificate. Output defaults to standard out unless you use -o output-file argument.
|
||||
|
||||
Use the -a argument to specify ASCII output.</p></dd><dt><span class="term">-S </span></dt><dd><p>Create an individual certificate and add it to a certificate database.</p></dd><dt><span class="term">-T </span></dt><dd><p>Reset the key database or token.</p></dd><dt><span class="term">-U </span></dt><dd><p>List all available modules or print a single named module.</p></dd><dt><span class="term">-V </span></dt><dd><p>Check the validity of a certificate and its attributes.</p></dd><dt><span class="term">-W </span></dt><dd><p>Change the password to a key database.</p></dd><dt><span class="term">--merge</span></dt><dd><p>Merge two databases into one.</p></dd><dt><span class="term">--upgrade-merge</span></dt><dd><p>Upgrade an old database and merge it into a new database. This is used to migrate legacy NSS databases (<code class="filename">cert8.db</code> and <code class="filename">key3.db</code>) into the newer SQLite databases (<code class="filename">cert9.db</code> and <code class="filename">key4.db</code>).</p></dd></dl></div><p><span class="command"><strong>Arguments</strong></span></p><p>Arguments modify a command option and are usually lower case, numbers, or symbols.</p><div class="variablelist"><dl class="variablelist"><dt><span class="term">-a</span></dt><dd><p>Use ASCII format or allow the use of ASCII format for input or output. This formatting follows RFC 1113.
|
||||
For certificate requests, ASCII output defaults to standard output unless redirected.</p></dd><dt><span class="term">--simple-self-signed</span></dt><dd><p>When printing the certificate chain, don't search for a chain if issuer name equals to subject name.</p></dd><dt><span class="term">-b validity-time</span></dt><dd><p>Specify a time at which a certificate is required to be valid. Use when checking certificate validity with the <code class="option">-V</code> option. The format of the <span class="emphasis"><em>validity-time</em></span> argument is <span class="emphasis"><em>YYMMDDHHMMSS[+HHMM|-HHMM|Z]</em></span>, which allows offsets to be set relative to the validity end time. Specifying seconds (<span class="emphasis"><em>SS</em></span>) is optional. When specifying an explicit time, use a Z at the end of the term, <span class="emphasis"><em>YYMMDDHHMMSSZ</em></span>, to close it. When specifying an offset time, use <span class="emphasis"><em>YYMMDDHHMMSS+HHMM</em></span> or <span class="emphasis"><em>YYMMDDHHMMSS-HHMM</em></span> for adding or subtracting time, respectively.
|
||||
For certificate requests, ASCII output defaults to standard output unless redirected.</p></dd><dt><span class="term">-b validity-time</span></dt><dd><p>Specify a time at which a certificate is required to be valid. Use when checking certificate validity with the <code class="option">-V</code> option. The format of the <span class="emphasis"><em>validity-time</em></span> argument is <span class="emphasis"><em>YYMMDDHHMMSS[+HHMM|-HHMM|Z]</em></span>, which allows offsets to be set relative to the validity end time. Specifying seconds (<span class="emphasis"><em>SS</em></span>) is optional. When specifying an explicit time, use a Z at the end of the term, <span class="emphasis"><em>YYMMDDHHMMSSZ</em></span>, to close it. When specifying an offset time, use <span class="emphasis"><em>YYMMDDHHMMSS+HHMM</em></span> or <span class="emphasis"><em>YYMMDDHHMMSS-HHMM</em></span> for adding or subtracting time, respectively.
|
||||
</p><p>
|
||||
If this option is not used, the validity check defaults to the current system time.</p></dd><dt><span class="term">-c issuer</span></dt><dd><p>Identify the certificate of the CA from which a new certificate will derive its authenticity.
|
||||
Use the exact nickname or alias of the CA certificate, or use the CA's email address. Bracket the issuer string
|
||||
with quotation marks if it contains spaces. </p></dd><dt><span class="term">-d [prefix]directory</span></dt><dd><p>Specify the database directory containing the certificate and key database files.</p><p><span class="command"><strong>certutil</strong></span> supports two types of databases: the legacy security databases (<code class="filename">cert8.db</code>, <code class="filename">key3.db</code>, and <code class="filename">secmod.db</code>) and new SQLite databases (<code class="filename">cert9.db</code>, <code class="filename">key4.db</code>, and <code class="filename">pkcs11.txt</code>). </p><p>NSS recognizes the following prefixes:</p><div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem"><p><span class="command"><strong>sql:</strong></span> requests the newer database</p></li><li class="listitem"><p><span class="command"><strong>dbm:</strong></span> requests the legacy database</p></li></ul></div><p>If no prefix is specified the default type is retrieved from NSS_DEFAULT_DB_TYPE. If NSS_DEFAULT_DB_TYPE is not set then <span class="command"><strong>sql:</strong></span> is the default.</p></dd><dt><span class="term">--dump-ext-val OID </span></dt><dd><p>For single cert, print binary DER encoding of extension OID.</p></dd><dt><span class="term">-e </span></dt><dd><p>Check a certificate's signature during the process of validating a certificate.</p></dd><dt><span class="term">--email email-address</span></dt><dd><p>Specify the email address of a certificate to list. Used with the -L command option.</p></dd><dt><span class="term">--extGeneric OID:critical-flag:filename[,OID:critical-flag:filename]... </span></dt><dd><p>
|
||||
with quotation marks if it contains spaces. </p></dd><dt><span class="term">-d [prefix]directory</span></dt><dd><p>Specify the database directory containing the certificate and key database files.</p><p><span class="command"><strong>certutil</strong></span> supports two types of databases: the legacy security databases (<code class="filename">cert8.db</code>, <code class="filename">key3.db</code>, and <code class="filename">secmod.db</code>) and new SQLite databases (<code class="filename">cert9.db</code>, <code class="filename">key4.db</code>, and <code class="filename">pkcs11.txt</code>). </p><p>NSS recognizes the following prefixes:</p><div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem"><p><span class="command"><strong>sql:</strong></span> requests the newer database</p></li><li class="listitem"><p><span class="command"><strong>dbm:</strong></span> requests the legacy database</p></li></ul></div><p>If no prefix is specified the default type is retrieved from NSS_DEFAULT_DB_TYPE. If NSS_DEFAULT_DB_TYPE is not set then <span class="command"><strong>dbm:</strong></span> is the default.</p></dd><dt><span class="term">--dump-ext-val OID </span></dt><dd><p>For single cert, print binary DER encoding of extension OID.</p></dd><dt><span class="term">-e </span></dt><dd><p>Check a certificate's signature during the process of validating a certificate.</p></dd><dt><span class="term">--email email-address</span></dt><dd><p>Specify the email address of a certificate to list. Used with the -L command option.</p></dd><dt><span class="term">--extGeneric OID:critical-flag:filename[,OID:critical-flag:filename]... </span></dt><dd><p>
|
||||
Add one or multiple extensions that certutil cannot encode yet, by loading their encodings from external files.
|
||||
</p><div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem"><p>OID (example): 1.2.3.4</p></li><li class="listitem"><p>critical-flag: critical or not-critical</p></li><li class="listitem"><p>filename: full path to a file containing an encoded extension</p></li></ul></div></dd><dt><span class="term">-f password-file</span></dt><dd><p>Specify a file that will automatically supply the password to include in a certificate
|
||||
or to access a certificate database. This is a plain-text file containing one password. Be sure to prevent
|
||||
|
|
@ -55,7 +55,7 @@ of the attribute codes:
|
|||
The attribute codes for the categories are separated by commas, and the entire set of attributes enclosed by quotation marks. For example:
|
||||
</p><p><span class="command"><strong>-t "TC,C,T"</strong></span></p><p>
|
||||
Use the -L option to see a list of the current certificates and trust attributes in a certificate database. </p><p>
|
||||
Note that the output of the -L option may include "u" flag, which means that there is a private key associated with the certificate. It is a dynamic flag and you cannot set it with certutil. </p></dd><dt><span class="term">-u certusage</span></dt><dd><p>Specify a usage context to apply when validating a certificate with the -V option.</p><p>The contexts are the following:</p><div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem"><p><span class="command"><strong>C</strong></span> (as an SSL client)</p></li><li class="listitem"><p><span class="command"><strong>V</strong></span> (as an SSL server)</p></li><li class="listitem"><p><span class="command"><strong>L</strong></span> (as an SSL CA)</p></li><li class="listitem"><p><span class="command"><strong>A</strong></span> (as Any CA)</p></li><li class="listitem"><p><span class="command"><strong>Y</strong></span> (Verify CA)</p></li><li class="listitem"><p><span class="command"><strong>S</strong></span> (as an email signer)</p></li><li class="listitem"><p><span class="command"><strong>R</strong></span> (as an email recipient)</p></li><li class="listitem"><p><span class="command"><strong>O</strong></span> (as an OCSP status responder)</p></li><li class="listitem"><p><span class="command"><strong>J</strong></span> (as an object signer)</p></li><li class="listitem"><p><span class="command"><strong>I</strong></span> (as an IPSEC user)</p></li></ul></div></dd><dt><span class="term">-v valid-months</span></dt><dd><p>Set the number of months a new certificate will be valid. The validity period begins at the current system time unless an offset is added or subtracted with the <code class="option">-w</code> option. If this argument is not used, the default validity period is three months. </p></dd><dt><span class="term">-w offset-months</span></dt><dd><p>Set an offset from the current system time, in months,
|
||||
Note that the output of the -L option may include "u" flag, which means that there is a private key associated with the certificate. It is a dynamic flag and you cannot set it with certutil. </p></dd><dt><span class="term">-u certusage</span></dt><dd><p>Specify a usage context to apply when validating a certificate with the -V option.</p><p>The contexts are the following:</p><div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem"><p><span class="command"><strong>C</strong></span> (as an SSL client)</p></li><li class="listitem"><p><span class="command"><strong>V</strong></span> (as an SSL server)</p></li><li class="listitem"><p><span class="command"><strong>L</strong></span> (as an SSL CA)</p></li><li class="listitem"><p><span class="command"><strong>A</strong></span> (as Any CA)</p></li><li class="listitem"><p><span class="command"><strong>Y</strong></span> (Verify CA)</p></li><li class="listitem"><p><span class="command"><strong>S</strong></span> (as an email signer)</p></li><li class="listitem"><p><span class="command"><strong>R</strong></span> (as an email recipient)</p></li><li class="listitem"><p><span class="command"><strong>O</strong></span> (as an OCSP status responder)</p></li><li class="listitem"><p><span class="command"><strong>J</strong></span> (as an object signer)</p></li></ul></div></dd><dt><span class="term">-v valid-months</span></dt><dd><p>Set the number of months a new certificate will be valid. The validity period begins at the current system time unless an offset is added or subtracted with the <code class="option">-w</code> option. If this argument is not used, the default validity period is three months. </p></dd><dt><span class="term">-w offset-months</span></dt><dd><p>Set an offset from the current system time, in months,
|
||||
for the beginning of a certificate's validity period. Use when creating
|
||||
the certificate or adding it to a database. Express the offset in integers,
|
||||
using a minus sign (-) to indicate a negative offset. If this argument is
|
||||
|
|
@ -110,20 +110,6 @@ of the attribute codes:
|
|||
msTrustListSign
|
||||
</p></li><li class="listitem"><p>
|
||||
critical
|
||||
</p></li><li class="listitem"><p>
|
||||
x509Any
|
||||
</p></li><li class="listitem"><p>
|
||||
ipsecIKE
|
||||
</p></li><li class="listitem"><p>
|
||||
ipsecIKEEnd
|
||||
</p></li><li class="listitem"><p>
|
||||
ipsecIKEIntermediate
|
||||
</p></li><li class="listitem"><p>
|
||||
ipsecEnd
|
||||
</p></li><li class="listitem"><p>
|
||||
ipsecTunnel
|
||||
</p></li><li class="listitem"><p>
|
||||
ipsecUser
|
||||
</p></li></ul></div><p>X.509 certificate extensions are described in RFC 5280.</p></dd><dt><span class="term">-7 emailAddrs</span></dt><dd><p>Add a comma-separated list of email addresses to the subject alternative name extension of a certificate or certificate request that is being created or added to the database. Subject alternative name extensions are described in Section 4.2.1.7 of RFC 3280.</p></dd><dt><span class="term">-8 dns-names</span></dt><dd><p>Add a comma-separated list of DNS names to the subject alternative name extension of a certificate or certificate request that is being created or added to the database. Subject alternative name extensions are described in Section 4.2.1.7 of RFC 3280.</p></dd><dt><span class="term">--extAIA</span></dt><dd><p>Add the Authority Information Access extension to the certificate. X.509 certificate extensions are described in RFC 5280.</p></dd><dt><span class="term">--extSIA</span></dt><dd><p>Add the Subject Information Access extension to the certificate. X.509 certificate extensions are described in RFC 5280.</p></dd><dt><span class="term">--extCP</span></dt><dd><p>Add the Certificate Policies extension to the certificate. X.509 certificate extensions are described in RFC 5280.</p></dd><dt><span class="term">--extPM</span></dt><dd><p>Add the Policy Mappings extension to the certificate. X.509 certificate extensions are described in RFC 5280.</p></dd><dt><span class="term">--extPC</span></dt><dd><p>Add the Policy Constraints extension to the certificate. X.509 certificate extensions are described in RFC 5280.</p></dd><dt><span class="term">--extIA</span></dt><dd><p>Add the Inhibit Any Policy Access extension to the certificate. X.509 certificate extensions are described in RFC 5280.</p></dd><dt><span class="term">--extSKID</span></dt><dd><p>Add the Subject Key ID extension to the certificate. X.509 certificate extensions are described in RFC 5280.</p></dd><dt><span class="term">--extNC</span></dt><dd><p>Add a Name Constraint extension to the certificate. X.509 certificate extensions are described in RFC 5280.</p></dd><dt><span class="term">--extSAN type:name[,type:name]...</span></dt><dd><p>
|
||||
Create a Subject Alt Name extension with one or multiple names.
|
||||
</p><p>
|
||||
|
|
@ -145,9 +131,9 @@ Comma separated list of one or more of the following:
|
|||
secmod.db or pkcs11.txt
|
||||
</p></li></ul></div><p>
|
||||
These databases must be created before certificates or keys can be generated.
|
||||
</p><pre class="programlisting">certutil -N -d directory</pre><p><span class="command"><strong>Creating a Certificate Request</strong></span></p><p>
|
||||
</p><pre class="programlisting">certutil -N -d [sql:]directory</pre><p><span class="command"><strong>Creating a Certificate Request</strong></span></p><p>
|
||||
A certificate request contains most or all of the information that is used to generate the final certificate. This request is submitted separately to a certificate authority and is then approved by some mechanism (automatically or by human review). Once the request is approved, then the certificate is generated.
|
||||
</p><pre class="programlisting">$ certutil -R -k key-type-or-id [-q pqgfile|curve-name] -g key-size -s subject [-h tokenname] -d directory [-p phone] [-o output-file] [-a]</pre><p>
|
||||
</p><pre class="programlisting">$ certutil -R -k key-type-or-id [-q pqgfile|curve-name] -g key-size -s subject [-h tokenname] -d [sql:]directory [-p phone] [-o output-file] [-a]</pre><p>
|
||||
The <code class="option">-R</code> command options requires four arguments:
|
||||
</p><div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem"><p>
|
||||
<code class="option">-k</code> to specify either the key type to generate or, when renewing a certificate, the existing key pair to use
|
||||
|
|
@ -161,13 +147,13 @@ Comma separated list of one or more of the following:
|
|||
The new certificate request can be output in ASCII format (<code class="option">-a</code>) or can be written to a specified file (<code class="option">-o</code>).
|
||||
</p><p>
|
||||
For example:
|
||||
</p><pre class="programlisting">$ certutil -R -k rsa -g 1024 -s "CN=John Smith,O=Example Corp,L=Mountain View,ST=California,C=US" -d $HOME/nssdb -p 650-555-0123 -a -o cert.cer
|
||||
</p><pre class="programlisting">$ certutil -R -k rsa -g 1024 -s "CN=John Smith,O=Example Corp,L=Mountain View,ST=California,C=US" -d sql:$HOME/nssdb -p 650-555-0123 -a -o cert.cer
|
||||
|
||||
Generating key. This may take a few moments...
|
||||
|
||||
</pre><p><span class="command"><strong>Creating a Certificate</strong></span></p><p>
|
||||
A valid certificate must be issued by a trusted CA. This can be done by specifying a CA certificate (<code class="option">-c</code>) that is stored in the certificate database. If a CA key pair is not available, you can create a self-signed certificate using the <code class="option">-x</code> argument with the <code class="option">-S</code> command option.
|
||||
</p><pre class="programlisting">$ certutil -S -k rsa|dsa|ec -n certname -s subject [-c issuer |-x] -t trustargs -d directory [-m serial-number] [-v valid-months] [-w offset-months] [-p phone] [-1] [-2] [-3] [-4] [-5 keyword] [-6 keyword] [-7 emailAddress] [-8 dns-names] [--extAIA] [--extSIA] [--extCP] [--extPM] [--extPC] [--extIA] [--extSKID]</pre><p>
|
||||
</p><pre class="programlisting">$ certutil -S -k rsa|dsa|ec -n certname -s subject [-c issuer |-x] -t trustargs -d [sql:]directory [-m serial-number] [-v valid-months] [-w offset-months] [-p phone] [-1] [-2] [-3] [-4] [-5 keyword] [-6 keyword] [-7 emailAddress] [-8 dns-names] [--extAIA] [--extSIA] [--extCP] [--extPM] [--extPC] [--extIA] [--extSKID]</pre><p>
|
||||
The series of numbers and <code class="option">--ext*</code> options set certificate extensions that can be added to the certificate when it is generated by the CA. Interactive prompts will result.
|
||||
</p><p>
|
||||
For example, this creates a self-signed certificate:
|
||||
|
|
@ -177,11 +163,11 @@ The interative prompts for key usage and whether any extensions are critical and
|
|||
From there, new certificates can reference the self-signed certificate:
|
||||
</p><pre class="programlisting">$ certutil -S -s "CN=My Server Cert" -n my-server-cert -c "my-ca-cert" -t ",," -1 -5 -6 -8 -m 730</pre><p><span class="command"><strong>Generating a Certificate from a Certificate Request</strong></span></p><p>
|
||||
When a certificate request is created, a certificate can be generated by using the request and then referencing a certificate authority signing certificate (the <span class="emphasis"><em>issuer</em></span> specified in the <code class="option">-c</code> argument). The issuing certificate must be in the certificate database in the specified directory.
|
||||
</p><pre class="programlisting">certutil -C -c issuer -i cert-request-file -o output-file [-m serial-number] [-v valid-months] [-w offset-months] -d directory [-1] [-2] [-3] [-4] [-5 keyword] [-6 keyword] [-7 emailAddress] [-8 dns-names]</pre><p>
|
||||
</p><pre class="programlisting">certutil -C -c issuer -i cert-request-file -o output-file [-m serial-number] [-v valid-months] [-w offset-months] -d [sql:]directory [-1] [-2] [-3] [-4] [-5 keyword] [-6 keyword] [-7 emailAddress] [-8 dns-names]</pre><p>
|
||||
For example:
|
||||
</p><pre class="programlisting">$ certutil -C -c "my-ca-cert" -i /home/certs/cert.req -o cert.cer -m 010 -v 12 -w 1 -d $HOME/nssdb -1 nonRepudiation,dataEncipherment -5 sslClient -6 clientAuth -7 jsmith@example.com</pre><p><span class="command"><strong>Listing Certificates</strong></span></p><p>
|
||||
</p><pre class="programlisting">$ certutil -C -c "my-ca-cert" -i /home/certs/cert.req -o cert.cer -m 010 -v 12 -w 1 -d sql:$HOME/nssdb -1 nonRepudiation,dataEncipherment -5 sslClient -6 clientAuth -7 jsmith@example.com</pre><p><span class="command"><strong>Listing Certificates</strong></span></p><p>
|
||||
The <code class="option">-L</code> command option lists all of the certificates listed in the certificate database. The path to the directory (<code class="option">-d</code>) is required.
|
||||
</p><pre class="programlisting">$ certutil -L -d /home/my/sharednssdb
|
||||
</p><pre class="programlisting">$ certutil -L -d sql:/home/my/sharednssdb
|
||||
|
||||
Certificate Nickname Trust Attributes
|
||||
SSL,S/MIME,JAR/XPI
|
||||
|
|
@ -192,7 +178,7 @@ Google Internet Authority ,,
|
|||
Certificate Authority - Example Domain CT,C,C</pre><p>
|
||||
Using additional arguments with <code class="option">-L</code> can return and print the information for a single, specific certificate. For example, the <code class="option">-n</code> argument passes the certificate name, while the <code class="option">-a</code> argument prints the certificate in ASCII format:
|
||||
</p><pre class="programlisting">
|
||||
$ certutil -L -d $HOME/nssdb -a -n my-ca-cert
|
||||
$ certutil -L -d sql:$HOME/nssdb -a -n my-ca-cert
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIB1DCCAT2gAwIBAgICDkIwDQYJKoZIhvcNAQEFBQAwFTETMBEGA1UEAxMKRXhh
|
||||
bXBsZSBDQTAeFw0xMzAzMTMxOTEwMjlaFw0xMzA2MTMxOTEwMjlaMBUxEzARBgNV
|
||||
|
|
@ -205,7 +191,7 @@ AQUFAAOBgQA6chkzkACN281d1jKMrc+RHG2UMaQyxiteaLVZO+Ro1nnRUvseDf09
|
|||
XKYFwPMJjWCihVku6bw/ihZfuMHhxK22Nue6inNQ6eDu7WmrqL8z3iUrQwxs+WiF
|
||||
ob2rb8XRVVJkzXdXxlk4uo3UtNvw8sAz7sWD71qxKaIHU5q49zijfg==
|
||||
-----END CERTIFICATE-----
|
||||
</pre><p>For a human-readable display</p><pre class="programlisting">$ certutil -L -d $HOME/nssdb -n my-ca-cert
|
||||
</pre><p>For a human-readable display</p><pre class="programlisting">$ certutil -L -d sql:$HOME/nssdb -n my-ca-cert
|
||||
Certificate:
|
||||
Data:
|
||||
Version: 3 (0x2)
|
||||
|
|
@ -273,7 +259,7 @@ Certificate:
|
|||
Keys are the original material used to encrypt certificate data. The keys generated for certificates are stored separately, in the key database.
|
||||
</p><p>
|
||||
To list all keys in the database, use the <code class="option">-K</code> command option and the (required) <code class="option">-d</code> argument to give the path to the directory.
|
||||
</p><pre class="programlisting">$ certutil -K -d $HOME/nssdb
|
||||
</p><pre class="programlisting">$ certutil -K -d sql:$HOME/nssdb
|
||||
certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and Certificate Services "
|
||||
< 0> rsa 455a6673bde9375c2887ec8bf8016b3f9f35861d Thawte Freemail Member's Thawte Consulting (Pty) Ltd. ID
|
||||
< 1> rsa 40defeeb522ade11090eacebaaf1196a172127df Example Domain Administrator Cert
|
||||
|
|
@ -287,7 +273,7 @@ certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and
|
|||
If there are multiple key types available, then the <code class="option">-k</code> <span class="emphasis"><em>key-type</em></span> argument can search a specific type of key, like RSA, DSA, or ECC.
|
||||
</p></li></ul></div><p><span class="command"><strong>Listing Security Modules</strong></span></p><p>
|
||||
The devices that can be used to store certificates -- both internal databases and external devices like smart cards -- are recognized and used by loading security modules. The <code class="option">-U</code> command option lists all of the security modules listed in the <code class="filename">secmod.db</code> database. The path to the directory (<code class="option">-d</code>) is required.
|
||||
</p><pre class="programlisting">$ certutil -U -d /home/my/sharednssdb
|
||||
</p><pre class="programlisting">$ certutil -U -d sql:/home/my/sharednssdb
|
||||
|
||||
slot: NSS User Private Key and Certificate Services
|
||||
token: NSS Certificate DB
|
||||
|
|
@ -297,44 +283,44 @@ certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and
|
|||
token: NSS Generic Crypto Services
|
||||
uri: pkcs11:token=NSS%20Generic%20Crypto%20Services;manufacturer=Mozilla%20Foundation;serial=0000000000000000;model=NSS%203</pre><p><span class="command"><strong>Adding Certificates to the Database</strong></span></p><p>
|
||||
Existing certificates or certificate requests can be added manually to the certificate database, even if they were generated elsewhere. This uses the <code class="option">-A</code> command option.
|
||||
</p><pre class="programlisting">certutil -A -n certname -t trustargs -d directory [-a] [-i input-file]</pre><p>
|
||||
</p><pre class="programlisting">certutil -A -n certname -t trustargs -d [sql:]directory [-a] [-i input-file]</pre><p>
|
||||
For example:
|
||||
</p><pre class="programlisting">$ certutil -A -n "CN=My SSL Certificate" -t ",," -d /home/my/sharednssdb -i /home/example-certs/cert.cer</pre><p>
|
||||
</p><pre class="programlisting">$ certutil -A -n "CN=My SSL Certificate" -t ",," -d sql:/home/my/sharednssdb -i /home/example-certs/cert.cer</pre><p>
|
||||
A related command option, <code class="option">-E</code>, is used specifically to add email certificates to the certificate database. The <code class="option">-E</code> command has the same arguments as the <code class="option">-A</code> command. The trust arguments for certificates have the format <span class="emphasis"><em>SSL,S/MIME,Code-signing</em></span>, so the middle trust settings relate most to email certificates (though the others can be set). For example:
|
||||
</p><pre class="programlisting">$ certutil -E -n "CN=John Smith Email Cert" -t ",P," -d /home/my/sharednssdb -i /home/example-certs/email.cer</pre><p><span class="command"><strong>Deleting Certificates to the Database</strong></span></p><p>
|
||||
</p><pre class="programlisting">$ certutil -E -n "CN=John Smith Email Cert" -t ",P," -d sql:/home/my/sharednssdb -i /home/example-certs/email.cer</pre><p><span class="command"><strong>Deleting Certificates to the Database</strong></span></p><p>
|
||||
Certificates can be deleted from a database using the <code class="option">-D</code> option. The only required options are to give the security database directory and to identify the certificate nickname.
|
||||
</p><pre class="programlisting">certutil -D -d directory -n "nickname"</pre><p>
|
||||
</p><pre class="programlisting">certutil -D -d [sql:]directory -n "nickname"</pre><p>
|
||||
For example:
|
||||
</p><pre class="programlisting">$ certutil -D -d /home/my/sharednssdb -n "my-ssl-cert"</pre><p><span class="command"><strong>Validating Certificates</strong></span></p><p>
|
||||
</p><pre class="programlisting">$ certutil -D -d sql:/home/my/sharednssdb -n "my-ssl-cert"</pre><p><span class="command"><strong>Validating Certificates</strong></span></p><p>
|
||||
A certificate contains an expiration date in itself, and expired certificates are easily rejected. However, certificates can also be revoked before they hit their expiration date. Checking whether a certificate has been revoked requires validating the certificate. Validation can also be used to ensure that the certificate is only used for the purposes it was initially issued for. Validation is carried out by the <code class="option">-V</code> command option.
|
||||
</p><pre class="programlisting">certutil -V -n certificate-name [-b time] [-e] [-u cert-usage] -d directory</pre><p>
|
||||
</p><pre class="programlisting">certutil -V -n certificate-name [-b time] [-e] [-u cert-usage] -d [sql:]directory</pre><p>
|
||||
For example, to validate an email certificate:
|
||||
</p><pre class="programlisting">$ certutil -V -n "John Smith's Email Cert" -e -u S,R -d /home/my/sharednssdb</pre><p><span class="command"><strong>Modifying Certificate Trust Settings</strong></span></p><p>
|
||||
</p><pre class="programlisting">$ certutil -V -n "John Smith's Email Cert" -e -u S,R -d sql:/home/my/sharednssdb</pre><p><span class="command"><strong>Modifying Certificate Trust Settings</strong></span></p><p>
|
||||
The trust settings (which relate to the operations that a certificate is allowed to be used for) can be changed after a certificate is created or added to the database. This is especially useful for CA certificates, but it can be performed for any type of certificate.
|
||||
</p><pre class="programlisting">certutil -M -n certificate-name -t trust-args -d directory</pre><p>
|
||||
</p><pre class="programlisting">certutil -M -n certificate-name -t trust-args -d [sql:]directory</pre><p>
|
||||
For example:
|
||||
</p><pre class="programlisting">$ certutil -M -n "My CA Certificate" -d /home/my/sharednssdb -t "CT,CT,CT"</pre><p><span class="command"><strong>Printing the Certificate Chain</strong></span></p><p>
|
||||
</p><pre class="programlisting">$ certutil -M -n "My CA Certificate" -d sql:/home/my/sharednssdb -t "CT,CT,CT"</pre><p><span class="command"><strong>Printing the Certificate Chain</strong></span></p><p>
|
||||
Certificates can be issued in <span class="emphasis"><em>chains</em></span> because every certificate authority itself has a certificate; when a CA issues a certificate, it essentially stamps that certificate with its own fingerprint. The <code class="option">-O</code> prints the full chain of a certificate, going from the initial CA (the root CA) through ever intermediary CA to the actual certificate. For example, for an email certificate with two CAs in the chain:
|
||||
</p><pre class="programlisting">$ certutil -d /home/my/sharednssdb -O -n "jsmith@example.com"
|
||||
</p><pre class="programlisting">$ certutil -d sql:/home/my/sharednssdb -O -n "jsmith@example.com"
|
||||
"Builtin Object Token:Thawte Personal Freemail CA" [E=personal-freemail@thawte.com,CN=Thawte Personal Freemail CA,OU=Certification Services Division,O=Thawte Consulting,L=Cape Town,ST=Western Cape,C=ZA]
|
||||
|
||||
"Thawte Personal Freemail Issuing CA - Thawte Consulting" [CN=Thawte Personal Freemail Issuing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA]
|
||||
|
||||
"(null)" [E=jsmith@example.com,CN=Thawte Freemail Member]</pre><p><span class="command"><strong>Resetting a Token</strong></span></p><p>
|
||||
The device which stores certificates -- both external hardware devices and internal software databases -- can be blanked and reused. This operation is performed on the device which stores the data, not directly on the security databases, so the location must be referenced through the token name (<code class="option">-h</code>) as well as any directory path. If there is no external token used, the default value is internal.
|
||||
</p><pre class="programlisting">certutil -T -d directory -h token-name -0 security-officer-password</pre><p>
|
||||
</p><pre class="programlisting">certutil -T -d [sql:]directory -h token-name -0 security-officer-password</pre><p>
|
||||
Many networks have dedicated personnel who handle changes to security tokens (the security officer). This person must supply the password to access the specified token. For example:
|
||||
</p><pre class="programlisting">$ certutil -T -d /home/my/sharednssdb -h nethsm -0 secret</pre><p><span class="command"><strong>Upgrading or Merging the Security Databases</strong></span></p><p>
|
||||
</p><pre class="programlisting">$ certutil -T -d sql:/home/my/sharednssdb -h nethsm -0 secret</pre><p><span class="command"><strong>Upgrading or Merging the Security Databases</strong></span></p><p>
|
||||
Many networks or applications may be using older BerkeleyDB versions of the certificate database (<code class="filename">cert8.db</code>). Databases can be upgraded to the new SQLite version of the database (<code class="filename">cert9.db</code>) using the <code class="option">--upgrade-merge</code> command option or existing databases can be merged with the new <code class="filename">cert9.db</code> databases using the <code class="option">---merge</code> command.
|
||||
</p><p>
|
||||
The <code class="option">--upgrade-merge</code> command must give information about the original database and then use the standard arguments (like <code class="option">-d</code>) to give the information about the new databases. The command also requires information that the tool uses for the process to upgrade and write over the original database.
|
||||
</p><pre class="programlisting">certutil --upgrade-merge -d directory [-P dbprefix] --source-dir directory --source-prefix dbprefix --upgrade-id id --upgrade-token-name name [-@ password-file]</pre><p>
|
||||
</p><pre class="programlisting">certutil --upgrade-merge -d [sql:]directory [-P dbprefix] --source-dir directory --source-prefix dbprefix --upgrade-id id --upgrade-token-name name [-@ password-file]</pre><p>
|
||||
For example:
|
||||
</p><pre class="programlisting">$ certutil --upgrade-merge -d /home/my/sharednssdb --source-dir /opt/my-app/alias/ --source-prefix serverapp- --upgrade-id 1 --upgrade-token-name internal</pre><p>
|
||||
</p><pre class="programlisting">$ certutil --upgrade-merge -d sql:/home/my/sharednssdb --source-dir /opt/my-app/alias/ --source-prefix serverapp- --upgrade-id 1 --upgrade-token-name internal</pre><p>
|
||||
The <code class="option">--merge</code> command only requires information about the location of the original database; since it doesn't change the format of the database, it can write over information without performing interim step.
|
||||
</p><pre class="programlisting">certutil --merge -d directory [-P dbprefix] --source-dir directory --source-prefix dbprefix [-@ password-file]</pre><p>
|
||||
</p><pre class="programlisting">certutil --merge -d [sql:]directory [-P dbprefix] --source-dir directory --source-prefix dbprefix [-@ password-file]</pre><p>
|
||||
For example:
|
||||
</p><pre class="programlisting">$ certutil --merge -d /home/my/sharednssdb --source-dir /opt/my-app/alias/ --source-prefix serverapp-</pre><p><span class="command"><strong>Running certutil Commands from a Batch File</strong></span></p><p>
|
||||
</p><pre class="programlisting">$ certutil --merge -d sql:/home/my/sharednssdb --source-dir /opt/my-app/alias/ --source-prefix serverapp-</pre><p><span class="command"><strong>Running certutil Commands from a Batch File</strong></span></p><p>
|
||||
A series of commands can be run sequentially from a text file with the <code class="option">-B</code> command option. The only argument for this specifies the input file.
|
||||
</p><pre class="programlisting">$ certutil -B -i /path/to/batch-file</pre></div><div class="refsection"><a name="databases"></a><h2>NSS Database Types</h2><p>NSS originally used BerkeleyDB databases to store security information.
|
||||
The last versions of these <span class="emphasis"><em>legacy</em></span> databases are:</p><div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem"><p>
|
||||
|
|
@ -352,8 +338,8 @@ BerkeleyDB. These new databases provide more accessibility and performance:</p><
|
|||
key4.db for keys
|
||||
</p></li><li class="listitem"><p>
|
||||
pkcs11.txt, a listing of all of the PKCS #11 modules, contained in a new subdirectory in the security databases directory
|
||||
</p></li></ul></div><p>Because the SQLite databases are designed to be shared, these are the <span class="emphasis"><em>shared</em></span> database type. The shared database type is preferred; the legacy format is included for backward compatibility.</p><p>By default, the tools (<span class="command"><strong>certutil</strong></span>, <span class="command"><strong>pk12util</strong></span>, <span class="command"><strong>modutil</strong></span>) assume that the given security databases use the SQLite type.
|
||||
Using the legacy databases must be manually specified by using the <span class="command"><strong>dbm:</strong></span> prefix with the given security directory. For example:</p><pre class="programlisting">$ certutil -L -d dbm:/home/my/sharednssdb</pre><p>To set the legacy database type as the default type for the tools, set the <code class="envar">NSS_DEFAULT_DB_TYPE</code> environment variable to <code class="envar">dbm</code>:</p><pre class="programlisting">export NSS_DEFAULT_DB_TYPE="dbm"</pre><p>This line can be set added to the <code class="filename">~/.bashrc</code> file to make the change permanent.</p><div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem"><p>
|
||||
</p></li></ul></div><p>Because the SQLite databases are designed to be shared, these are the <span class="emphasis"><em>shared</em></span> database type. The shared database type is preferred; the legacy format is included for backward compatibility.</p><p>By default, the tools (<span class="command"><strong>certutil</strong></span>, <span class="command"><strong>pk12util</strong></span>, <span class="command"><strong>modutil</strong></span>) assume that the given security databases follow the more common legacy type.
|
||||
Using the SQLite databases must be manually specified by using the <span class="command"><strong>sql:</strong></span> prefix with the given security directory. For example:</p><pre class="programlisting">$ certutil -L -d sql:/home/my/sharednssdb</pre><p>To set the shared database type as the default type for the tools, set the <code class="envar">NSS_DEFAULT_DB_TYPE</code> environment variable to <code class="envar">sql</code>:</p><pre class="programlisting">export NSS_DEFAULT_DB_TYPE="sql"</pre><p>This line can be set added to the <code class="filename">~/.bashrc</code> file to make the change permanent.</p><p>Most applications do not use the shared database by default, but they can be configured to use them. For example, this how-to article covers how to configure Firefox and Thunderbird to use the new shared NSS databases:</p><div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem"><p>
|
||||
https://wiki.mozilla.org/NSS_Shared_DB_Howto</p></li></ul></div><p>For an engineering draft on the changes in the shared NSS databases, see the NSS project wiki:</p><div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem"><p>
|
||||
https://wiki.mozilla.org/NSS_Shared_DB
|
||||
</p></li></ul></div></div><div class="refsection"><a name="seealso"></a><h2>See Also</h2><p>pk12util (1)</p><p>modutil (1)</p><p><span class="command"><strong>certutil</strong></span> has arguments or operations that use features defined in several IETF RFCs.</p><div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem"><p>
|
||||
|
|
|
|||
|
|
@ -1,5 +1,7 @@
|
|||
<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><title>DERDUMP</title><meta name="generator" content="DocBook XSL Stylesheets Vsnapshot"><link rel="home" href="index.html" title="DERDUMP"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">DERDUMP</th></tr></table><hr></div><div class="refentry"><a name="derdump"></a><div class="titlepage"></div><div class="refnamediv"><h2>Name</h2><p>derdump — Dumps C-sequence strings from a DER encoded certificate file</p></div><div class="refsynopsisdiv"><h2>Synopsis</h2><div class="cmdsynopsis"><p><code class="command">derdump</code> [<code class="option">-r</code>] [<code class="option">-i <em class="replaceable"><code>input-file</code></em></code>] [<code class="option">-o <em class="replaceable"><code>output-file</code></em></code>]</p></div></div><div class="refsection"><a name="idm46110902671184"></a><h2>STATUS</h2><p>This documentation is still work in progress. Please contribute to the initial review in <a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=836477" target="_top">Mozilla NSS bug 836477</a>
|
||||
</p></div><div class="refsection"><a name="idm46110902669184"></a><h2>Description</h2><p><span class="command"><strong>derdump </strong></span>dumps C-sequence strings from a DER encode certificate file </p></div><div class="refsection"><a name="idm46110902647776"></a><h2>Options</h2><div class="variablelist"><dl class="variablelist"><dt><span class="term"><code class="option">-r </code></span></dt><dd>For formatted items, dump raw bytes as well</dd><dt><span class="term"><code class="option">-i </code> <em class="replaceable"><code>DER encoded file</code></em></span></dt><dd>Define an input file to use (default is stdin)</dd><dt><span class="term"><code class="option">-o </code> <em class="replaceable"><code>output file</code></em></span></dt><dd>Define an output file to use (default is stdout).</dd></dl></div></div><div class="refsection"><a name="resources"></a><h2>Additional Resources</h2><p>NSS is maintained in conjunction with PKI and security-related projects through Mozilla dn Fedora. The most closely-related project is Dogtag PKI, with a project wiki at <a class="ulink" href="http://pki.fedoraproject.org/wiki/" target="_top">PKI Wiki</a>. </p><p>For information specifically about NSS, the NSS project wiki is located at <a class="ulink" href="http://www.mozilla.org/projects/security/pki/nss/" target="_top">Mozilla NSS site</a>. The NSS site relates directly to NSS code changes and releases.</p><p>Mailing lists: pki-devel@redhat.com and pki-users@redhat.com</p><p>IRC: Freenode at #dogtag-pki</p></div><div class="refsection"><a name="authors"></a><h2>Authors</h2><p>The NSS tools were written and maintained by developers with Netscape, Red Hat, Sun, Oracle, Mozilla, and Google.</p><p>
|
||||
<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><title>DERDUMP</title><meta name="generator" content="DocBook XSL Stylesheets V1.77.1"><link rel="home" href="index.html" title="DERDUMP"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">DERDUMP</th></tr></table><hr></div><div class="refentry"><a name="derdump"></a><div class="titlepage"></div><div class="refnamediv"><h2>Name</h2><p>derdump — Dumps C-sequence strings from a DER encoded certificate file</p></div><div class="refsynopsisdiv"><h2>Synopsis</h2><div class="cmdsynopsis"><p><code class="command">derdump</code> [<code class="option">-r</code>] [<code class="option">-i <em class="replaceable"><code>input-file</code></em></code>] [<code class="option">-o <em class="replaceable"><code>output-file</code></em></code>]</p></div></div><div class="refsection"><a name="idp4817536"></a><h2>STATUS</h2><p>This documentation is still work in progress. Please contribute to the initial review in <a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=836477" target="_top">Mozilla NSS bug 836477</a>
|
||||
</p></div><div class="refsection"><a name="idp2658976"></a><h2>Description</h2><p><span class="command"><strong>derdump </strong></span>dumps C-sequence strings from a DER encode certificate file </p></div><div class="refsection"><a name="idp4859136"></a><h2>Options</h2><div class="variablelist"><dl class="variablelist"><dt><span class="term"><code class="option">-r </code></span></dt><dd>For formatted items, dump raw bytes as well</dd><dt><span class="term"><code class="option">-i </code> <em class="replaceable"><code>DER encoded file</code></em></span></dt><dd>Define an input file to use (default is stdin)</dd><dt><span class="term"><code class="option">-o </code> <em class="replaceable"><code>output file</code></em></span></dt><dd>Define an output file to use (default is stdout).</dd></dl></div></div><div class="refsection"><a name="resources"></a><h2>Additional Resources</h2><p>NSS is maintained in conjunction with PKI and security-related projects through Mozilla dn Fedora. The most closely-related project is Dogtag PKI, with a project wiki at <a class="ulink" href="http://pki.fedoraproject.org/wiki/" target="_top">PKI Wiki</a>. </p><p>For information specifically about NSS, the NSS project wiki is located at <a class="ulink" href="http://www.mozilla.org/projects/security/pki/nss/" target="_top">Mozilla NSS site</a>. The NSS site relates directly to NSS code changes and releases.</p><p>Mailing lists: pki-devel@redhat.com and pki-users@redhat.com</p><p>IRC: Freenode at #dogtag-pki</p></div><div class="refsection"><a name="authors"></a><h2>Authors</h2><p>The NSS tools were written and maintained by developers with Netscape and now with Red Hat.</p><p>
|
||||
Authors: Gerhardus Geldenhuis <gerhardus.geldenhuis@gmail.com>. Elio Maldonado <emaldona@redhat.com>, Deon Lackey <dlackey@redhat.com>
|
||||
</p></div><div class="refsection"><a name="license"></a><h2>LICENSE</h2><p>Licensed under the Mozilla Public License, v. 2.0. If a copy of the MPL was not distributed with this file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
</p></div><div class="refsection"><a name="license"></a><h2>LICENSE</h2><p>Licensed under the Mozilla Public License, version 1.1,
|
||||
and/or the GNU General Public License, version 2 or later,
|
||||
and/or the GNU Lesser General Public License, version 2.1 or later.
|
||||
</p></div></div><div class="navfooter"><hr></div></body></html>
|
||||
|
|
|
|||
File diff suppressed because one or more lines are too long
|
|
@ -1,9 +1,9 @@
|
|||
<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><title>PK12UTIL</title><meta name="generator" content="DocBook XSL Stylesheets Vsnapshot"><link rel="home" href="index.html" title="PK12UTIL"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">PK12UTIL</th></tr></table><hr></div><div class="refentry"><a name="pk12util"></a><div class="titlepage"></div><div class="refnamediv"><h2>Name</h2><p>pk12util — Export and import keys and certificate to or from a PKCS #12 file and the NSS database</p></div><div class="refsynopsisdiv"><h2>Synopsis</h2><div class="cmdsynopsis"><p><code class="command">pk12util</code> [-i p12File|-l p12File|-o p12File] [-c keyCipher] [-C certCipher] [-d directory] [-h tokenname] [-m | --key-len keyLength] [-M hashAlg] [-n certname] [-P dbprefix] [-r] [-v] [--cert-key-len certKeyLength] [-k slotPasswordFile|-K slotPassword] [-w p12filePasswordFile|-W p12filePassword]</p></div></div><div class="refsection"><a name="idm45355426428624"></a><h2>STATUS</h2><p>This documentation is still work in progress. Please contribute to the initial review in <a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=836477" target="_top">Mozilla NSS bug 836477</a>
|
||||
</p></div><div class="refsection"><a name="description"></a><h2>Description</h2><p>The PKCS #12 utility, <span class="command"><strong>pk12util</strong></span>, enables sharing certificates among any server that supports PKCS #12. The tool can import certificates and keys from PKCS #12 files into security databases, export certificates, and list certificates and keys.</p></div><div class="refsection"><a name="options"></a><h2>Options and Arguments</h2><p><span class="command"><strong>Options</strong></span></p><div class="variablelist"><dl class="variablelist"><dt><span class="term">-i p12file</span></dt><dd><p>Import keys and certificates from a PKCS #12 file into a security database.</p></dd><dt><span class="term">-l p12file</span></dt><dd><p>List the keys and certificates in PKCS #12 file.</p></dd><dt><span class="term">-o p12file</span></dt><dd><p>Export keys and certificates from the security database to a PKCS #12 file.</p></dd></dl></div><p><span class="command"><strong>Arguments</strong></span></p><div class="variablelist"><dl class="variablelist"><dt><span class="term">-c keyCipher</span></dt><dd><p>Specify the key encryption algorithm.</p></dd><dt><span class="term">-C certCipher</span></dt><dd><p>Specify the certiticate encryption algorithm.</p></dd><dt><span class="term">-d directory</span></dt><dd><p>Specify the database directory into which to import to or export from certificates and keys.</p><p><span class="command"><strong>pk12util</strong></span> supports two types of databases: the legacy security databases (<code class="filename">cert8.db</code>, <code class="filename">key3.db</code>, and <code class="filename">secmod.db</code>) and new SQLite databases (<code class="filename">cert9.db</code>, <code class="filename">key4.db</code>, and <code class="filename">pkcs11.txt</code>). If the prefix <span class="command"><strong>dbm:</strong></span> is not used, then the tool assumes that the given databases are in the SQLite format.</p></dd><dt><span class="term">-h tokenname</span></dt><dd><p>Specify the name of the token to import into or export from.</p></dd><dt><span class="term">-k slotPasswordFile</span></dt><dd><p>Specify the text file containing the slot's password.</p></dd><dt><span class="term">-K slotPassword</span></dt><dd><p>Specify the slot's password.</p></dd><dt><span class="term">-m | --key-len keyLength</span></dt><dd><p>Specify the desired length of the symmetric key to be used to encrypt the private key.</p></dd><dt><span class="term">-M hashAlg</span></dt><dd><p>Specify the hash algorithm used in the pkcs #12 mac. This algorithm also specifies the HMAC used in the prf when using pkcs #5 v2.</p></dd><dt><span class="term">--cert-key-len certKeyLength</span></dt><dd><p>Specify the desired length of the symmetric key to be used to encrypt the certificates and other meta-data.</p></dd><dt><span class="term">-n certname</span></dt><dd><p>Specify the nickname of the cert and private key to export.</p><p>The nickname can also be a PKCS #11 URI. For example, if you have a certificate named "my-server-cert" on the internal certificate store, it can be unambiguously specified as "pkcs11:token=NSS%20Certificate%20DB;object=my-server-cert". For details about the format, see RFC 7512.</p></dd><dt><span class="term">-P prefix</span></dt><dd><p>Specify the prefix used on the certificate and key databases. This option is provided as a special case.
|
||||
<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><title>PK12UTIL</title><meta name="generator" content="DocBook XSL Stylesheets Vsnapshot"><link rel="home" href="index.html" title="PK12UTIL"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">PK12UTIL</th></tr></table><hr></div><div class="refentry"><a name="pk12util"></a><div class="titlepage"></div><div class="refnamediv"><h2>Name</h2><p>pk12util — Export and import keys and certificate to or from a PKCS #12 file and the NSS database</p></div><div class="refsynopsisdiv"><h2>Synopsis</h2><div class="cmdsynopsis"><p><code class="command">pk12util</code> [-i p12File|-l p12File|-o p12File] [-d [sql:]directory] [-h tokenname] [-P dbprefix] [-r] [-v] [-k slotPasswordFile|-K slotPassword] [-w p12filePasswordFile|-W p12filePassword]</p></div></div><div class="refsection"><a name="idm45659476549872"></a><h2>STATUS</h2><p>This documentation is still work in progress. Please contribute to the initial review in <a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=836477" target="_top">Mozilla NSS bug 836477</a>
|
||||
</p></div><div class="refsection"><a name="description"></a><h2>Description</h2><p>The PKCS #12 utility, <span class="command"><strong>pk12util</strong></span>, enables sharing certificates among any server that supports PKCS #12. The tool can import certificates and keys from PKCS #12 files into security databases, export certificates, and list certificates and keys.</p></div><div class="refsection"><a name="options"></a><h2>Options and Arguments</h2><p><span class="command"><strong>Options</strong></span></p><div class="variablelist"><dl class="variablelist"><dt><span class="term">-i p12file</span></dt><dd><p>Import keys and certificates from a PKCS #12 file into a security database.</p></dd><dt><span class="term">-l p12file</span></dt><dd><p>List the keys and certificates in PKCS #12 file.</p></dd><dt><span class="term">-o p12file</span></dt><dd><p>Export keys and certificates from the security database to a PKCS #12 file.</p></dd></dl></div><p><span class="command"><strong>Arguments</strong></span></p><div class="variablelist"><dl class="variablelist"><dt><span class="term">-c keyCipher</span></dt><dd><p>Specify the key encryption algorithm.</p></dd><dt><span class="term">-C certCipher</span></dt><dd><p>Specify the certiticate encryption algorithm.</p></dd><dt><span class="term">-d [sql:]directory</span></dt><dd><p>Specify the database directory into which to import to or export from certificates and keys.</p><p><span class="command"><strong>pk12util</strong></span> supports two types of databases: the legacy security databases (<code class="filename">cert8.db</code>, <code class="filename">key3.db</code>, and <code class="filename">secmod.db</code>) and new SQLite databases (<code class="filename">cert9.db</code>, <code class="filename">key4.db</code>, and <code class="filename">pkcs11.txt</code>). If the prefix <span class="command"><strong>sql:</strong></span> is not used, then the tool assumes that the given databases are in the old format.</p></dd><dt><span class="term">-h tokenname</span></dt><dd><p>Specify the name of the token to import into or export from.</p></dd><dt><span class="term">-k slotPasswordFile</span></dt><dd><p>Specify the text file containing the slot's password.</p></dd><dt><span class="term">-K slotPassword</span></dt><dd><p>Specify the slot's password.</p></dd><dt><span class="term">-m | --key-len keyLength</span></dt><dd><p>Specify the desired length of the symmetric key to be used to encrypt the private key.</p></dd><dt><span class="term">-n | --cert-key-len certKeyLength</span></dt><dd><p>Specify the desired length of the symmetric key to be used to encrypt the certificates and other meta-data.</p></dd><dt><span class="term">-n certname</span></dt><dd><p>Specify the nickname of the cert and private key to export.</p><p>The nickname can also be a PKCS #11 URI. For example, if you have a certificate named "my-server-cert" on the internal certificate store, it can be unambiguously specified as "pkcs11:token=NSS%20Certificate%20DB;object=my-server-cert". For details about the format, see RFC 7512.</p></dd><dt><span class="term">-P prefix</span></dt><dd><p>Specify the prefix used on the certificate and key databases. This option is provided as a special case.
|
||||
Changing the names of the certificate and key databases is not recommended.</p></dd><dt><span class="term">-r</span></dt><dd><p>Dumps all of the data in raw (binary) form. This must be saved as a DER file. The default is to return information in a pretty-print ASCII format, which displays the information about the certificates and public keys in the p12 file.</p></dd><dt><span class="term">-v </span></dt><dd><p>Enable debug logging when importing.</p></dd><dt><span class="term">-w p12filePasswordFile</span></dt><dd><p>Specify the text file containing the pkcs #12 file password.</p></dd><dt><span class="term">-W p12filePassword</span></dt><dd><p>Specify the pkcs #12 file password.</p></dd></dl></div></div><div class="refsection"><a name="return-codes"></a><h2>Return Codes</h2><div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem"><p> 0 - No error</p></li><li class="listitem"><p> 1 - User Cancelled</p></li><li class="listitem"><p> 2 - Usage error</p></li><li class="listitem"><p> 6 - NLS init error</p></li><li class="listitem"><p> 8 - Certificate DB open error</p></li><li class="listitem"><p> 9 - Key DB open error</p></li><li class="listitem"><p> 10 - File initialization error</p></li><li class="listitem"><p> 11 - Unicode conversion error</p></li><li class="listitem"><p> 12 - Temporary file creation error</p></li><li class="listitem"><p> 13 - PKCS11 get slot error</p></li><li class="listitem"><p> 14 - PKCS12 decoder start error</p></li><li class="listitem"><p> 15 - error read from import file</p></li><li class="listitem"><p> 16 - pkcs12 decode error</p></li><li class="listitem"><p> 17 - pkcs12 decoder verify error</p></li><li class="listitem"><p> 18 - pkcs12 decoder validate bags error</p></li><li class="listitem"><p> 19 - pkcs12 decoder import bags error</p></li><li class="listitem"><p> 20 - key db conversion version 3 to version 2 error</p></li><li class="listitem"><p> 21 - cert db conversion version 7 to version 5 error</p></li><li class="listitem"><p> 22 - cert and key dbs patch error</p></li><li class="listitem"><p> 23 - get default cert db error</p></li><li class="listitem"><p> 24 - find cert by nickname error</p></li><li class="listitem"><p> 25 - create export context error</p></li><li class="listitem"><p> 26 - PKCS12 add password itegrity error</p></li><li class="listitem"><p> 27 - cert and key Safes creation error</p></li><li class="listitem"><p> 28 - PKCS12 add cert and key error</p></li><li class="listitem"><p> 29 - PKCS12 encode error</p></li></ul></div></div><div class="refsection"><a name="examples"></a><h2>Examples</h2><p><span class="command"><strong>Importing Keys and Certificates</strong></span></p><p>The most basic usage of <span class="command"><strong>pk12util</strong></span> for importing a certificate or key is the PKCS #12 input file (<code class="option">-i</code>) and some way to specify the security database being accessed (either <code class="option">-d</code> for a directory or <code class="option">-h</code> for a token).
|
||||
</p><p>
|
||||
pk12util -i p12File [-h tokenname] [-v] [-d directory] [-P dbprefix] [-k slotPasswordFile|-K slotPassword] [-w p12filePasswordFile|-W p12filePassword]
|
||||
</p><p>For example:</p><p> </p><pre class="programlisting"># pk12util -i /tmp/cert-files/users.p12 -d /home/my/sharednssdb
|
||||
pk12util -i p12File [-h tokenname] [-v] [-d [sql:]directory] [-P dbprefix] [-k slotPasswordFile|-K slotPassword] [-w p12filePasswordFile|-W p12filePassword]
|
||||
</p><p>For example:</p><p> </p><pre class="programlisting"># pk12util -i /tmp/cert-files/users.p12 -d sql:/home/my/sharednssdb
|
||||
|
||||
Enter a password which will be used to encrypt your keys.
|
||||
The password should be at least 8 characters long,
|
||||
|
|
@ -13,10 +13,10 @@ Enter new password:
|
|||
Re-enter password:
|
||||
Enter password for PKCS12 file:
|
||||
pk12util: PKCS12 IMPORT SUCCESSFUL</pre><p><span class="command"><strong>Exporting Keys and Certificates</strong></span></p><p>Using the <span class="command"><strong>pk12util</strong></span> command to export certificates and keys requires both the name of the certificate to extract from the database (<code class="option">-n</code>) and the PKCS #12-formatted output file to write to. There are optional parameters that can be used to encrypt the file to protect the certificate material.
|
||||
</p><p>pk12util -o p12File -n certname [-c keyCipher] [-C certCipher] [-m|--key_len keyLen] [-n|--cert_key_len certKeyLen] [-d directory] [-P dbprefix] [-k slotPasswordFile|-K slotPassword] [-w p12filePasswordFile|-W p12filePassword]</p><p>For example:</p><pre class="programlisting"># pk12util -o certs.p12 -n Server-Cert -d /home/my/sharednssdb
|
||||
</p><p>pk12util -o p12File -n certname [-c keyCipher] [-C certCipher] [-m|--key_len keyLen] [-n|--cert_key_len certKeyLen] [-d [sql:]directory] [-P dbprefix] [-k slotPasswordFile|-K slotPassword] [-w p12filePasswordFile|-W p12filePassword]</p><p>For example:</p><pre class="programlisting"># pk12util -o certs.p12 -n Server-Cert -d sql:/home/my/sharednssdb
|
||||
Enter password for PKCS12 file:
|
||||
Re-enter password: </pre><p><span class="command"><strong>Listing Keys and Certificates</strong></span></p><p>The information in a <code class="filename">.p12</code> file are not human-readable. The certificates and keys in the file can be printed (listed) in a human-readable pretty-print format that shows information for every certificate and any public keys in the <code class="filename">.p12</code> file.
|
||||
</p><p>pk12util -l p12File [-h tokenname] [-r] [-d directory] [-P dbprefix] [-k slotPasswordFile|-K slotPassword] [-w p12filePasswordFile|-W p12filePassword]</p><p>For example, this prints the default ASCII output:</p><pre class="programlisting"># pk12util -l certs.p12
|
||||
</p><p>pk12util -l p12File [-h tokenname] [-r] [-d [sql:]directory] [-P dbprefix] [-k slotPasswordFile|-K slotPassword] [-w p12filePasswordFile|-W p12filePassword]</p><p>For example, this prints the default ASCII output:</p><pre class="programlisting"># pk12util -l certs.p12
|
||||
|
||||
Enter password for PKCS12 file:
|
||||
Key(shrouded):
|
||||
|
|
@ -64,8 +64,8 @@ BerkleyDB. These new databases provide more accessibility and performance:</p><d
|
|||
key4.db for keys
|
||||
</p></li><li class="listitem"><p>
|
||||
pkcs11.txt, which is listing of all of the PKCS #11 modules contained in a new subdirectory in the security databases directory
|
||||
</p></li></ul></div><p>Because the SQLite databases are designed to be shared, these are the <span class="emphasis"><em>shared</em></span> database type. The shared database type is preferred; the legacy format is included for backward compatibility.</p><p>By default, the tools (<span class="command"><strong>certutil</strong></span>, <span class="command"><strong>pk12util</strong></span>, <span class="command"><strong>modutil</strong></span>) assume that the given security databases use the SQLite type
|
||||
Using the legacy databases must be manually specified by using the <span class="command"><strong>dbm:</strong></span> prefix with the given security directory. For example:</p><pre class="programlisting"># pk12util -i /tmp/cert-files/users.p12 -d dbm:/home/my/sharednssdb</pre><p>To set the legacy database type as the default type for the tools, set the <code class="envar">NSS_DEFAULT_DB_TYPE</code> environment variable to <code class="envar">dbm</code>:</p><pre class="programlisting">export NSS_DEFAULT_DB_TYPE="dbm"</pre><p>This line can be set added to the <code class="filename">~/.bashrc</code> file to make the change permanent.</p><div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem"><p>
|
||||
</p></li></ul></div><p>Because the SQLite databases are designed to be shared, these are the <span class="emphasis"><em>shared</em></span> database type. The shared database type is preferred; the legacy format is included for backward compatibility.</p><p>By default, the tools (<span class="command"><strong>certutil</strong></span>, <span class="command"><strong>pk12util</strong></span>, <span class="command"><strong>modutil</strong></span>) assume that the given security databases follow the more common legacy type.
|
||||
Using the SQLite databases must be manually specified by using the <span class="command"><strong>sql:</strong></span> prefix with the given security directory. For example:</p><pre class="programlisting"># pk12util -i /tmp/cert-files/users.p12 -d sql:/home/my/sharednssdb</pre><p>To set the shared database type as the default type for the tools, set the <code class="envar">NSS_DEFAULT_DB_TYPE</code> environment variable to <code class="envar">sql</code>:</p><pre class="programlisting">export NSS_DEFAULT_DB_TYPE="sql"</pre><p>This line can be set added to the <code class="filename">~/.bashrc</code> file to make the change permanent.</p><p>Most applications do not use the shared database by default, but they can be configured to use them. For example, this how-to article covers how to configure Firefox and Thunderbird to use the new shared NSS databases:</p><div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem"><p>
|
||||
https://wiki.mozilla.org/NSS_Shared_DB_Howto</p></li></ul></div><p>For an engineering draft on the changes in the shared NSS databases, see the NSS project wiki:</p><div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem"><p>
|
||||
https://wiki.mozilla.org/NSS_Shared_DB
|
||||
</p></li></ul></div></div><div class="refsection"><a name="compatibility"></a><h2>Compatibility Notes</h2><p>The exporting behavior of <span class="command"><strong>pk12util</strong></span> has changed over time, while importing files exported with older versions of NSS is still supported.</p><p>Until the 3.30 release, <span class="command"><strong>pk12util</strong></span> used the UTF-16 encoding for the PKCS #5 password-based encryption schemes, while the recommendation is to encode passwords in UTF-8 if the used encryption scheme is defined outside of the PKCS #12 standard.</p><p>Until the 3.31 release, even when <strong class="userinput"><code>"AES-128-CBC"</code></strong> or <strong class="userinput"><code>"AES-192-CBC"</code></strong> is given from the command line, <span class="command"><strong>pk12util</strong></span> always used 256-bit AES as the underlying encryption scheme.</p><p>For historical reasons, <span class="command"><strong>pk12util</strong></span> accepts password-based encryption schemes not listed in this document. However, those schemes are not officially supported and may have issues in interoperability with other tools.</p></div><div class="refsection"><a name="seealso"></a><h2>See Also</h2><p>certutil (1)</p><p>modutil (1)</p><p>The NSS wiki has information on the new database design and how to configure applications to use it.</p><div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem"><p>
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><title>PP</title><meta name="generator" content="DocBook XSL Stylesheets Vsnapshot"><link rel="home" href="index.html" title="PP"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">PP</th></tr></table><hr></div><div class="refentry"><a name="pp"></a><div class="titlepage"></div><div class="refnamediv"><h2>Name</h2><p>pp — Prints certificates, keys, crls, and pkcs7 files</p></div><div class="refsynopsisdiv"><h2>Synopsis</h2><div class="cmdsynopsis"><p><code class="command">pp -t type [-a] [-i input] [-o output] [-u] [-w]</code> </p></div></div><div class="refsection"><a name="idm45517456298304"></a><h2>STATUS</h2><p>This documentation is still work in progress. Please contribute to the initial review in <a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=836477" target="_top">Mozilla NSS bug 836477</a>
|
||||
</p></div><div class="refsection"><a name="idm45517456296384"></a><h2>Description</h2><p><span class="command"><strong>pp </strong></span>pretty-prints private and public key, certificate, certificate-request,
|
||||
pkcs7, pkcs12 or crl files
|
||||
</p></div><div class="refsection"><a name="idm45517456294576"></a><h2>Options</h2><div class="variablelist"><dl class="variablelist"><dt><span class="term"><code class="option">-t </code> <em class="replaceable"><code>type</code></em></span></dt><dd><p class="simpara">specify the input, one of {private-key | public-key | certificate | certificate-request | pkcs7 | pkcs12 | crl | name}</p><p class="simpara"></p></dd><dt><span class="term"><code class="option">-a </code></span></dt><dd>Input is in ascii encoded form (RFC1113)</dd><dt><span class="term"><code class="option">-i </code> <em class="replaceable"><code>inputfile</code></em></span></dt><dd>Define an input file to use (default is stdin)</dd><dt><span class="term"><code class="option">-o </code> <em class="replaceable"><code>outputfile</code></em></span></dt><dd>Define an output file to use (default is stdout)</dd><dt><span class="term"><code class="option">-u </code> </span></dt><dd>Use UTF-8 (default is to show non-ascii as .)</dd><dt><span class="term"><code class="option">-w </code> </span></dt><dd>Don't wrap long output lines</dd></dl></div></div><div class="refsection"><a name="resources"></a><h2>Additional Resources</h2><p>NSS is maintained in conjunction with PKI and security-related projects through Mozilla and Fedora. The most closely-related project is Dogtag PKI, with a project wiki at <a class="ulink" href="http://pki.fedoraproject.org/wiki/" target="_top">PKI Wiki</a>. </p><p>For information specifically about NSS, the NSS project wiki is located at <a class="ulink" href="http://www.mozilla.org/projects/security/pki/nss/" target="_top">Mozilla NSS site</a>. The NSS site relates directly to NSS code changes and releases.</p><p>Mailing lists: pki-devel@redhat.com and pki-users@redhat.com</p><p>IRC: Freenode at #dogtag-pki</p></div><div class="refsection"><a name="authors"></a><h2>Authors</h2><p>The NSS tools were written and maintained by developers with Netscape, Red Hat, Sun, Oracle, Mozilla, and Google.</p><p>
|
||||
<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><title>PP</title><meta name="generator" content="DocBook XSL Stylesheets V1.78.1"><link rel="home" href="index.html" title="PP"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">PP</th></tr></table><hr></div><div class="refentry"><a name="pp"></a><div class="titlepage"></div><div class="refnamediv"><h2>Name</h2><p>pp — Prints certificates, keys, crls, and pkcs7 files</p></div><div class="refsynopsisdiv"><h2>Synopsis</h2><div class="cmdsynopsis"><p><code class="command">pp -t type [-a] [-i input] [-o output] [-u] [-w]</code> </p></div></div><div class="refsection"><a name="idm226689875920"></a><h2>STATUS</h2><p>This documentation is still work in progress. Please contribute to the initial review in <a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=836477" target="_top">Mozilla NSS bug 836477</a>
|
||||
</p></div><div class="refsection"><a name="idm226686118544"></a><h2>Description</h2><p><span class="command"><strong>pp </strong></span>pretty-prints private and public key, certificate, certificate-request,
|
||||
pkcs7 or crl files
|
||||
</p></div><div class="refsection"><a name="idm226686116608"></a><h2>Options</h2><div class="variablelist"><dl class="variablelist"><dt><span class="term"><code class="option">-t </code> <em class="replaceable"><code>type</code></em></span></dt><dd><p class="simpara">specify the input, one of {private-key | public-key | certificate | certificate-request | pkcs7 | crl}</p><p class="simpara"></p></dd><dt><span class="term"><code class="option">-a </code></span></dt><dd>Input is in ascii encoded form (RFC1113)</dd><dt><span class="term"><code class="option">-i </code> <em class="replaceable"><code>inputfile</code></em></span></dt><dd>Define an input file to use (default is stdin)</dd><dt><span class="term"><code class="option">-o </code> <em class="replaceable"><code>outputfile</code></em></span></dt><dd>Define an output file to use (default is stdout)</dd><dt><span class="term"><code class="option">-u </code> </span></dt><dd>Use UTF-8 (default is to show non-ascii as .)</dd><dt><span class="term"><code class="option">-w </code> </span></dt><dd>Don't wrap long output lines</dd></dl></div></div><div class="refsection"><a name="resources"></a><h2>Additional Resources</h2><p>NSS is maintained in conjunction with PKI and security-related projects through Mozilla and Fedora. The most closely-related project is Dogtag PKI, with a project wiki at <a class="ulink" href="http://pki.fedoraproject.org/wiki/" target="_top">PKI Wiki</a>. </p><p>For information specifically about NSS, the NSS project wiki is located at <a class="ulink" href="http://www.mozilla.org/projects/security/pki/nss/" target="_top">Mozilla NSS site</a>. The NSS site relates directly to NSS code changes and releases.</p><p>Mailing lists: pki-devel@redhat.com and pki-users@redhat.com</p><p>IRC: Freenode at #dogtag-pki</p></div><div class="refsection"><a name="authors"></a><h2>Authors</h2><p>The NSS tools were written and maintained by developers with Netscape, Red Hat, Sun, Oracle, Mozilla, and Google.</p><p>
|
||||
Authors: Elio Maldonado <emaldona@redhat.com>, Deon Lackey <dlackey@redhat.com>.
|
||||
</p></div><div class="refsection"><a name="license"></a><h2>LICENSE</h2><p>Licensed under the Mozilla Public License, v. 2.0. If a copy of the MPL was not distributed with this file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
</p></div></div><div class="navfooter"><hr></div></body></html>
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><title>SIGNVER</title><meta name="generator" content="DocBook XSL Stylesheets Vsnapshot"><link rel="home" href="index.html" title="SIGNVER"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">SIGNVER</th></tr></table><hr></div><div class="refentry"><a name="signver"></a><div class="titlepage"></div><div class="refnamediv"><h2>Name</h2><p>signver — Verify a detached PKCS#7 signature for a file.</p></div><div class="refsynopsisdiv"><h2>Synopsis</h2><div class="cmdsynopsis"><p><code class="command">signtool</code> -A | -V -d <em class="replaceable"><code>directory</code></em> [-a] [-i <em class="replaceable"><code>input_file</code></em>] [-o <em class="replaceable"><code>output_file</code></em>] [-s <em class="replaceable"><code>signature_file</code></em>] [-v]</p></div></div><div class="refsection"><a name="idm45992751922208"></a><h2>STATUS</h2><p>This documentation is still work in progress. Please contribute to the initial review in <a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=836477" target="_top">Mozilla NSS bug 836477</a>
|
||||
</p></div><div class="refsection"><a name="description"></a><h2>Description</h2><p>The Signature Verification Tool, <span class="command"><strong>signver</strong></span>, is a simple command-line utility that unpacks a base-64-encoded PKCS#7 signed object and verifies the digital signature using standard cryptographic techniques. The Signature Verification Tool can also display the contents of the signed object.</p></div><div class="refsection"><a name="options"></a><h2>Options</h2><div class="variablelist"><dl class="variablelist"><dt><span class="term">-A</span></dt><dd><p>Displays all of the information in the PKCS#7 signature.</p></dd><dt><span class="term">-V</span></dt><dd><p>Verifies the digital signature.</p></dd><dt><span class="term">-d <span class="emphasis"><em>directory</em></span></span></dt><dd><p>Specify the database directory which contains the certificates and keys.</p><p><span class="command"><strong>signver</strong></span> supports two types of databases: the legacy security databases (<code class="filename">cert8.db</code>, <code class="filename">key3.db</code>, and <code class="filename">secmod.db</code>) and new SQLite databases (<code class="filename">cert9.db</code>, <code class="filename">key4.db</code>, and <code class="filename">pkcs11.txt</code>). If the prefix <span class="command"><strong>dbm:</strong></span> is not used, then the tool assumes that the given databases are in the SQLite format.</p></dd><dt><span class="term">-a</span></dt><dd><p>Sets that the given signature file is in ASCII format.</p></dd><dt><span class="term">-i <span class="emphasis"><em>input_file</em></span></span></dt><dd><p>Gives the input file for the object with signed data.</p></dd><dt><span class="term">-o <span class="emphasis"><em>output_file</em></span></span></dt><dd><p>Gives the output file to which to write the results.</p></dd><dt><span class="term">-s <span class="emphasis"><em>signature_file</em></span></span></dt><dd><p>Gives the input file for the digital signature.</p></dd><dt><span class="term">-v</span></dt><dd><p>Enables verbose output.</p></dd></dl></div></div><div class="refsection"><a name="examples"></a><h2>Extended Examples</h2><div class="refsection"><a name="idm45992752059232"></a><h3>Verifying a Signature</h3><p>The <code class="option">-V</code> option verifies that the signature in a given signature file is valid when used to sign the given object (from the input file).</p><pre class="programlisting">signver -V -s <em class="replaceable"><code>signature_file</code></em> -i <em class="replaceable"><code>signed_file</code></em> -d /home/my/sharednssdb
|
||||
<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><title>SIGNVER</title><meta name="generator" content="DocBook XSL Stylesheets V1.78.1"><link rel="home" href="index.html" title="SIGNVER"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">SIGNVER</th></tr></table><hr></div><div class="refentry"><a name="signver"></a><div class="titlepage"></div><div class="refnamediv"><h2>Name</h2><p>signver — Verify a detached PKCS#7 signature for a file.</p></div><div class="refsynopsisdiv"><h2>Synopsis</h2><div class="cmdsynopsis"><p><code class="command">signtool</code> -A | -V -d <em class="replaceable"><code>directory</code></em> [-a] [-i <em class="replaceable"><code>input_file</code></em>] [-o <em class="replaceable"><code>output_file</code></em>] [-s <em class="replaceable"><code>signature_file</code></em>] [-v]</p></div></div><div class="refsection"><a name="idm233257229808"></a><h2>STATUS</h2><p>This documentation is still work in progress. Please contribute to the initial review in <a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=836477" target="_top">Mozilla NSS bug 836477</a>
|
||||
</p></div><div class="refsection"><a name="description"></a><h2>Description</h2><p>The Signature Verification Tool, <span class="command"><strong>signver</strong></span>, is a simple command-line utility that unpacks a base-64-encoded PKCS#7 signed object and verifies the digital signature using standard cryptographic techniques. The Signature Verification Tool can also display the contents of the signed object.</p></div><div class="refsection"><a name="options"></a><h2>Options</h2><div class="variablelist"><dl class="variablelist"><dt><span class="term">-A</span></dt><dd><p>Displays all of the information in the PKCS#7 signature.</p></dd><dt><span class="term">-V</span></dt><dd><p>Verifies the digital signature.</p></dd><dt><span class="term">-d [sql:]<span class="emphasis"><em>directory</em></span></span></dt><dd><p>Specify the database directory which contains the certificates and keys.</p><p><span class="command"><strong>signver</strong></span> supports two types of databases: the legacy security databases (<code class="filename">cert8.db</code>, <code class="filename">key3.db</code>, and <code class="filename">secmod.db</code>) and new SQLite databases (<code class="filename">cert9.db</code>, <code class="filename">key4.db</code>, and <code class="filename">pkcs11.txt</code>). If the prefix <span class="command"><strong>sql:</strong></span> is not used, then the tool assumes that the given databases are in the old format.</p></dd><dt><span class="term">-a</span></dt><dd><p>Sets that the given signature file is in ASCII format.</p></dd><dt><span class="term">-i <span class="emphasis"><em>input_file</em></span></span></dt><dd><p>Gives the input file for the object with signed data.</p></dd><dt><span class="term">-o <span class="emphasis"><em>output_file</em></span></span></dt><dd><p>Gives the output file to which to write the results.</p></dd><dt><span class="term">-s <span class="emphasis"><em>signature_file</em></span></span></dt><dd><p>Gives the input file for the digital signature.</p></dd><dt><span class="term">-v</span></dt><dd><p>Enables verbose output.</p></dd></dl></div></div><div class="refsection"><a name="examples"></a><h2>Extended Examples</h2><div class="refsection"><a name="idm233261091008"></a><h3>Verifying a Signature</h3><p>The <code class="option">-V</code> option verifies that the signature in a given signature file is valid when used to sign the given object (from the input file).</p><pre class="programlisting">signver -V -s <em class="replaceable"><code>signature_file</code></em> -i <em class="replaceable"><code>signed_file</code></em> -d sql:/home/my/sharednssdb
|
||||
|
||||
signatureValid=yes</pre></div><div class="refsection"><a name="idm45992752056160"></a><h3>Printing Signature Data</h3><p>
|
||||
signatureValid=yes</pre></div><div class="refsection"><a name="idm233261087840"></a><h3>Printing Signature Data</h3><p>
|
||||
The <code class="option">-A</code> option prints all of the information contained in a signature file. Using the <code class="option">-o</code> option prints the signature file information to the given output file rather than stdout.
|
||||
</p><pre class="programlisting">signver -A -s <em class="replaceable"><code>signature_file</code></em> -o <em class="replaceable"><code>output_file</code></em></pre></div></div><div class="refsection"><a name="databases"></a><h2>NSS Database Types</h2><p>NSS originally used BerkeleyDB databases to store security information.
|
||||
The last versions of these <span class="emphasis"><em>legacy</em></span> databases are:</p><div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem"><p>
|
||||
|
|
@ -19,8 +19,8 @@ BerkleyDB. These new databases provide more accessibility and performance:</p><d
|
|||
key4.db for keys
|
||||
</p></li><li class="listitem"><p>
|
||||
pkcs11.txt, which is listing of all of the PKCS #11 modules contained in a new subdirectory in the security databases directory
|
||||
</p></li></ul></div><p>Because the SQLite databases are designed to be shared, these are the <span class="emphasis"><em>shared</em></span> database type. The shared database type is preferred; the legacy format is included for backward compatibility.</p><p>By default, the tools (<span class="command"><strong>certutil</strong></span>, <span class="command"><strong>pk12util</strong></span>, <span class="command"><strong>modutil</strong></span>) assume that the given security databases use the SQLite type
|
||||
Using the legacy databases must be manually specified by using the <span class="command"><strong>dbm:</strong></span> prefix with the given security directory. For example:</p><pre class="programlisting"># signver -A -s <em class="replaceable"><code>signature</code></em> -d dbm:/home/my/sharednssdb</pre><p>To set the legacy database type as the default type for the tools, set the <code class="envar">NSS_DEFAULT_DB_TYPE</code> environment variable to <code class="envar">dbm</code>:</p><pre class="programlisting">export NSS_DEFAULT_DB_TYPE="dbm"</pre><p>This line can be added to the <code class="filename">~/.bashrc</code> file to make the change permanent for the user.</p><div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem"><p>
|
||||
</p></li></ul></div><p>Because the SQLite databases are designed to be shared, these are the <span class="emphasis"><em>shared</em></span> database type. The shared database type is preferred; the legacy format is included for backward compatibility.</p><p>By default, the tools (<span class="command"><strong>certutil</strong></span>, <span class="command"><strong>pk12util</strong></span>, <span class="command"><strong>modutil</strong></span>) assume that the given security databases follow the more common legacy type.
|
||||
Using the SQLite databases must be manually specified by using the <span class="command"><strong>sql:</strong></span> prefix with the given security directory. For example:</p><pre class="programlisting"># signver -A -s <em class="replaceable"><code>signature</code></em> -d sql:/home/my/sharednssdb</pre><p>To set the shared database type as the default type for the tools, set the <code class="envar">NSS_DEFAULT_DB_TYPE</code> environment variable to <code class="envar">sql</code>:</p><pre class="programlisting">export NSS_DEFAULT_DB_TYPE="sql"</pre><p>This line can be added to the <code class="filename">~/.bashrc</code> file to make the change permanent for the user.</p><p>Most applications do not use the shared database by default, but they can be configured to use them. For example, this how-to article covers how to configure Firefox and Thunderbird to use the new shared NSS databases:</p><div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem"><p>
|
||||
https://wiki.mozilla.org/NSS_Shared_DB_Howto</p></li></ul></div><p>For an engineering draft on the changes in the shared NSS databases, see the NSS project wiki:</p><div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem"><p>
|
||||
https://wiki.mozilla.org/NSS_Shared_DB
|
||||
</p></li></ul></div></div><div class="refsection"><a name="seealso"></a><h2>See Also</h2><p>signtool (1)</p><p>The NSS wiki has information on the new database design and how to configure applications to use it.</p><div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem"><p>Setting up the shared NSS database</p><p>https://wiki.mozilla.org/NSS_Shared_DB_Howto</p></li><li class="listitem"><p>
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><title>SSLTAP</title><meta name="generator" content="DocBook XSL Stylesheets Vsnapshot"><link rel="home" href="index.html" title="SSLTAP"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">SSLTAP</th></tr></table><hr></div><div class="refentry"><a name="ssltap"></a><div class="titlepage"></div><div class="refnamediv"><h2>Name</h2><p>ssltap — Tap into SSL connections and display the data going by </p></div><div class="refsynopsisdiv"><h2>Synopsis</h2><div class="cmdsynopsis"><p><code class="command">ssltap</code> [-fhlsvx] [-p port] [hostname:port]</p></div></div><div class="refsection"><a name="idm45187609295232"></a><h2>STATUS</h2><p>This documentation is still work in progress. Please contribute to the initial review in <a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=836477" target="_top">Mozilla NSS bug 836477</a>
|
||||
<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><title>SSLTAP</title><meta name="generator" content="DocBook XSL Stylesheets V1.78.1"><link rel="home" href="index.html" title="SSLTAP"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">SSLTAP</th></tr></table><hr></div><div class="refentry"><a name="ssltap"></a><div class="titlepage"></div><div class="refnamediv"><h2>Name</h2><p>ssltap — Tap into SSL connections and display the data going by </p></div><div class="refsynopsisdiv"><h2>Synopsis</h2><div class="cmdsynopsis"><p><code class="command">ssltap</code> [-fhlsvx] [-p port] [hostname:port]</p></div></div><div class="refsection"><a name="idm233258230400"></a><h2>STATUS</h2><p>This documentation is still work in progress. Please contribute to the initial review in <a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=836477" target="_top">Mozilla NSS bug 836477</a>
|
||||
</p></div><div class="refsection"><a name="description"></a><h2>Description</h2><p>The SSL Debugging Tool <span class="command"><strong>ssltap</strong></span> is an SSL-aware command-line proxy. It watches TCP connections and displays the data going by. If a connection is SSL, the data display includes interpreted SSL records and handshaking</p></div><div class="refsection"><a name="options"></a><h2>Options</h2><div class="variablelist"><dl class="variablelist"><dt><span class="term">-f </span></dt><dd><p>
|
||||
Turn on fancy printing. Output is printed in colored HTML. Data sent from the client to the server is in blue; the server's reply is in red. When used with looping mode, the different connections are separated with horizontal lines. You can use this option to upload the output into a browser.
|
||||
</p></dd><dt><span class="term">-h </span></dt><dd><p>
|
||||
|
|
|
|||
|
|
@ -149,14 +149,14 @@
|
|||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term>-dbdir directory</term>
|
||||
<term>-dbdir [sql:]directory</term>
|
||||
<listitem><para>Specify the database directory in which to access or create security module database files.</para>
|
||||
<para><command>modutil</command> supports two types of databases: the legacy security databases (<filename>cert8.db</filename>, <filename>key3.db</filename>, and <filename>secmod.db</filename>) and SQLite databases (<filename>cert9.db</filename>, <filename>key4.db</filename>, and <filename>pkcs11.txt</filename>). If the prefix <command>dbm:</command> is not used, then the tool assumes that the given databases are in SQLite format.</para></listitem>
|
||||
<para><command>modutil</command> supports two types of databases: the legacy security databases (<filename>cert8.db</filename>, <filename>key3.db</filename>, and <filename>secmod.db</filename>) and new SQLite databases (<filename>cert9.db</filename>, <filename>key4.db</filename>, and <filename>pkcs11.txt</filename>). If the prefix <command>sql:</command> is not used, then the tool assumes that the given databases are in the old format.</para></listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term>--dbprefix prefix</term>
|
||||
<listitem><para>Specify the prefix used on the database files, such as <filename>my_</filename> for <filename>my_cert9.db</filename>. This option is provided as a special case. Changing the names of the certificate and key databases is not recommended.</para></listitem>
|
||||
<listitem><para>Specify the prefix used on the database files, such as <filename>my_</filename> for <filename>my_cert8.db</filename>. This option is provided as a special case. Changing the names of the certificate and key databases is not recommended.</para></listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
|
|
@ -229,13 +229,13 @@
|
|||
|
||||
<para><command>Creating Database Files</command></para>
|
||||
<para>Before any operations can be performed, there must be a set of security databases available. <command>modutil</command> can be used to create these files. The only required argument is the database that where the databases will be located.</para>
|
||||
<programlisting>modutil -create -dbdir directory</programlisting>
|
||||
<programlisting>modutil -create -dbdir [sql:]directory</programlisting>
|
||||
|
||||
<para><command>Adding a Cryptographic Module</command></para>
|
||||
<para>Adding a PKCS #11 module means submitting a supporting library file, enabling its ciphers, and setting default provider status for various security mechanisms. This can be done by supplying all of the information through <command>modutil</command> directly or by running a JAR file and install script. For the most basic case, simply upload the library:</para>
|
||||
<programlisting>modutil -add modulename -libfile library-file [-ciphers cipher-enable-list] [-mechanisms mechanism-list] </programlisting>
|
||||
<para>For example:
|
||||
<programlisting>modutil -dbdir /home/my/sharednssdb -add "Example PKCS #11 Module" -libfile "/tmp/crypto.so" -mechanisms RSA:DSA:RC2:RANDOM
|
||||
<programlisting>modutil -dbdir sql:/home/my/sharednssdb -add "Example PKCS #11 Module" -libfile "/tmp/crypto.so" -mechanisms RSA:DSA:RC2:RANDOM
|
||||
|
||||
Using database directory ...
|
||||
Module "Example PKCS #11 Module" added to database.</programlisting>
|
||||
|
|
@ -267,7 +267,7 @@ Module "Example PKCS #11 Module" added to database.</programlisting>
|
|||
} </programlisting>
|
||||
<para>Both the install script and the required libraries must be bundled in a JAR file, which is specified with the <option>-jar</option> argument.</para>
|
||||
|
||||
<programlisting>modutil -dbdir /home/mt"jar-install-filey/sharednssdb -jar install.jar -installdir /home/my/sharednssdb
|
||||
<programlisting>modutil -dbdir sql:/home/mt"jar-install-filey/sharednssdb -jar install.jar -installdir sql:/home/my/sharednssdb
|
||||
|
||||
This installation JAR file was signed by:
|
||||
----------------------------------------------
|
||||
|
|
@ -304,15 +304,15 @@ Installation completed successfully </programlisting>
|
|||
|
||||
<para><command>Deleting a Module</command></para>
|
||||
<para>A specific PKCS #11 module can be deleted from the <filename>secmod.db</filename> database:</para>
|
||||
<programlisting>modutil -delete modulename -dbdir directory </programlisting>
|
||||
<programlisting>modutil -delete modulename -dbdir [sql:]directory </programlisting>
|
||||
|
||||
<para><command>Displaying Module Information</command></para>
|
||||
<para>The <filename>secmod.db</filename> database contains information about the PKCS #11 modules that are available to an application or server to use. The list of all modules, information about specific modules, and database configuration specs for modules can all be viewed. </para>
|
||||
<para>To simply get a list of modules in the database, use the <option>-list</option> command.</para>
|
||||
<programlisting>modutil -list [modulename] -dbdir directory </programlisting>
|
||||
<programlisting>modutil -list [modulename] -dbdir [sql:]directory </programlisting>
|
||||
<para>Listing the modules shows the module name, their status, and other associated security databases for certificates and keys. For example:</para>
|
||||
|
||||
<programlisting>modutil -list -dbdir /home/my/sharednssdb
|
||||
<programlisting>modutil -list -dbdir sql:/home/my/sharednssdb
|
||||
|
||||
Listing of PKCS #11 Modules
|
||||
-----------------------------------------------------------
|
||||
|
|
@ -329,7 +329,7 @@ Listing of PKCS #11 Modules
|
|||
uri: pkcs11:token=NSS%20Certificate%20DB;manufacturer=Mozilla%20Foundation;serial=0000000000000000;model=NSS%203
|
||||
-----------------------------------------------------------</programlisting>
|
||||
<para>Passing a specific module name with the <option>-list</option> returns details information about the module itself, like supported cipher mechanisms, version numbers, serial numbers, and other information about the module and the token it is loaded on. For example:</para>
|
||||
<programlisting> modutil -list "NSS Internal PKCS #11 Module" -dbdir /home/my/sharednssdb
|
||||
<programlisting> modutil -list "NSS Internal PKCS #11 Module" -dbdir sql:/home/my/sharednssdb
|
||||
|
||||
-----------------------------------------------------------
|
||||
Name: NSS Internal PKCS #11 Module
|
||||
|
|
@ -375,7 +375,7 @@ Default Mechanism Flags: RSA:RC2:RC4:DES:DH:SHA1:MD5:MD2:SSL:TLS:AES
|
|||
Login Type: Login required
|
||||
User Pin: Initialized</programlisting>
|
||||
<para>A related command, <option>-rawlist</option> returns information about the database configuration for the modules. (This information can be edited by loading new specs using the <option>-rawadd</option> command.)</para>
|
||||
<programlisting> modutil -rawlist -dbdir /home/my/sharednssdb
|
||||
<programlisting> modutil -rawlist -dbdir sql:/home/my/sharednssdb
|
||||
name="NSS Internal PKCS #11 Module" parameters="configdir=. certPrefix= keyPrefix= secmod=secmod.db flags=readOnly " NSS="trustOrder=75 cipherOrder=100 slotParams={0x00000001=[slotFlags=RSA,RC4,RC2,DES,DH,SHA1,MD5,MD2,SSL,TLS,AES,RANDOM askpw=any timeout=30 ] } Flags=internal,critical"</programlisting>
|
||||
|
||||
<para><command>Setting a Default Provider for Security Mechanisms</command></para>
|
||||
|
|
@ -403,11 +403,11 @@ Slot "NSS Internal Cryptographic Services " enabled.<
|
|||
|
||||
<para><command>Enabling and Verifying FIPS Compliance</command></para>
|
||||
<para>The NSS modules can have FIPS 140-2 compliance enabled or disabled using <command>modutil</command> with the <option>-fips</option> option. For example:</para>
|
||||
<programlisting>modutil -fips true -dbdir /home/my/sharednssdb/
|
||||
<programlisting>modutil -fips true -dbdir sql:/home/my/sharednssdb/
|
||||
|
||||
FIPS mode enabled.</programlisting>
|
||||
<para>To verify that status of FIPS mode, run the <option>-chkfips</option> command with either a true or false flag (it doesn't matter which). The tool returns the current FIPS setting.</para>
|
||||
<programlisting>modutil -chkfips false -dbdir /home/my/sharednssdb/
|
||||
<programlisting>modutil -chkfips false -dbdir sql:/home/my/sharednssdb/
|
||||
|
||||
FIPS mode enabled.</programlisting>
|
||||
|
||||
|
|
@ -415,7 +415,7 @@ FIPS mode enabled.</programlisting>
|
|||
|
||||
<para>Initializing or changing a token's password:</para>
|
||||
<programlisting>modutil -changepw tokenname [-pwfile old-password-file] [-newpwfile new-password-file] </programlisting>
|
||||
<programlisting>modutil -dbdir /home/my/sharednssdb -changepw "NSS Certificate DB"
|
||||
<programlisting>modutil -dbdir sql:/home/my/sharednssdb -changepw "NSS Certificate DB"
|
||||
|
||||
Enter old password:
|
||||
Incorrect password, try again...
|
||||
|
|
@ -689,16 +689,17 @@ BerkleyDB. These new databases provide more accessibility and performance:</para
|
|||
|
||||
<para>Because the SQLite databases are designed to be shared, these are the <emphasis>shared</emphasis> database type. The shared database type is preferred; the legacy format is included for backward compatibility.</para>
|
||||
|
||||
<para>By default, the tools (<command>certutil</command>, <command>pk12util</command>, <command>modutil</command>) assume that the given security databases use the SQLite type.
|
||||
Using the legacy databases must be manually specified by using the <command>dbm:</command> prefix with the given security directory. For example:</para>
|
||||
<para>By default, the tools (<command>certutil</command>, <command>pk12util</command>, <command>modutil</command>) assume that the given security databases follow the more common legacy type.
|
||||
Using the SQLite databases must be manually specified by using the <command>sql:</command> prefix with the given security directory. For example:</para>
|
||||
|
||||
<programlisting>modutil -create -dbdir dbm:/home/my/sharednssdb</programlisting>
|
||||
<programlisting>modutil -create -dbdir sql:/home/my/sharednssdb</programlisting>
|
||||
|
||||
<para>To set the legacy database type as the default type for the tools, set the <envar>NSS_DEFAULT_DB_TYPE</envar> environment variable to <envar>dbm</envar>:</para>
|
||||
<programlisting>export NSS_DEFAULT_DB_TYPE="dbm"</programlisting>
|
||||
<para>To set the shared database type as the default type for the tools, set the <envar>NSS_DEFAULT_DB_TYPE</envar> environment variable to <envar>sql</envar>:</para>
|
||||
<programlisting>export NSS_DEFAULT_DB_TYPE="sql"</programlisting>
|
||||
|
||||
<para>This line can be added to the <filename>~/.bashrc</filename> file to make the change permanent for the user.</para>
|
||||
|
||||
<para>Most applications do not use the shared database by default, but they can be configured to use them. For example, this how-to article covers how to configure Firefox and Thunderbird to use the new shared NSS databases:</para>
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
<para>
|
||||
|
|
|
|||
|
|
@ -2,12 +2,12 @@
|
|||
.\" Title: CERTUTIL
|
||||
.\" Author: [see the "Authors" section]
|
||||
.\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
|
||||
.\" Date: 19 May 2021
|
||||
.\" Date: 5 October 2017
|
||||
.\" Manual: NSS Security Tools
|
||||
.\" Source: nss-tools
|
||||
.\" Language: English
|
||||
.\"
|
||||
.TH "CERTUTIL" "1" "19 May 2021" "nss-tools" "NSS Security Tools"
|
||||
.TH "CERTUTIL" "1" "5 October 2017" "nss-tools" "NSS Security Tools"
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * Define some portability stuff
|
||||
.\" -----------------------------------------------------------------
|
||||
|
|
@ -187,11 +187,6 @@ Arguments modify a command option and are usually lower case, numbers, or symbol
|
|||
Use ASCII format or allow the use of ASCII format for input or output\&. This formatting follows RFC 1113\&. For certificate requests, ASCII output defaults to standard output unless redirected\&.
|
||||
.RE
|
||||
.PP
|
||||
\-\-simple\-self\-signed
|
||||
.RS 4
|
||||
When printing the certificate chain, don\*(Aqt search for a chain if issuer name equals to subject name\&.
|
||||
.RE
|
||||
.PP
|
||||
\-b validity\-time
|
||||
.RS 4
|
||||
Specify a time at which a certificate is required to be valid\&. Use when checking certificate validity with the
|
||||
|
|
@ -252,7 +247,7 @@ requests the legacy database
|
|||
.RE
|
||||
.sp
|
||||
If no prefix is specified the default type is retrieved from NSS_DEFAULT_DB_TYPE\&. If NSS_DEFAULT_DB_TYPE is not set then
|
||||
\fBsql:\fR
|
||||
\fBdbm:\fR
|
||||
is the default\&.
|
||||
.RE
|
||||
.PP
|
||||
|
|
@ -579,18 +574,6 @@ The contexts are the following:
|
|||
\fBJ\fR
|
||||
(as an object signer)
|
||||
.RE
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
\fBI\fR
|
||||
(as an IPSEC user)
|
||||
.RE
|
||||
.RE
|
||||
.PP
|
||||
\-v valid\-months
|
||||
|
|
@ -1063,83 +1046,6 @@ msTrustListSign
|
|||
critical
|
||||
.RE
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
x509Any
|
||||
.RE
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
ipsecIKE
|
||||
.RE
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
ipsecIKEEnd
|
||||
.RE
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
ipsecIKEIntermediate
|
||||
.RE
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
ipsecEnd
|
||||
.RE
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
ipsecTunnel
|
||||
.RE
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
ipsecUser
|
||||
.RE
|
||||
.sp
|
||||
X\&.509 certificate extensions are described in RFC 5280\&.
|
||||
.RE
|
||||
.PP
|
||||
|
|
@ -1293,7 +1199,7 @@ These databases must be created before certificates or keys can be generated\&.
|
|||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
certutil \-N \-d directory
|
||||
certutil \-N \-d [sql:]directory
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
|
|
@ -1307,7 +1213,7 @@ A certificate request contains most or all of the information that is used to ge
|
|||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
$ certutil \-R \-k key\-type\-or\-id [\-q pqgfile|curve\-name] \-g key\-size \-s subject [\-h tokenname] \-d directory [\-p phone] [\-o output\-file] [\-a]
|
||||
$ certutil \-R \-k key\-type\-or\-id [\-q pqgfile|curve\-name] \-g key\-size \-s subject [\-h tokenname] \-d [sql:]directory [\-p phone] [\-o output\-file] [\-a]
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
|
|
@ -1373,7 +1279,7 @@ For example:
|
|||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
$ certutil \-R \-k rsa \-g 1024 \-s "CN=John Smith,O=Example Corp,L=Mountain View,ST=California,C=US" \-d $HOME/nssdb \-p 650\-555\-0123 \-a \-o cert\&.cer
|
||||
$ certutil \-R \-k rsa \-g 1024 \-s "CN=John Smith,O=Example Corp,L=Mountain View,ST=California,C=US" \-d sql:$HOME/nssdb \-p 650\-555\-0123 \-a \-o cert\&.cer
|
||||
|
||||
Generating key\&. This may take a few moments\&.\&.\&.
|
||||
|
||||
|
|
@ -1394,7 +1300,7 @@ command option\&.
|
|||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
$ certutil \-S \-k rsa|dsa|ec \-n certname \-s subject [\-c issuer |\-x] \-t trustargs \-d directory [\-m serial\-number] [\-v valid\-months] [\-w offset\-months] [\-p phone] [\-1] [\-2] [\-3] [\-4] [\-5 keyword] [\-6 keyword] [\-7 emailAddress] [\-8 dns\-names] [\-\-extAIA] [\-\-extSIA] [\-\-extCP] [\-\-extPM] [\-\-extPC] [\-\-extIA] [\-\-extSKID]
|
||||
$ certutil \-S \-k rsa|dsa|ec \-n certname \-s subject [\-c issuer |\-x] \-t trustargs \-d [sql:]directory [\-m serial\-number] [\-v valid\-months] [\-w offset\-months] [\-p phone] [\-1] [\-2] [\-3] [\-4] [\-5 keyword] [\-6 keyword] [\-7 emailAddress] [\-8 dns\-names] [\-\-extAIA] [\-\-extSIA] [\-\-extCP] [\-\-extPM] [\-\-extPC] [\-\-extIA] [\-\-extSKID]
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
|
|
@ -1442,7 +1348,7 @@ argument)\&. The issuing certificate must be in the certificate database in the
|
|||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
certutil \-C \-c issuer \-i cert\-request\-file \-o output\-file [\-m serial\-number] [\-v valid\-months] [\-w offset\-months] \-d directory [\-1] [\-2] [\-3] [\-4] [\-5 keyword] [\-6 keyword] [\-7 emailAddress] [\-8 dns\-names]
|
||||
certutil \-C \-c issuer \-i cert\-request\-file \-o output\-file [\-m serial\-number] [\-v valid\-months] [\-w offset\-months] \-d [sql:]directory [\-1] [\-2] [\-3] [\-4] [\-5 keyword] [\-6 keyword] [\-7 emailAddress] [\-8 dns\-names]
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
|
|
@ -1454,7 +1360,7 @@ For example:
|
|||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
$ certutil \-C \-c "my\-ca\-cert" \-i /home/certs/cert\&.req \-o cert\&.cer \-m 010 \-v 12 \-w 1 \-d $HOME/nssdb \-1 nonRepudiation,dataEncipherment \-5 sslClient \-6 clientAuth \-7 jsmith@example\&.com
|
||||
$ certutil \-C \-c "my\-ca\-cert" \-i /home/certs/cert\&.req \-o cert\&.cer \-m 010 \-v 12 \-w 1 \-d sql:$HOME/nssdb \-1 nonRepudiation,dataEncipherment \-5 sslClient \-6 clientAuth \-7 jsmith@example\&.com
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
|
|
@ -1470,7 +1376,7 @@ command option lists all of the certificates listed in the certificate database\
|
|||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
$ certutil \-L \-d /home/my/sharednssdb
|
||||
$ certutil \-L \-d sql:/home/my/sharednssdb
|
||||
|
||||
Certificate Nickname Trust Attributes
|
||||
SSL,S/MIME,JAR/XPI
|
||||
|
|
@ -1496,7 +1402,7 @@ argument prints the certificate in ASCII format:
|
|||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
$ certutil \-L \-d $HOME/nssdb \-a \-n my\-ca\-cert
|
||||
$ certutil \-L \-d sql:$HOME/nssdb \-a \-n my\-ca\-cert
|
||||
\-\-\-\-\-BEGIN CERTIFICATE\-\-\-\-\-
|
||||
MIIB1DCCAT2gAwIBAgICDkIwDQYJKoZIhvcNAQEFBQAwFTETMBEGA1UEAxMKRXhh
|
||||
bXBsZSBDQTAeFw0xMzAzMTMxOTEwMjlaFw0xMzA2MTMxOTEwMjlaMBUxEzARBgNV
|
||||
|
|
@ -1520,7 +1426,7 @@ For a human\-readable display
|
|||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
$ certutil \-L \-d $HOME/nssdb \-n my\-ca\-cert
|
||||
$ certutil \-L \-d sql:$HOME/nssdb \-n my\-ca\-cert
|
||||
Certificate:
|
||||
Data:
|
||||
Version: 3 (0x2)
|
||||
|
|
@ -1603,7 +1509,7 @@ argument to give the path to the directory\&.
|
|||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
$ certutil \-K \-d $HOME/nssdb
|
||||
$ certutil \-K \-d sql:$HOME/nssdb
|
||||
certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and Certificate Services "
|
||||
< 0> rsa 455a6673bde9375c2887ec8bf8016b3f9f35861d Thawte Freemail Member\*(Aqs Thawte Consulting (Pty) Ltd\&. ID
|
||||
< 1> rsa 40defeeb522ade11090eacebaaf1196a172127df Example Domain Administrator Cert
|
||||
|
|
@ -1669,7 +1575,7 @@ database\&. The path to the directory (\fB\-d\fR) is required\&.
|
|||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
$ certutil \-U \-d /home/my/sharednssdb
|
||||
$ certutil \-U \-d sql:/home/my/sharednssdb
|
||||
|
||||
slot: NSS User Private Key and Certificate Services
|
||||
token: NSS Certificate DB
|
||||
|
|
@ -1693,7 +1599,7 @@ command option\&.
|
|||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
certutil \-A \-n certname \-t trustargs \-d directory [\-a] [\-i input\-file]
|
||||
certutil \-A \-n certname \-t trustargs \-d [sql:]directory [\-a] [\-i input\-file]
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
|
|
@ -1705,7 +1611,7 @@ For example:
|
|||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
$ certutil \-A \-n "CN=My SSL Certificate" \-t ",," \-d /home/my/sharednssdb \-i /home/example\-certs/cert\&.cer
|
||||
$ certutil \-A \-n "CN=My SSL Certificate" \-t ",," \-d sql:/home/my/sharednssdb \-i /home/example\-certs/cert\&.cer
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
|
|
@ -1723,7 +1629,7 @@ command\&. The trust arguments for certificates have the format
|
|||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
$ certutil \-E \-n "CN=John Smith Email Cert" \-t ",P," \-d /home/my/sharednssdb \-i /home/example\-certs/email\&.cer
|
||||
$ certutil \-E \-n "CN=John Smith Email Cert" \-t ",P," \-d sql:/home/my/sharednssdb \-i /home/example\-certs/email\&.cer
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
|
|
@ -1739,7 +1645,7 @@ option\&. The only required options are to give the security database directory
|
|||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
certutil \-D \-d directory \-n "nickname"
|
||||
certutil \-D \-d [sql:]directory \-n "nickname"
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
|
|
@ -1751,7 +1657,7 @@ For example:
|
|||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
$ certutil \-D \-d /home/my/sharednssdb \-n "my\-ssl\-cert"
|
||||
$ certutil \-D \-d sql:/home/my/sharednssdb \-n "my\-ssl\-cert"
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
|
|
@ -1767,7 +1673,7 @@ command option\&.
|
|||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
certutil \-V \-n certificate\-name [\-b time] [\-e] [\-u cert\-usage] \-d directory
|
||||
certutil \-V \-n certificate\-name [\-b time] [\-e] [\-u cert\-usage] \-d [sql:]directory
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
|
|
@ -1779,7 +1685,7 @@ For example, to validate an email certificate:
|
|||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
$ certutil \-V \-n "John Smith\*(Aqs Email Cert" \-e \-u S,R \-d /home/my/sharednssdb
|
||||
$ certutil \-V \-n "John Smith\*(Aqs Email Cert" \-e \-u S,R \-d sql:/home/my/sharednssdb
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
|
|
@ -1793,7 +1699,7 @@ The trust settings (which relate to the operations that a certificate is allowed
|
|||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
certutil \-M \-n certificate\-name \-t trust\-args \-d directory
|
||||
certutil \-M \-n certificate\-name \-t trust\-args \-d [sql:]directory
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
|
|
@ -1805,7 +1711,7 @@ For example:
|
|||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
$ certutil \-M \-n "My CA Certificate" \-d /home/my/sharednssdb \-t "CT,CT,CT"
|
||||
$ certutil \-M \-n "My CA Certificate" \-d sql:/home/my/sharednssdb \-t "CT,CT,CT"
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
|
|
@ -1823,7 +1729,7 @@ prints the full chain of a certificate, going from the initial CA (the root CA)
|
|||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
$ certutil \-d /home/my/sharednssdb \-O \-n "jsmith@example\&.com"
|
||||
$ certutil \-d sql:/home/my/sharednssdb \-O \-n "jsmith@example\&.com"
|
||||
"Builtin Object Token:Thawte Personal Freemail CA" [E=personal\-freemail@thawte\&.com,CN=Thawte Personal Freemail CA,OU=Certification Services Division,O=Thawte Consulting,L=Cape Town,ST=Western Cape,C=ZA]
|
||||
|
||||
"Thawte Personal Freemail Issuing CA \- Thawte Consulting" [CN=Thawte Personal Freemail Issuing CA,O=Thawte Consulting (Pty) Ltd\&.,C=ZA]
|
||||
|
|
@ -1842,7 +1748,7 @@ The device which stores certificates \-\- both external hardware devices and int
|
|||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
certutil \-T \-d directory \-h token\-name \-0 security\-officer\-password
|
||||
certutil \-T \-d [sql:]directory \-h token\-name \-0 security\-officer\-password
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
|
|
@ -1854,7 +1760,7 @@ Many networks have dedicated personnel who handle changes to security tokens (th
|
|||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
$ certutil \-T \-d /home/my/sharednssdb \-h nethsm \-0 secret
|
||||
$ certutil \-T \-d sql:/home/my/sharednssdb \-h nethsm \-0 secret
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
|
|
@ -1879,7 +1785,7 @@ command must give information about the original database and then use the stand
|
|||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
certutil \-\-upgrade\-merge \-d directory [\-P dbprefix] \-\-source\-dir directory \-\-source\-prefix dbprefix \-\-upgrade\-id id \-\-upgrade\-token\-name name [\-@ password\-file]
|
||||
certutil \-\-upgrade\-merge \-d [sql:]directory [\-P dbprefix] \-\-source\-dir directory \-\-source\-prefix dbprefix \-\-upgrade\-id id \-\-upgrade\-token\-name name [\-@ password\-file]
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
|
|
@ -1891,7 +1797,7 @@ For example:
|
|||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
$ certutil \-\-upgrade\-merge \-d /home/my/sharednssdb \-\-source\-dir /opt/my\-app/alias/ \-\-source\-prefix serverapp\- \-\-upgrade\-id 1 \-\-upgrade\-token\-name internal
|
||||
$ certutil \-\-upgrade\-merge \-d sql:/home/my/sharednssdb \-\-source\-dir /opt/my\-app/alias/ \-\-source\-prefix serverapp\- \-\-upgrade\-id 1 \-\-upgrade\-token\-name internal
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
|
|
@ -1905,7 +1811,7 @@ command only requires information about the location of the original database; s
|
|||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
certutil \-\-merge \-d directory [\-P dbprefix] \-\-source\-dir directory \-\-source\-prefix dbprefix [\-@ password\-file]
|
||||
certutil \-\-merge \-d [sql:]directory [\-P dbprefix] \-\-source\-dir directory \-\-source\-prefix dbprefix [\-@ password\-file]
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
|
|
@ -1917,7 +1823,7 @@ For example:
|
|||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
$ certutil \-\-merge \-d /home/my/sharednssdb \-\-source\-dir /opt/my\-app/alias/ \-\-source\-prefix serverapp\-
|
||||
$ certutil \-\-merge \-d sql:/home/my/sharednssdb \-\-source\-dir /opt/my\-app/alias/ \-\-source\-prefix serverapp\-
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
|
|
@ -2020,30 +1926,30 @@ database type\&. The shared database type is preferred; the legacy format is inc
|
|||
.PP
|
||||
By default, the tools (\fBcertutil\fR,
|
||||
\fBpk12util\fR,
|
||||
\fBmodutil\fR) assume that the given security databases use the SQLite type\&. Using the legacy databases must be manually specified by using the
|
||||
\fBdbm:\fR
|
||||
\fBmodutil\fR) assume that the given security databases follow the more common legacy type\&. Using the SQLite databases must be manually specified by using the
|
||||
\fBsql:\fR
|
||||
prefix with the given security directory\&. For example:
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
$ certutil \-L \-d dbm:/home/my/sharednssdb
|
||||
$ certutil \-L \-d sql:/home/my/sharednssdb
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.PP
|
||||
To set the legacy database type as the default type for the tools, set the
|
||||
To set the shared database type as the default type for the tools, set the
|
||||
\fBNSS_DEFAULT_DB_TYPE\fR
|
||||
environment variable to
|
||||
\fBdbm\fR:
|
||||
\fBsql\fR:
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
export NSS_DEFAULT_DB_TYPE="dbm"
|
||||
export NSS_DEFAULT_DB_TYPE="sql"
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
|
|
@ -2052,6 +1958,8 @@ export NSS_DEFAULT_DB_TYPE="dbm"
|
|||
This line can be set added to the
|
||||
~/\&.bashrc
|
||||
file to make the change permanent\&.
|
||||
.PP
|
||||
Most applications do not use the shared database by default, but they can be configured to use them\&. For example, this how\-to article covers how to configure Firefox and Thunderbird to use the new shared NSS databases:
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
|
|
|
|||
|
|
@ -1,13 +1,13 @@
|
|||
'\" t
|
||||
.\" Title: CRLUTIL
|
||||
.\" Author: [see the "Authors" section]
|
||||
.\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
|
||||
.\" Date: 19 May 2021
|
||||
.\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>
|
||||
.\" Date: 5 June 2014
|
||||
.\" Manual: NSS Security Tools
|
||||
.\" Source: nss-tools
|
||||
.\" Language: English
|
||||
.\"
|
||||
.TH "CRLUTIL" "1" "19 May 2021" "nss-tools" "NSS Security Tools"
|
||||
.TH "CRLUTIL" "1" "5 June 2014" "nss-tools" "NSS Security Tools"
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * Define some portability stuff
|
||||
.\" -----------------------------------------------------------------
|
||||
|
|
|
|||
|
|
@ -1,13 +1,13 @@
|
|||
'\" t
|
||||
.\" Title: DERDUMP
|
||||
.\" Author: [see the "Authors" section]
|
||||
.\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
|
||||
.\" Date: 19 May 2021
|
||||
.\" Generator: DocBook XSL Stylesheets v1.77.1 <http://docbook.sf.net/>
|
||||
.\" Date: 15 February 2013
|
||||
.\" Manual: NSS Security Tools
|
||||
.\" Source: nss-tools
|
||||
.\" Language: English
|
||||
.\"
|
||||
.TH "DERDUMP" "1" "19 May 2021" "nss-tools" "NSS Security Tools"
|
||||
.TH "DERDUMP" "1" "15 February 2013" "nss-tools" "NSS Security Tools"
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * Define some portability stuff
|
||||
.\" -----------------------------------------------------------------
|
||||
|
|
@ -68,12 +68,12 @@ Mailing lists: pki\-devel@redhat\&.com and pki\-users@redhat\&.com
|
|||
IRC: Freenode at #dogtag\-pki
|
||||
.SH "AUTHORS"
|
||||
.PP
|
||||
The NSS tools were written and maintained by developers with Netscape, Red Hat, Sun, Oracle, Mozilla, and Google\&.
|
||||
The NSS tools were written and maintained by developers with Netscape and now with Red Hat\&.
|
||||
.PP
|
||||
Authors: Gerhardus Geldenhuis <gerhardus\&.geldenhuis@gmail\&.com>\&. Elio Maldonado <emaldona@redhat\&.com>, Deon Lackey <dlackey@redhat\&.com>
|
||||
.SH "LICENSE"
|
||||
.PP
|
||||
Licensed under the Mozilla Public License, v\&. 2\&.0\&. If a copy of the MPL was not distributed with this file, You can obtain one at http://mozilla\&.org/MPL/2\&.0/\&.
|
||||
Licensed under the Mozilla Public License, version 1\&.1, and/or the GNU General Public License, version 2 or later, and/or the GNU Lesser General Public License, version 2\&.1 or later\&.
|
||||
.SH "NOTES"
|
||||
.IP " 1." 4
|
||||
Mozilla NSS bug 836477
|
||||
|
|
|
|||
|
|
@ -2,12 +2,12 @@
|
|||
.\" Title: MODUTIL
|
||||
.\" Author: [see the "Authors" section]
|
||||
.\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
|
||||
.\" Date: 19 May 2021
|
||||
.\" Date: 5 October 2017
|
||||
.\" Manual: NSS Security Tools
|
||||
.\" Source: nss-tools
|
||||
.\" Language: English
|
||||
.\"
|
||||
.TH "MODUTIL" "1" "19 May 2021" "nss-tools" "NSS Security Tools"
|
||||
.TH "MODUTIL" "1" "5 October 2017" "nss-tools" "NSS Security Tools"
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * Define some portability stuff
|
||||
.\" -----------------------------------------------------------------
|
||||
|
|
@ -188,18 +188,18 @@ Enable specific ciphers in a module that is being added to the database\&. The
|
|||
is a colon\-delimited list of cipher names\&. Enclose this list in quotation marks if it contains spaces\&.
|
||||
.RE
|
||||
.PP
|
||||
\-dbdir directory
|
||||
\-dbdir [sql:]directory
|
||||
.RS 4
|
||||
Specify the database directory in which to access or create security module database files\&.
|
||||
.sp
|
||||
\fBmodutil\fR
|
||||
supports two types of databases: the legacy security databases (cert8\&.db,
|
||||
key3\&.db, and
|
||||
secmod\&.db) and SQLite databases (cert9\&.db,
|
||||
secmod\&.db) and new SQLite databases (cert9\&.db,
|
||||
key4\&.db, and
|
||||
pkcs11\&.txt)\&. If the prefix
|
||||
\fBdbm:\fR
|
||||
is not used, then the tool assumes that the given databases are in SQLite format\&.
|
||||
\fBsql:\fR
|
||||
is not used, then the tool assumes that the given databases are in the old format\&.
|
||||
.RE
|
||||
.PP
|
||||
\-\-dbprefix prefix
|
||||
|
|
@ -207,7 +207,7 @@ is not used, then the tool assumes that the given databases are in SQLite format
|
|||
Specify the prefix used on the database files, such as
|
||||
my_
|
||||
for
|
||||
my_cert9\&.db\&. This option is provided as a special case\&. Changing the names of the certificate and key databases is not recommended\&.
|
||||
my_cert8\&.db\&. This option is provided as a special case\&. Changing the names of the certificate and key databases is not recommended\&.
|
||||
.RE
|
||||
.PP
|
||||
\-installdir root\-installation\-directory
|
||||
|
|
@ -330,7 +330,7 @@ can be used to create these files\&. The only required argument is the database
|
|||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
modutil \-create \-dbdir directory
|
||||
modutil \-create \-dbdir [sql:]directory
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
|
|
@ -358,7 +358,7 @@ For example:
|
|||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
modutil \-dbdir /home/my/sharednssdb \-add "Example PKCS #11 Module" \-libfile "/tmp/crypto\&.so" \-mechanisms RSA:DSA:RC2:RANDOM
|
||||
modutil \-dbdir sql:/home/my/sharednssdb \-add "Example PKCS #11 Module" \-libfile "/tmp/crypto\&.so" \-mechanisms RSA:DSA:RC2:RANDOM
|
||||
|
||||
Using database directory \&.\&.\&.
|
||||
Module "Example PKCS #11 Module" added to database\&.
|
||||
|
|
@ -411,7 +411,7 @@ argument\&.
|
|||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
modutil \-dbdir /home/mt"jar\-install\-filey/sharednssdb \-jar install\&.jar \-installdir /home/my/sharednssdb
|
||||
modutil \-dbdir sql:/home/mt"jar\-install\-filey/sharednssdb \-jar install\&.jar \-installdir sql:/home/my/sharednssdb
|
||||
|
||||
This installation JAR file was signed by:
|
||||
\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-
|
||||
|
|
@ -473,7 +473,7 @@ database:
|
|||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
modutil \-delete modulename \-dbdir directory
|
||||
modutil \-delete modulename \-dbdir [sql:]directory
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
|
|
@ -493,7 +493,7 @@ command\&.
|
|||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
modutil \-list [modulename] \-dbdir directory
|
||||
modutil \-list [modulename] \-dbdir [sql:]directory
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
|
|
@ -505,7 +505,7 @@ Listing the modules shows the module name, their status, and other associated se
|
|||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
modutil \-list \-dbdir /home/my/sharednssdb
|
||||
modutil \-list \-dbdir sql:/home/my/sharednssdb
|
||||
|
||||
Listing of PKCS #11 Modules
|
||||
\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-
|
||||
|
|
@ -534,7 +534,7 @@ returns details information about the module itself, like supported cipher mecha
|
|||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
modutil \-list "NSS Internal PKCS #11 Module" \-dbdir /home/my/sharednssdb
|
||||
modutil \-list "NSS Internal PKCS #11 Module" \-dbdir sql:/home/my/sharednssdb
|
||||
|
||||
\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-
|
||||
Name: NSS Internal PKCS #11 Module
|
||||
|
|
@ -594,7 +594,7 @@ command\&.)
|
|||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
modutil \-rawlist \-dbdir /home/my/sharednssdb
|
||||
modutil \-rawlist \-dbdir sql:/home/my/sharednssdb
|
||||
name="NSS Internal PKCS #11 Module" parameters="configdir=\&. certPrefix= keyPrefix= secmod=secmod\&.db flags=readOnly " NSS="trustOrder=75 cipherOrder=100 slotParams={0x00000001=[slotFlags=RSA,RC4,RC2,DES,DH,SHA1,MD5,MD2,SSL,TLS,AES,RANDOM askpw=any timeout=30 ] } Flags=internal,critical"
|
||||
.fi
|
||||
.if n \{\
|
||||
|
|
@ -688,7 +688,7 @@ option\&. For example:
|
|||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
modutil \-fips true \-dbdir /home/my/sharednssdb/
|
||||
modutil \-fips true \-dbdir sql:/home/my/sharednssdb/
|
||||
|
||||
FIPS mode enabled\&.
|
||||
.fi
|
||||
|
|
@ -704,7 +704,7 @@ command with either a true or false flag (it doesn\*(Aqt matter which)\&. The to
|
|||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
modutil \-chkfips false \-dbdir /home/my/sharednssdb/
|
||||
modutil \-chkfips false \-dbdir sql:/home/my/sharednssdb/
|
||||
|
||||
FIPS mode enabled\&.
|
||||
.fi
|
||||
|
|
@ -730,7 +730,7 @@ modutil \-changepw tokenname [\-pwfile old\-password\-file] [\-newpwfile new\-pa
|
|||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
modutil \-dbdir /home/my/sharednssdb \-changepw "NSS Certificate DB"
|
||||
modutil \-dbdir sql:/home/my/sharednssdb \-changepw "NSS Certificate DB"
|
||||
|
||||
Enter old password:
|
||||
Incorrect password, try again\&.\&.\&.
|
||||
|
|
@ -1341,30 +1341,30 @@ database type\&. The shared database type is preferred; the legacy format is inc
|
|||
.PP
|
||||
By default, the tools (\fBcertutil\fR,
|
||||
\fBpk12util\fR,
|
||||
\fBmodutil\fR) assume that the given security databases use the SQLite type\&. Using the legacy databases must be manually specified by using the
|
||||
\fBdbm:\fR
|
||||
\fBmodutil\fR) assume that the given security databases follow the more common legacy type\&. Using the SQLite databases must be manually specified by using the
|
||||
\fBsql:\fR
|
||||
prefix with the given security directory\&. For example:
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
modutil \-create \-dbdir dbm:/home/my/sharednssdb
|
||||
modutil \-create \-dbdir sql:/home/my/sharednssdb
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.PP
|
||||
To set the legacy database type as the default type for the tools, set the
|
||||
To set the shared database type as the default type for the tools, set the
|
||||
\fBNSS_DEFAULT_DB_TYPE\fR
|
||||
environment variable to
|
||||
\fBdbm\fR:
|
||||
\fBsql\fR:
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
export NSS_DEFAULT_DB_TYPE="dbm"
|
||||
export NSS_DEFAULT_DB_TYPE="sql"
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
|
|
@ -1373,6 +1373,8 @@ export NSS_DEFAULT_DB_TYPE="dbm"
|
|||
This line can be added to the
|
||||
~/\&.bashrc
|
||||
file to make the change permanent for the user\&.
|
||||
.PP
|
||||
Most applications do not use the shared database by default, but they can be configured to use them\&. For example, this how\-to article covers how to configure Firefox and Thunderbird to use the new shared NSS databases:
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
|
|
|
|||
|
|
@ -2,12 +2,12 @@
|
|||
.\" Title: PK12UTIL
|
||||
.\" Author: [see the "Authors" section]
|
||||
.\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
|
||||
.\" Date: 19 May 2021
|
||||
.\" Date: 5 October 2017
|
||||
.\" Manual: NSS Security Tools
|
||||
.\" Source: nss-tools
|
||||
.\" Language: English
|
||||
.\"
|
||||
.TH "PK12UTIL" "1" "19 May 2021" "nss-tools" "NSS Security Tools"
|
||||
.TH "PK12UTIL" "1" "5 October 2017" "nss-tools" "NSS Security Tools"
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * Define some portability stuff
|
||||
.\" -----------------------------------------------------------------
|
||||
|
|
@ -31,7 +31,7 @@
|
|||
pk12util \- Export and import keys and certificate to or from a PKCS #12 file and the NSS database
|
||||
.SH "SYNOPSIS"
|
||||
.HP \w'\fBpk12util\fR\ 'u
|
||||
\fBpk12util\fR [\-i\ p12File|\-l\ p12File|\-o\ p12File] [\-c\ keyCipher] [\-C\ certCipher] [\-d\ directory] [\-h\ tokenname] [\-m\ |\ \-\-key\-len\ keyLength] [\-M\ hashAlg] [\-n\ certname] [\-P\ dbprefix] [\-r] [\-v] [\-\-cert\-key\-len\ certKeyLength] [\-k\ slotPasswordFile|\-K\ slotPassword] [\-w\ p12filePasswordFile|\-W\ p12filePassword]
|
||||
\fBpk12util\fR [\-i\ p12File|\-l\ p12File|\-o\ p12File] [\-d\ [sql:]directory] [\-h\ tokenname] [\-P\ dbprefix] [\-r] [\-v] [\-k\ slotPasswordFile|\-K\ slotPassword] [\-w\ p12filePasswordFile|\-W\ p12filePassword]
|
||||
.SH "STATUS"
|
||||
.PP
|
||||
This documentation is still work in progress\&. Please contribute to the initial review in
|
||||
|
|
@ -71,7 +71,7 @@ Specify the key encryption algorithm\&.
|
|||
Specify the certiticate encryption algorithm\&.
|
||||
.RE
|
||||
.PP
|
||||
\-d directory
|
||||
\-d [sql:]directory
|
||||
.RS 4
|
||||
Specify the database directory into which to import to or export from certificates and keys\&.
|
||||
.sp
|
||||
|
|
@ -81,8 +81,8 @@ key3\&.db, and
|
|||
secmod\&.db) and new SQLite databases (cert9\&.db,
|
||||
key4\&.db, and
|
||||
pkcs11\&.txt)\&. If the prefix
|
||||
\fBdbm:\fR
|
||||
is not used, then the tool assumes that the given databases are in the SQLite format\&.
|
||||
\fBsql:\fR
|
||||
is not used, then the tool assumes that the given databases are in the old format\&.
|
||||
.RE
|
||||
.PP
|
||||
\-h tokenname
|
||||
|
|
@ -105,12 +105,7 @@ Specify the slot\*(Aqs password\&.
|
|||
Specify the desired length of the symmetric key to be used to encrypt the private key\&.
|
||||
.RE
|
||||
.PP
|
||||
\-M hashAlg
|
||||
.RS 4
|
||||
Specify the hash algorithm used in the pkcs #12 mac\&. This algorithm also specifies the HMAC used in the prf when using pkcs #5 v2\&.
|
||||
.RE
|
||||
.PP
|
||||
\-\-cert\-key\-len certKeyLength
|
||||
\-n | \-\-cert\-key\-len certKeyLength
|
||||
.RS 4
|
||||
Specify the desired length of the symmetric key to be used to encrypt the certificates and other meta\-data\&.
|
||||
.RE
|
||||
|
|
@ -445,7 +440,7 @@ for a directory or
|
|||
\fB\-h\fR
|
||||
for a token)\&.
|
||||
.PP
|
||||
pk12util \-i p12File [\-h tokenname] [\-v] [\-d directory] [\-P dbprefix] [\-k slotPasswordFile|\-K slotPassword] [\-w p12filePasswordFile|\-W p12filePassword]
|
||||
pk12util \-i p12File [\-h tokenname] [\-v] [\-d [sql:]directory] [\-P dbprefix] [\-k slotPasswordFile|\-K slotPassword] [\-w p12filePasswordFile|\-W p12filePassword]
|
||||
.PP
|
||||
For example:
|
||||
.PP
|
||||
|
|
@ -455,7 +450,7 @@ For example:
|
|||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
# pk12util \-i /tmp/cert\-files/users\&.p12 \-d /home/my/sharednssdb
|
||||
# pk12util \-i /tmp/cert\-files/users\&.p12 \-d sql:/home/my/sharednssdb
|
||||
|
||||
Enter a password which will be used to encrypt your keys\&.
|
||||
The password should be at least 8 characters long,
|
||||
|
|
@ -476,7 +471,7 @@ Using the
|
|||
\fBpk12util\fR
|
||||
command to export certificates and keys requires both the name of the certificate to extract from the database (\fB\-n\fR) and the PKCS #12\-formatted output file to write to\&. There are optional parameters that can be used to encrypt the file to protect the certificate material\&.
|
||||
.PP
|
||||
pk12util \-o p12File \-n certname [\-c keyCipher] [\-C certCipher] [\-m|\-\-key_len keyLen] [\-n|\-\-cert_key_len certKeyLen] [\-d directory] [\-P dbprefix] [\-k slotPasswordFile|\-K slotPassword] [\-w p12filePasswordFile|\-W p12filePassword]
|
||||
pk12util \-o p12File \-n certname [\-c keyCipher] [\-C certCipher] [\-m|\-\-key_len keyLen] [\-n|\-\-cert_key_len certKeyLen] [\-d [sql:]directory] [\-P dbprefix] [\-k slotPasswordFile|\-K slotPassword] [\-w p12filePasswordFile|\-W p12filePassword]
|
||||
.PP
|
||||
For example:
|
||||
.sp
|
||||
|
|
@ -484,7 +479,7 @@ For example:
|
|||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
# pk12util \-o certs\&.p12 \-n Server\-Cert \-d /home/my/sharednssdb
|
||||
# pk12util \-o certs\&.p12 \-n Server\-Cert \-d sql:/home/my/sharednssdb
|
||||
Enter password for PKCS12 file:
|
||||
Re\-enter password:
|
||||
.fi
|
||||
|
|
@ -500,7 +495,7 @@ file are not human\-readable\&. The certificates and keys in the file can be pri
|
|||
\&.p12
|
||||
file\&.
|
||||
.PP
|
||||
pk12util \-l p12File [\-h tokenname] [\-r] [\-d directory] [\-P dbprefix] [\-k slotPasswordFile|\-K slotPassword] [\-w p12filePasswordFile|\-W p12filePassword]
|
||||
pk12util \-l p12File [\-h tokenname] [\-r] [\-d [sql:]directory] [\-P dbprefix] [\-k slotPasswordFile|\-K slotPassword] [\-w p12filePasswordFile|\-W p12filePassword]
|
||||
.PP
|
||||
For example, this prints the default ASCII output:
|
||||
.sp
|
||||
|
|
@ -742,30 +737,30 @@ database type\&. The shared database type is preferred; the legacy format is inc
|
|||
.PP
|
||||
By default, the tools (\fBcertutil\fR,
|
||||
\fBpk12util\fR,
|
||||
\fBmodutil\fR) assume that the given security databases use the SQLite type Using the legacy databases must be manually specified by using the
|
||||
\fBdbm:\fR
|
||||
\fBmodutil\fR) assume that the given security databases follow the more common legacy type\&. Using the SQLite databases must be manually specified by using the
|
||||
\fBsql:\fR
|
||||
prefix with the given security directory\&. For example:
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
# pk12util \-i /tmp/cert\-files/users\&.p12 \-d dbm:/home/my/sharednssdb
|
||||
# pk12util \-i /tmp/cert\-files/users\&.p12 \-d sql:/home/my/sharednssdb
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.PP
|
||||
To set the legacy database type as the default type for the tools, set the
|
||||
To set the shared database type as the default type for the tools, set the
|
||||
\fBNSS_DEFAULT_DB_TYPE\fR
|
||||
environment variable to
|
||||
\fBdbm\fR:
|
||||
\fBsql\fR:
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
export NSS_DEFAULT_DB_TYPE="dbm"
|
||||
export NSS_DEFAULT_DB_TYPE="sql"
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
|
|
@ -774,6 +769,8 @@ export NSS_DEFAULT_DB_TYPE="dbm"
|
|||
This line can be set added to the
|
||||
~/\&.bashrc
|
||||
file to make the change permanent\&.
|
||||
.PP
|
||||
Most applications do not use the shared database by default, but they can be configured to use them\&. For example, this how\-to article covers how to configure Firefox and Thunderbird to use the new shared NSS databases:
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
|
|
|
|||
|
|
@ -1,13 +1,13 @@
|
|||
'\" t
|
||||
.\" Title: PP
|
||||
.\" Author: [see the "Authors" section]
|
||||
.\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
|
||||
.\" Date: 19 May 2021
|
||||
.\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>
|
||||
.\" Date: 29 July 2014
|
||||
.\" Manual: NSS Security Tools
|
||||
.\" Source: nss-tools
|
||||
.\" Language: English
|
||||
.\"
|
||||
.TH "PP" "1" "19 May 2021" "nss-tools" "NSS Security Tools"
|
||||
.TH "PP" "1" "29 July 2014" "nss-tools" "NSS Security Tools"
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * Define some portability stuff
|
||||
.\" -----------------------------------------------------------------
|
||||
|
|
@ -38,12 +38,12 @@ This documentation is still work in progress\&. Please contribute to the initial
|
|||
\m[blue]\fBMozilla NSS bug 836477\fR\m[]\&\s-2\u[1]\d\s+2
|
||||
.SH "DESCRIPTION"
|
||||
.PP
|
||||
\fBpp \fRpretty\-prints private and public key, certificate, certificate\-request, pkcs7, pkcs12 or crl files
|
||||
\fBpp \fRpretty\-prints private and public key, certificate, certificate\-request, pkcs7 or crl files
|
||||
.SH "OPTIONS"
|
||||
.PP
|
||||
\fB\-t \fR \fItype\fR
|
||||
.RS 4
|
||||
specify the input, one of {private\-key | public\-key | certificate | certificate\-request | pkcs7 | pkcs12 | crl | name}
|
||||
specify the input, one of {private\-key | public\-key | certificate | certificate\-request | pkcs7 | crl}
|
||||
.sp
|
||||
.RE
|
||||
.PP
|
||||
|
|
|
|||
|
|
@ -1,13 +1,13 @@
|
|||
'\" t
|
||||
.\" Title: signtool
|
||||
.\" Author: [see the "Authors" section]
|
||||
.\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
|
||||
.\" Date: 19 May 2021
|
||||
.\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>
|
||||
.\" Date: 5 June 2014
|
||||
.\" Manual: NSS Security Tools
|
||||
.\" Source: nss-tools
|
||||
.\" Language: English
|
||||
.\"
|
||||
.TH "SIGNTOOL" "1" "19 May 2021" "nss-tools" "NSS Security Tools"
|
||||
.TH "SIGNTOOL" "1" "5 June 2014" "nss-tools" "NSS Security Tools"
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * Define some portability stuff
|
||||
.\" -----------------------------------------------------------------
|
||||
|
|
|
|||
|
|
@ -1,13 +1,13 @@
|
|||
'\" t
|
||||
.\" Title: SIGNVER
|
||||
.\" Author: [see the "Authors" section]
|
||||
.\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
|
||||
.\" Date: 19 May 2021
|
||||
.\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>
|
||||
.\" Date: 5 June 2014
|
||||
.\" Manual: NSS Security Tools
|
||||
.\" Source: nss-tools
|
||||
.\" Language: English
|
||||
.\"
|
||||
.TH "SIGNVER" "1" "19 May 2021" "nss-tools" "NSS Security Tools"
|
||||
.TH "SIGNVER" "1" "5 June 2014" "nss-tools" "NSS Security Tools"
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * Define some portability stuff
|
||||
.\" -----------------------------------------------------------------
|
||||
|
|
@ -52,7 +52,7 @@ Displays all of the information in the PKCS#7 signature\&.
|
|||
Verifies the digital signature\&.
|
||||
.RE
|
||||
.PP
|
||||
\-d \fIdirectory\fR
|
||||
\-d [sql:]\fIdirectory\fR
|
||||
.RS 4
|
||||
Specify the database directory which contains the certificates and keys\&.
|
||||
.sp
|
||||
|
|
@ -62,8 +62,8 @@ key3\&.db, and
|
|||
secmod\&.db) and new SQLite databases (cert9\&.db,
|
||||
key4\&.db, and
|
||||
pkcs11\&.txt)\&. If the prefix
|
||||
\fBdbm:\fR
|
||||
is not used, then the tool assumes that the given databases are in the SQLite format\&.
|
||||
\fBsql:\fR
|
||||
is not used, then the tool assumes that the given databases are in the old format\&.
|
||||
.RE
|
||||
.PP
|
||||
\-a
|
||||
|
|
@ -101,7 +101,7 @@ option verifies that the signature in a given signature file is valid when used
|
|||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
signver \-V \-s \fIsignature_file\fR \-i \fIsigned_file\fR \-d /home/my/sharednssdb
|
||||
signver \-V \-s \fIsignature_file\fR \-i \fIsigned_file\fR \-d sql:/home/my/sharednssdb
|
||||
|
||||
signatureValid=yes
|
||||
.fi
|
||||
|
|
@ -207,30 +207,30 @@ database type\&. The shared database type is preferred; the legacy format is inc
|
|||
.PP
|
||||
By default, the tools (\fBcertutil\fR,
|
||||
\fBpk12util\fR,
|
||||
\fBmodutil\fR) assume that the given security databases use the SQLite type Using the legacy databases must be manually specified by using the
|
||||
\fBdbm:\fR
|
||||
\fBmodutil\fR) assume that the given security databases follow the more common legacy type\&. Using the SQLite databases must be manually specified by using the
|
||||
\fBsql:\fR
|
||||
prefix with the given security directory\&. For example:
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
# signver \-A \-s \fIsignature\fR \-d dbm:/home/my/sharednssdb
|
||||
# signver \-A \-s \fIsignature\fR \-d sql:/home/my/sharednssdb
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.PP
|
||||
To set the legacy database type as the default type for the tools, set the
|
||||
To set the shared database type as the default type for the tools, set the
|
||||
\fBNSS_DEFAULT_DB_TYPE\fR
|
||||
environment variable to
|
||||
\fBdbm\fR:
|
||||
\fBsql\fR:
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
export NSS_DEFAULT_DB_TYPE="dbm"
|
||||
export NSS_DEFAULT_DB_TYPE="sql"
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
|
|
@ -239,6 +239,8 @@ export NSS_DEFAULT_DB_TYPE="dbm"
|
|||
This line can be added to the
|
||||
~/\&.bashrc
|
||||
file to make the change permanent for the user\&.
|
||||
.PP
|
||||
Most applications do not use the shared database by default, but they can be configured to use them\&. For example, this how\-to article covers how to configure Firefox and Thunderbird to use the new shared NSS databases:
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
|
|
|
|||
|
|
@ -1,13 +1,13 @@
|
|||
'\" t
|
||||
.\" Title: SSLTAP
|
||||
.\" Author: [see the "Authors" section]
|
||||
.\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
|
||||
.\" Date: 19 May 2021
|
||||
.\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>
|
||||
.\" Date: 5 June 2014
|
||||
.\" Manual: NSS Security Tools
|
||||
.\" Source: nss-tools
|
||||
.\" Language: English
|
||||
.\"
|
||||
.TH "SSLTAP" "1" "19 May 2021" "nss-tools" "NSS Security Tools"
|
||||
.TH "SSLTAP" "1" "5 June 2014" "nss-tools" "NSS Security Tools"
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * Define some portability stuff
|
||||
.\" -----------------------------------------------------------------
|
||||
|
|
|
|||
|
|
@ -1,13 +1,13 @@
|
|||
'\" t
|
||||
.\" Title: VFYCHAIN
|
||||
.\" Author: [see the "Authors" section]
|
||||
.\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
|
||||
.\" Date: 19 May 2021
|
||||
.\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>
|
||||
.\" Date: 5 June 2014
|
||||
.\" Manual: NSS Security Tools
|
||||
.\" Source: nss-tools
|
||||
.\" Language: English
|
||||
.\"
|
||||
.TH "VFYCHAIN" "1" "19 May 2021" "nss-tools" "NSS Security Tools"
|
||||
.TH "VFYCHAIN" "1" "5 June 2014" "nss-tools" "NSS Security Tools"
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * Define some portability stuff
|
||||
.\" -----------------------------------------------------------------
|
||||
|
|
|
|||
|
|
@ -1,13 +1,13 @@
|
|||
'\" t
|
||||
.\" Title: VFYSERV
|
||||
.\" Author: [see the "Authors" section]
|
||||
.\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
|
||||
.\" Date: 19 May 2021
|
||||
.\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>
|
||||
.\" Date: 5 June 2014
|
||||
.\" Manual: NSS Security Tools
|
||||
.\" Source: nss-tools
|
||||
.\" Language: English
|
||||
.\"
|
||||
.TH "VFYSERV" "1" "19 May 2021" "nss-tools" "NSS Security Tools"
|
||||
.TH "VFYSERV" "1" "5 June 2014" "nss-tools" "NSS Security Tools"
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * Define some portability stuff
|
||||
.\" -----------------------------------------------------------------
|
||||
|
|
|
|||
|
|
@ -28,17 +28,11 @@
|
|||
<cmdsynopsis>
|
||||
<command>pk12util</command>
|
||||
<arg>-i p12File|-l p12File|-o p12File</arg>
|
||||
<arg>-c keyCipher</arg>
|
||||
<arg>-C certCipher</arg>
|
||||
<arg>-d directory</arg>
|
||||
<arg>-d [sql:]directory</arg>
|
||||
<arg>-h tokenname</arg>
|
||||
<arg>-m | --key-len keyLength</arg>
|
||||
<arg>-M hashAlg</arg>
|
||||
<arg>-n certname</arg>
|
||||
<arg>-P dbprefix</arg>
|
||||
<arg>-r</arg>
|
||||
<arg>-v</arg>
|
||||
<arg>--cert-key-len certKeyLength</arg>
|
||||
<arg>-k slotPasswordFile|-K slotPassword</arg>
|
||||
<arg>-w p12filePasswordFile|-W p12filePassword</arg>
|
||||
</cmdsynopsis>
|
||||
|
|
@ -88,9 +82,9 @@
|
|||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term>-d directory</term>
|
||||
<term>-d [sql:]directory</term>
|
||||
<listitem><para>Specify the database directory into which to import to or export from certificates and keys.</para>
|
||||
<para><command>pk12util</command> supports two types of databases: the legacy security databases (<filename>cert8.db</filename>, <filename>key3.db</filename>, and <filename>secmod.db</filename>) and new SQLite databases (<filename>cert9.db</filename>, <filename>key4.db</filename>, and <filename>pkcs11.txt</filename>). If the prefix <command>dbm:</command> is not used, then the tool assumes that the given databases are in the SQLite format.</para></listitem>
|
||||
<para><command>pk12util</command> supports two types of databases: the legacy security databases (<filename>cert8.db</filename>, <filename>key3.db</filename>, and <filename>secmod.db</filename>) and new SQLite databases (<filename>cert9.db</filename>, <filename>key4.db</filename>, and <filename>pkcs11.txt</filename>). If the prefix <command>sql:</command> is not used, then the tool assumes that the given databases are in the old format.</para></listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
|
|
@ -113,12 +107,6 @@
|
|||
<listitem><para>Specify the desired length of the symmetric key to be used to encrypt the private key.</para></listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term>-M hashAlg</term>
|
||||
<listitem><para>Specify the hash algorithm used in the pkcs #12 mac. This algorithm also specifies the HMAC used in the prf when using pkcs #5 v2.</para></listitem>
|
||||
</varlistentry>
|
||||
|
||||
|
||||
<varlistentry>
|
||||
<term>--cert-key-len certKeyLength</term>
|
||||
<listitem><para>Specify the desired length of the symmetric key to be used to encrypt the certificates and other meta-data.</para></listitem>
|
||||
|
|
@ -249,11 +237,11 @@
|
|||
<para>The most basic usage of <command>pk12util</command> for importing a certificate or key is the PKCS #12 input file (<option>-i</option>) and some way to specify the security database being accessed (either <option>-d</option> for a directory or <option>-h</option> for a token).
|
||||
</para>
|
||||
<para>
|
||||
pk12util -i p12File [-h tokenname] [-v] [-d directory] [-P dbprefix] [-k slotPasswordFile|-K slotPassword] [-w p12filePasswordFile|-W p12filePassword]
|
||||
pk12util -i p12File [-h tokenname] [-v] [-d [sql:]directory] [-P dbprefix] [-k slotPasswordFile|-K slotPassword] [-w p12filePasswordFile|-W p12filePassword]
|
||||
</para>
|
||||
<para>For example:</para>
|
||||
<para> </para>
|
||||
<programlisting># pk12util -i /tmp/cert-files/users.p12 -d /home/my/sharednssdb
|
||||
<programlisting># pk12util -i /tmp/cert-files/users.p12 -d sql:/home/my/sharednssdb
|
||||
|
||||
Enter a password which will be used to encrypt your keys.
|
||||
The password should be at least 8 characters long,
|
||||
|
|
@ -267,16 +255,16 @@ pk12util: PKCS12 IMPORT SUCCESSFUL</programlisting>
|
|||
<para><command>Exporting Keys and Certificates</command></para>
|
||||
<para>Using the <command>pk12util</command> command to export certificates and keys requires both the name of the certificate to extract from the database (<option>-n</option>) and the PKCS #12-formatted output file to write to. There are optional parameters that can be used to encrypt the file to protect the certificate material.
|
||||
</para>
|
||||
<para>pk12util -o p12File -n certname [-c keyCipher] [-C certCipher] [-m|--key_len keyLen] [-n|--cert_key_len certKeyLen] [-d directory] [-P dbprefix] [-k slotPasswordFile|-K slotPassword] [-w p12filePasswordFile|-W p12filePassword]</para>
|
||||
<para>pk12util -o p12File -n certname [-c keyCipher] [-C certCipher] [-m|--key_len keyLen] [-n|--cert_key_len certKeyLen] [-d [sql:]directory] [-P dbprefix] [-k slotPasswordFile|-K slotPassword] [-w p12filePasswordFile|-W p12filePassword]</para>
|
||||
<para>For example:</para>
|
||||
<programlisting># pk12util -o certs.p12 -n Server-Cert -d /home/my/sharednssdb
|
||||
<programlisting># pk12util -o certs.p12 -n Server-Cert -d sql:/home/my/sharednssdb
|
||||
Enter password for PKCS12 file:
|
||||
Re-enter password: </programlisting>
|
||||
|
||||
<para><command>Listing Keys and Certificates</command></para>
|
||||
<para>The information in a <filename>.p12</filename> file are not human-readable. The certificates and keys in the file can be printed (listed) in a human-readable pretty-print format that shows information for every certificate and any public keys in the <filename>.p12</filename> file.
|
||||
</para>
|
||||
<para>pk12util -l p12File [-h tokenname] [-r] [-d directory] [-P dbprefix] [-k slotPasswordFile|-K slotPassword] [-w p12filePasswordFile|-W p12filePassword]</para>
|
||||
<para>pk12util -l p12File [-h tokenname] [-r] [-d [sql:]directory] [-P dbprefix] [-k slotPasswordFile|-K slotPassword] [-w p12filePasswordFile|-W p12filePassword]</para>
|
||||
<para>For example, this prints the default ASCII output:</para>
|
||||
<programlisting># pk12util -l certs.p12
|
||||
|
||||
|
|
@ -394,16 +382,17 @@ BerkleyDB. These new databases provide more accessibility and performance:</para
|
|||
|
||||
<para>Because the SQLite databases are designed to be shared, these are the <emphasis>shared</emphasis> database type. The shared database type is preferred; the legacy format is included for backward compatibility.</para>
|
||||
|
||||
<para>By default, the tools (<command>certutil</command>, <command>pk12util</command>, <command>modutil</command>) assume that the given security databases use the SQLite type
|
||||
Using the legacy databases must be manually specified by using the <command>dbm:</command> prefix with the given security directory. For example:</para>
|
||||
<para>By default, the tools (<command>certutil</command>, <command>pk12util</command>, <command>modutil</command>) assume that the given security databases follow the more common legacy type.
|
||||
Using the SQLite databases must be manually specified by using the <command>sql:</command> prefix with the given security directory. For example:</para>
|
||||
|
||||
<programlisting># pk12util -i /tmp/cert-files/users.p12 -d dbm:/home/my/sharednssdb</programlisting>
|
||||
<programlisting># pk12util -i /tmp/cert-files/users.p12 -d sql:/home/my/sharednssdb</programlisting>
|
||||
|
||||
<para>To set the legacy database type as the default type for the tools, set the <envar>NSS_DEFAULT_DB_TYPE</envar> environment variable to <envar>dbm</envar>:</para>
|
||||
<programlisting>export NSS_DEFAULT_DB_TYPE="dbm"</programlisting>
|
||||
<para>To set the shared database type as the default type for the tools, set the <envar>NSS_DEFAULT_DB_TYPE</envar> environment variable to <envar>sql</envar>:</para>
|
||||
<programlisting>export NSS_DEFAULT_DB_TYPE="sql"</programlisting>
|
||||
|
||||
<para>This line can be set added to the <filename>~/.bashrc</filename> file to make the change permanent.</para>
|
||||
|
||||
<para>Most applications do not use the shared database by default, but they can be configured to use them. For example, this how-to article covers how to configure Firefox and Thunderbird to use the new shared NSS databases:</para>
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
<para>
|
||||
|
|
|
|||
|
|
@ -40,7 +40,7 @@
|
|||
<title>Description</title>
|
||||
|
||||
<para><command>pp </command>pretty-prints private and public key, certificate, certificate-request,
|
||||
pkcs7, pkcs12 or crl files
|
||||
pkcs7 or crl files
|
||||
</para>
|
||||
|
||||
</refsection>
|
||||
|
|
@ -53,7 +53,7 @@
|
|||
<varlistentry>
|
||||
<term><option>-t </option> <replaceable>type</replaceable></term>
|
||||
<listitem>
|
||||
<simpara>specify the input, one of {private-key | public-key | certificate | certificate-request | pkcs7 | pkcs12 | crl | name}</simpara>
|
||||
<simpara>specify the input, one of {private-key | public-key | certificate | certificate-request | pkcs7 | crl}</simpara>
|
||||
<simpara></simpara>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
|
|
|||
|
|
@ -1,230 +0,0 @@
|
|||
.. _mozilla_projects_nss_building:
|
||||
|
||||
Building NSS
|
||||
============
|
||||
|
||||
`Introduction <#introduction>`__
|
||||
--------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
This page has detailed information on how to build NSS. Because NSS is a
|
||||
cross-platform library that builds on many different platforms and has many
|
||||
options, it may be complex to build._ Two build systems are maintained
|
||||
concurrently: a ``Make`` based and a ``gyp`` based system.
|
||||
|
||||
.. _build_environment:
|
||||
|
||||
`Prerequisites <#build_environment>`__
|
||||
------------------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
NSS needs a C and C++ compiler. It has minimal dependencies, including only
|
||||
standard C and C++ libraries, plus `zlib <https://www.zlib.net/>`__.
|
||||
For building, you also need `make <https://www.gnu.org/software/make/>`__.
|
||||
Ideally, also install `gyp-next <https://github.com/nodejs/gyp-next>`__ and `ninja
|
||||
<https://ninja-build.org/>`__ and put them on your path. This is
|
||||
recommended, as the build is faster and more reliable.
|
||||
Please, note that we ``gyp`` is currently unmaintained and that our support for
|
||||
``gyp-next`` is experimental and might be unstable.
|
||||
|
||||
To install prerequisites on different platforms, one can run the following
|
||||
commands:
|
||||
|
||||
**On Linux:**
|
||||
|
||||
.. code::
|
||||
|
||||
sudo apt install mercurial git ninja-build python3-pip
|
||||
python3 -m pip install gyp-next
|
||||
|
||||
**On MacOS:**
|
||||
|
||||
.. code::
|
||||
|
||||
brew install mercurial git ninja python3-pip
|
||||
python3 -m pip install gyp-next
|
||||
|
||||
It is also necessary to make sure that a `python` (not just `python3`)
|
||||
executable is in the path.
|
||||
The Homebrew Python installation has the necessary symlink but may require
|
||||
explicit adding to the PATH variable, for example like this:
|
||||
|
||||
.. code::
|
||||
|
||||
export PATH="/opt/homebrew/opt/python/libexec/bin:$PATH"
|
||||
|
||||
**On Windows:**
|
||||
|
||||
.. code::
|
||||
|
||||
<TODO>
|
||||
|
||||
.. note::
|
||||
To retrieve the source code from the project repositories, users will need to
|
||||
download a release or pull the source code with their favourite Version
|
||||
Control System (git or Mercurial). Installing a VCS is not necessary to build
|
||||
an NSS release when downloaded as a compressed archive.
|
||||
|
||||
By default Mozilla uses a Mercurial repository for NSS. If you whish to
|
||||
contribute to NSS and use ``git`` instead of Mercurial, we encourage you to
|
||||
install `git-cinnabar <https://github.com/glandium/git-cinnabar>`__.
|
||||
|
||||
..
|
||||
`Windows <#windows>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
NSS compilation on Windows uses the same shared build system as Mozilla
|
||||
Firefox. You must first install the `Windows Prerequisites
|
||||
<https://developer.mozilla.org/en-US/docs/Mozilla/Developer_guide/Build_Instructions/Windows_Prerequisites>`__,
|
||||
including **MozillaBuild**.
|
||||
|
||||
You can also build NSS on the Windows Subsystem for Linux, but the resulting binaries aren't
|
||||
usable by other Windows applications.
|
||||
|
||||
.. _get_the_source:
|
||||
|
||||
`Source code <#get_the_source>`__
|
||||
---------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
NSS and NSPR use Mercurial for source control like other Mozilla projects. To
|
||||
check out the latest sources for NSS and NSPR--which may not be part of a
|
||||
stable release--use the following commands:
|
||||
|
||||
.. code::
|
||||
|
||||
hg clone https://hg.mozilla.org/projects/nspr
|
||||
hg clone https://hg.mozilla.org/projects/nss
|
||||
|
||||
|
||||
**To get the source of a specific release, see:**
|
||||
ref:`mozilla_projects_nss_releases` **.**
|
||||
|
||||
To download the source using ``git-cinnabar`` instead:
|
||||
|
||||
.. code::
|
||||
|
||||
git clone hg::https://hg.mozilla.org/projects/nspr
|
||||
git clone hg::https://hg.mozilla.org/projects/nss
|
||||
|
||||
|
||||
`Build with gyp and ninja <#build>`__
|
||||
-------------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
Build NSS and NSPR using our build script from the ``nss`` directory:
|
||||
|
||||
.. code::
|
||||
|
||||
cd nss
|
||||
./build.sh
|
||||
|
||||
This builds both NSPR and NSS in a parent directory called ``dist``.
|
||||
|
||||
Build options are available for this script: ``-o`` will build in **Release**
|
||||
mode instead of the **Debug** mode and ``-c`` will **clean** the ``dist``
|
||||
directory before the build.
|
||||
|
||||
Other build options can be displayed by running ``./build.sh --help``
|
||||
|
||||
.. _build_with_make:
|
||||
|
||||
`Build with make <#build_with_make>`__
|
||||
--------------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
Alternatively, there is a ``make`` target, which produces a similar
|
||||
result. This supports some alternative options, but can be a lot slower.
|
||||
|
||||
.. code::
|
||||
|
||||
USE_64=1 make -j
|
||||
|
||||
The make-based build system for NSS uses a variety of variables to control
|
||||
the build. Below are some of the variables, along with possible values they
|
||||
may be set to.
|
||||
|
||||
.. csv-table::
|
||||
:header: "BUILD_OPT", ""
|
||||
:widths: 10,50
|
||||
|
||||
"0", "Build a debug (non-optimized) version of NSS. **This is the default.**"
|
||||
"1", "Build an optimized (non-debug) version of NSS."
|
||||
|
||||
.. csv-table::
|
||||
:header: "USE_64", ""
|
||||
:widths: 10,50
|
||||
|
||||
"0", "Build for a 32-bit environment/ABI. **This is the default.**"
|
||||
"1", "Build for a 64-bit environment/ABI. *This is recommended.*"
|
||||
|
||||
.. csv-table::
|
||||
:header: "USE_ASAN", ""
|
||||
:widths: 10,50
|
||||
|
||||
"0", "Do not create an `AddressSanitizer
|
||||
<http://clang.llvm.org/docs/AddressSanitizer.html>`__ build. **This is the default.**"
|
||||
"1", "Create an AddressSanitizer build."
|
||||
|
||||
|
||||
.. _unit_testing:
|
||||
|
||||
`Unit testing <#unit_testing>`__
|
||||
--------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
NSS contains extensive unit tests. Scripts to run these are found in the ``tests`` directory.
|
||||
Run the standard suite by:
|
||||
|
||||
.. code::
|
||||
|
||||
HOST=localhost DOMSUF=localdomain USE_64=1 ./tests/all.sh
|
||||
|
||||
.. _unit_test_configuration:
|
||||
|
||||
`Unit test configuration <#unit_test_configuration>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
NSS tests are configured using environment variables.
|
||||
The scripts will attempt to infer values for ``HOST`` and ``DOMSUF``, but
|
||||
can fail. Replace ``localhost`` and ``localdomain`` with the hostname and
|
||||
domain suffix for your host. You need to be able to connect to
|
||||
``$HOST.$DOMSUF``.
|
||||
|
||||
If you don't have a domain suffix you can add an entry to ``/etc/hosts`` (on
|
||||
Windows,\ ``c:\Windows\System32\drivers\etc\hosts``) as follows:
|
||||
|
||||
.. code::
|
||||
|
||||
127.0.0.1 localhost.localdomain
|
||||
|
||||
Validate this opening a command shell and typing: ``ping localhost.localdomain``.
|
||||
|
||||
Remove the ``USE_64=1`` override if using a 32-bit build.
|
||||
|
||||
.. _test_results:
|
||||
|
||||
`Test results <#test_results>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
Running all tests can take a considerable amount of time.
|
||||
|
||||
Test output is stored in ``tests_results/security/$HOST.$NUMBER/``. The file
|
||||
``results.html`` summarizes the results, ``output.log`` captures all the test
|
||||
output.
|
||||
|
||||
Other subdirectories of ``nss/tests`` contain scripts that run a subset of
|
||||
the full suite. Those can be run directly instead of ``all.sh``, which might
|
||||
save some time at the cost of coverage.
|
||||
|
|
@ -1,176 +0,0 @@
|
|||
.. _mozilla_projects_nss_build_artifacts:
|
||||
|
||||
Build artifacts
|
||||
===============
|
||||
|
||||
.. container::
|
||||
|
||||
**Network Security Services (NSS)** is a set of libraries designed to support cross-platform
|
||||
development of communications applications that support TLS, S/MIME, and other Internet security
|
||||
standards. For a general overview of NSS and the standards it supports, see
|
||||
:ref:`mozilla_projects_nss_overview`.
|
||||
|
||||
.. _shared_libraries:
|
||||
|
||||
`Shared libraries <#shared_libraries>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
Network Security Services provides both static libraries and shared libraries. Applications that
|
||||
use the shared libraries must use only the APIs that they export. Three shared libraries export
|
||||
public functions:
|
||||
|
||||
- The SSL/TLS library supports core TLS operations.
|
||||
- The S/MIME library supports core S/MIME operations.
|
||||
- The freebl library supports core crypto operations.
|
||||
|
||||
.. note::
|
||||
|
||||
We guarantee that applications using the exported APIs will remain compatible with future
|
||||
versions of those libraries until deprecated.
|
||||
|
||||
.. container::
|
||||
|
||||
..
|
||||
For a complete list of public functions exported by these shared
|
||||
libraries in NSS 3.2, see :ref:`mozilla_projects_nss_reference_nss_functions`.
|
||||
|
||||
..
|
||||
For information on which static libraries in NSS 3.1.1 are replaced by each of the above shared
|
||||
libraries in NSS 3.2 , see `Migration from NSS
|
||||
3.1.1 <https://www-archive.mozilla.org/projects/security/pki/nss/release_notes_32.html#migration>`__.
|
||||
|
||||
..
|
||||
Figure 1, below, shows a simplified view of the relationships among the three shared libraries
|
||||
listed above and NSPR, which provides low-level cross platform support for operations such as
|
||||
threading and I/O. (Note that NSPR is a separate Mozilla project; see `Netscape Portable
|
||||
Runtime <https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSPR>`__ for details.)
|
||||
|
||||
.. image:: /en-US/docs/Mozilla/Projects/NSS/Introduction_to_Network_Security_Services/nss.gif
|
||||
:alt: Diagram showing the relationships among core NSS libraries and NSPR.
|
||||
:width: 429px
|
||||
:height: 196px
|
||||
|
||||
.. _naming_conventions_and_special_libraries:
|
||||
|
||||
`Naming conventions <#naming_conventions_and_special_libraries>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
Windows and Unix use different naming conventions for static and dynamic
|
||||
libraries:
|
||||
|
||||
======= ======== ===============================
|
||||
Windows Unix
|
||||
static ``.lib`` ``.a``
|
||||
dynamic ``.dll`` ``.so`` or ``.dylib`` or ``.sl``
|
||||
======= ======== ===============================
|
||||
|
||||
In addition, Windows has "import" libraries that bind to dynamic
|
||||
libraries. So the NSS library has the following forms:
|
||||
|
||||
- ``libnss3.so`` - Linux shared library
|
||||
- ``libnss3.dylib`` - MacOS shared library
|
||||
- ``libnss3.sl`` - HP-UX shared library
|
||||
- ``libnss.a`` - Unix static library
|
||||
- ``nss3.dll`` - Windows shared library
|
||||
- ``nss3.lib`` - Windows import library binding to ``nss3.dll``
|
||||
- ``nss.lib`` - Windows static library
|
||||
|
||||
NSS, SSL, and S/MIME have all of the above forms.
|
||||
|
||||
The following static libraries aren't included in any shared libraries
|
||||
|
||||
- ``libcrmf.a``/``crmf.lib`` provides an API for CRMF operations.
|
||||
- ``libjar.a``/``jar.lib`` provides an API for creating JAR files.
|
||||
|
||||
The following static libraries are included only in external loadable PKCS
|
||||
#11 modules:
|
||||
|
||||
- ``libnssckfw.a``/``nssckfw.lib`` provides an API for writing PKCS #11 modules.
|
||||
- ``libswfci.a``/``swfci.lib`` provides support for software FORTEZZA.
|
||||
|
||||
The following shared libraries are standalone loadable modules, not meant to
|
||||
be linked with directly:
|
||||
|
||||
- ``libfort.so``/``libfort.sl``/``fort32.dll`` provides support for hardware FORTEZZA.
|
||||
- ``libswft.so``/``libswft.sl``/``swft32.dll`` provides support for software FORTEZZA.
|
||||
- ``libnssckbi.so``/``libnssckbi.sl``/``nssckbi.dll`` defines the default set
|
||||
of trusted root certificates.
|
||||
|
||||
..
|
||||
.. _support_for_ilp32:
|
||||
|
||||
`Support for ILP32 <#support_for_ilp32>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
In NSS 3.2 and later versions, there are two new shared libraries for the platforms HP-UX for
|
||||
PARisc CPUs and Solaris for (Ultra)Sparc (not x86) CPUs. These HP and Solaris platforms allow
|
||||
programs that use the ILP32 program model to run on both 32-bit CPUs and 64-bit CPUs. The two
|
||||
libraries exist to provide optimal performance on each of the two types of CPUs.
|
||||
|
||||
These two extra shared libraries are not supplied on any other platforms. The names of these
|
||||
libraries are platform-dependent, as shown in the following table.
|
||||
|
||||
================================== ============================ ============================
|
||||
Platform for 32-bit CPUs for 64-bit CPUs
|
||||
Solaris/Sparc ``libfreebl_pure32_3.so`` ``libfreebl_hybrid_3.so``
|
||||
HPUX/PARisc ``libfreebl_pure32_3.sl`` ``libfreebl_hybrid_3.sl``
|
||||
AIX (planned for a future release) ``libfreebl_pure32_3_shr.a`` ``libfreebl_hybrid_3_shr.a``
|
||||
================================== ============================ ============================
|
||||
|
||||
An application should not link against these libraries, because they are dynamically loaded by
|
||||
NSS at run time. Linking the application against one or the other of these libraries may produce
|
||||
an application program that can only run on one type of CPU (e.g. only on 64-bit CPUs, not on
|
||||
32-bit CPUs) or that doesn't use the more efficient 64-bit code on 64-bit CPUs, which defeats the
|
||||
purpose of having these shared libraries.
|
||||
|
||||
On platforms for which these shared libraries exist, NSS 3.2 will fail if these shared libs are
|
||||
not present. So, an application must include these files in its distribution of NSS shared
|
||||
libraries. These shared libraries should be installed in the same directory where the other NSS
|
||||
shared libraries (such as ``libnss3.so``) are installed. Both shared libs should always be
|
||||
installed whether the target system has a 32-bit CPU or a 64-bit CPU. NSS will pick the right one
|
||||
for the local system at run time.
|
||||
|
||||
Note that NSS 3.x is also available in the LP64 model for these platforms, but the LP64 model of
|
||||
NSS 3.x does not have these two extra shared libraries.
|
||||
|
||||
..
|
||||
.. _what_you_should_already_know:
|
||||
|
||||
`What you should already know <#what_you_should_already_know>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
Before using NSS, you should be familiar with the following topics:
|
||||
|
||||
- Concepts and techniques of public-key cryptography
|
||||
- The Secure Sockets Layer (SSL) protocol
|
||||
- The PKCS #11 standard for cryptographic token interfaces
|
||||
- Cross-platform development issues and techniques
|
||||
|
||||
.. _where_to_find_more_information:
|
||||
|
||||
`Where to find more information <#where_to_find_more_information>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
For information about PKI and SSL that you should understand before using NSS, see the following:
|
||||
|
||||
- `Introduction to Public-Key
|
||||
Cryptography <https://developer.mozilla.org/en-US/docs/Archive/Security/Introduction_to_Public-Key_Cryptography>`__
|
||||
- `Introduction to
|
||||
SSL <https://developer.mozilla.org/en-US/docs/Archive/Security/Introduction_to_SSL>`__
|
||||
|
||||
For links to API documentation, build instructions, and other useful information, see the
|
||||
:ref:`mozilla_projects_nss`.
|
||||
|
||||
As mentioned above, NSS is built on top of NSPR. The API documentation for NSPR is available at
|
||||
`NSPR API
|
||||
Reference <https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSPR/Reference>`__.
|
||||
|
|
@ -1,70 +0,0 @@
|
|||
.. _mozilla_projects_nss_community:
|
||||
|
||||
Community
|
||||
---------
|
||||
|
||||
Network Security Services (NSS) is maintained by a group of engineers and researchers,
|
||||
mainly RedHat and Mozilla.
|
||||
|
||||
.. warning::
|
||||
|
||||
While the NSS team focuses mainly on supporting platforms and features needded by
|
||||
Firefox and RHEL, we are happy to take contributions.
|
||||
|
||||
Contributors can reach out the the core team and follow NSS related news through the
|
||||
following mailing list, Google group and Element/Matrix channel:
|
||||
|
||||
.. note::
|
||||
|
||||
Mailing list: `https://groups.google.com/a/mozilla.org/g/dev-tech-crypto <https://groups.google.com/a/mozilla.org/g/dev-tech-crypto>`__
|
||||
|
||||
Matrix/Element: `https://app.element.io/#/room/#nss:mozilla.org <https://app.element.io/#/room/#nss:mozilla.org>`__
|
||||
|
||||
..
|
||||
- View Mozilla Security forums...
|
||||
|
||||
- `Mailing list <https://lists.mozilla.org/listinfo/dev-security>`__
|
||||
- `Newsgroup <http://groups.google.com/group/mozilla.dev.security>`__
|
||||
- `RSS feed <http://groups.google.com/group/mozilla.dev.security/feeds>`__
|
||||
|
||||
.. _how_to_contribute:
|
||||
|
||||
`How to Contribute <#how_to_contribute>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
Start by opening a **Bugzilla** account at `bugzilla.mozilla.org <https://bugzilla.mozilla.org/>`__ if you don't have one.
|
||||
|
||||
``NSS :: Libraries`` is the component for issues you'd like to work on.
|
||||
We maintain a list of `NSS bugs marked with a keyword "good-first-bug" <https://bugzilla.mozilla.org/buglist.cgi?keywords=good-first-bug%2C%20&keywords_type=allwords&classification=Components&query_format=advanced&bug_status=UNCONFIRMED&bug_status=NEW&bug_status=ASSIGNED&bug_status=REOPENED&component=Libraries&product=NSS>`__.
|
||||
|
||||
.. _creating_your_patch:
|
||||
|
||||
`Creating your Patch <#creating_your_patch>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
See our section on :ref:`mozilla_projects_nss_nss_sources_building_testing` to get started
|
||||
making your patch. When you're satisfied with it, you'll need code review.
|
||||
|
||||
.. _code_review:
|
||||
|
||||
`Code Review <#code_review>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
`http://phabricator.services.mozilla.com/ <https://phabricator.services.mozilla.com>`__ is our
|
||||
code review tool, which uses your Bugzilla account.
|
||||
|
||||
Use our `Phabricator user instructions <https://moz-conduit.readthedocs.io/en/latest/phabricator-user.html>`__ to upload patches for review.
|
||||
Some items that will be evaluated during code review are `listed in checklist form on
|
||||
Github. <https://github.com/mozilla/nss-tools/blob/master/nss-code-review-checklist.yaml>`__
|
||||
|
||||
After passing review, your patch can be landed by a member of the NSS team. Note that we don't land code that isn't both reviewed and tested.
|
||||
|
||||
.. warning::
|
||||
|
||||
Please reach out to the team before engaging in a lot of work to make ensure we are willing to accept your contributions.
|
||||
|
|
@ -1,60 +0,0 @@
|
|||
.. _mozilla_projects_nss_getting_started:
|
||||
|
||||
.. warning::
|
||||
This NSS documentation was just imported from our legacy MDN repository. It currently is very deprecated and likely incorrect or broken in many places.
|
||||
|
||||
Getting Started
|
||||
===============
|
||||
|
||||
.. _how_to_get_involved_with_nss:
|
||||
|
||||
`How to get involved with NSS <#how_to_get_involved_with_nss>`__
|
||||
----------------------------------------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
| Network Security Services (NSS) is a base library for cryptographic algorithms and secure
|
||||
network protocols used by Mozilla software.
|
||||
| Would you like to get involved and help us to improve the core security of Mozilla Firefox and
|
||||
other applications that make use of NSS? We are looking forward to your contributions!
|
||||
|
||||
.. note::
|
||||
|
||||
We have a large list of tasks waiting for attention, and we are happy to assist you in
|
||||
identifying areas that match your interest or skills. You can find us on `chat.mozilla.org`
|
||||
in channel `#nss <https://chat.mozilla.org/#/room/#nss:mozilla.org>`__ or you could ask your
|
||||
questions on the `mozilla.dev.tech.crypto <https://groups.google.com/a/mozilla.org/g/dev-tech-crypto>`__ newsgroup.
|
||||
|
||||
|
||||
The NSS library and its supporting command line tools are written in the C programming language.
|
||||
Its build system and the automated tests are based on makefiles and bash scripts.
|
||||
|
||||
Over time, many documents have been produced that describe various aspects of NSS. You can start
|
||||
with:
|
||||
|
||||
- the current `primary NSS documentation page <https://developer.mozilla.org/en-US/docs/NSS>`__
|
||||
from which we link to other documentation.
|
||||
- a `General Overview <https://developer.mozilla.org/en-US/docs/Overview_of_NSS>`__ of the
|
||||
applications that use NSS and the features it provides.
|
||||
- a high level :ref:`mozilla_projects_nss_an_overview_of_nss_internals`.
|
||||
- learn about getting the :ref:`mozilla_projects_nss_nss_sources_building_testing`
|
||||
- `Old documentation <https://www-archive.mozilla.org/projects/security/pki/nss/>`__ that is on
|
||||
the archived mozilla.org website.
|
||||
|
||||
.. _nss_sample_code:
|
||||
|
||||
`NSS Sample Code <#nss_sample_code>`__
|
||||
--------------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
A good place to start learning how to write NSS applications are the command line tools that are
|
||||
maintained by the NSS developers. You can find them in subdirectory mozilla/security/nss/cmd
|
||||
|
||||
Or have a look at some basic :ref:`mozilla_projects_nss_nss_sample_code`.
|
||||
|
||||
A new set of samples is currently under development and review, see `Create new NSS
|
||||
samples <https://bugzilla.mozilla.org/show_bug.cgi?id=490238>`__.
|
||||
|
||||
You are welcome to download the samples via: hg clone https://hg.mozilla.org/projects/nss; cd
|
||||
nss; hg update SAMPLES_BRANCH
|
||||
|
|
@ -1,143 +0,0 @@
|
|||
.. _mozilla_projects_nss:
|
||||
|
||||
Network Security Services (NSS)
|
||||
===============================
|
||||
|
||||
.. toctree::
|
||||
:maxdepth: 2
|
||||
:glob:
|
||||
:hidden:
|
||||
|
||||
build.rst
|
||||
build_artifacts.rst
|
||||
releases/index.rst
|
||||
community.rst
|
||||
legacy/index.rst
|
||||
|
||||
.. warning::
|
||||
This NSS documentation was just imported from our legacy MDN repository. It
|
||||
currently is very deprecated and likely incorrect or broken in many places.
|
||||
|
||||
.. container::
|
||||
|
||||
**Network Security Services** (**NSS**) is a set of libraries designed to
|
||||
support cross-platform development of security-enabled client and server
|
||||
applications. Applications built with NSS can support SSL v3, TLS, PKCS #5,
|
||||
PKCS #7, PKCS #11, PKCS #12, S/MIME, X.509 v3 certificates, and other
|
||||
security standards.
|
||||
|
||||
NSS is available under the Mozilla Public License v2 (MPLv2).
|
||||
|
||||
If you're a developer and would like to contribute to NSS, you might want to
|
||||
read the documents:
|
||||
|
||||
.. rubric:: Getting Started
|
||||
:name: Getting_Started
|
||||
|
||||
:ref:`mozilla_projects_nss_building`
|
||||
This page contains information how to download, build and test NSS.
|
||||
|
||||
:ref:`mozilla_projects_nss_releases`
|
||||
This page contains information about recent releases of NSS.
|
||||
|
||||
:ref:`mozilla_projects_nss_nss_releases`
|
||||
This page contains information about older releases of NSS.
|
||||
|
||||
:ref:`mozilla_projects_nss_community`
|
||||
This page contains information about the community and how to reach out.
|
||||
|
||||
|
||||
.. warning::
|
||||
References below this point are part of the deprecated documentation and will
|
||||
be ported in the future. You can contribute to refreshing this documentation
|
||||
by submitting changes directly in the NSS repository (``nss/doc/rst``).
|
||||
|
||||
.. rubric:: NSS APIs
|
||||
:name: NSS_APIs
|
||||
|
||||
:ref:`mozilla_projects_nss_introduction_to_network_security_services`
|
||||
Provides an overview of the NSS libraries and what you need to know to use them.
|
||||
:ref:`mozilla_projects_nss_ssl_functions`
|
||||
Summarizes the SSL APIs exported by the NSS shared libraries.
|
||||
:ref:`mozilla_projects_nss_reference`
|
||||
API used to invoke SSL operations.
|
||||
:ref:`mozilla_projects_nss_nss_api_guidelines`
|
||||
Explains how the libraries and code are organized, and guidelines for developing code (naming
|
||||
conventions, error handling, thread safety, etc.)
|
||||
:ref:`mozilla_projects_nss_nss_tech_notes`
|
||||
Links to NSS technical notes, which provide latest information about new NSS features and
|
||||
supplementary documentation for advanced topics in programming with NSS.
|
||||
|
||||
.. rubric:: Tools, testing, and other technical details
|
||||
:name: Tools_testing_and_other_technical_details
|
||||
|
||||
:ref:`mozilla_projects_nss_nss_developer_tutorial`
|
||||
How to make changes in NSS. Coding style, maintaining ABI compatibility.
|
||||
|
||||
:ref:`mozilla_projects_nss_tools`
|
||||
Tools for developing, debugging, and managing applications that use NSS.
|
||||
:ref:`mozilla_projects_nss_nss_sample_code`
|
||||
Demonstrates how NSS can be used for cryptographic operations, certificate handling, SSL, etc.
|
||||
:ref:`mozilla_projects_nss_nss_third-party_code`
|
||||
A list of third-party code included in the NSS library.
|
||||
`NSS 3.2 Test Suite <https://www-archive.mozilla.org/projects/security/pki/nss/testnss_32.html>`__
|
||||
**Archived version.** Describes how to run the standard NSS tests.
|
||||
`NSS Performance Reports <https://www-archive.mozilla.org/projects/security/pki/nss/performance_reports.html>`__
|
||||
**Archived version.** Links to performance reports for NSS 3.2 and later releases.
|
||||
`Encryption Technologies Available in NSS 3.11 <https://www-archive.mozilla.org/projects/security/pki/nss/nss-3.11/nss-3.11-algorithms.html>`__
|
||||
**Archived version.** Lists the cryptographic algorithms used by NSS 3.11.
|
||||
`NSS 3.1 Loadable Root Certificates <https://www-archive.mozilla.org/projects/security/pki/nss/loadable_certs.html>`__
|
||||
**Archived version.** Describes the scheme for loading root CA certificates.
|
||||
`cert7.db <https://www-archive.mozilla.org/projects/security/pki/nss/db_formats.html>`__
|
||||
**Archived version.** General format of the cert7.db database.
|
||||
|
||||
.. rubric:: PKCS #11 information
|
||||
:name: PKCS_11_information
|
||||
|
||||
- :ref:`mozilla_projects_nss_pkcs11`
|
||||
- :ref:`mozilla_projects_nss_pkcs11_implement`
|
||||
- :ref:`mozilla_projects_nss_pkcs11_module_specs`
|
||||
- :ref:`mozilla_projects_nss_pkcs11_faq`
|
||||
- `Using the JAR Installation Manager to Install a PKCS #11 Cryptographic
|
||||
Module <https://developer.mozilla.org/en-US/docs/PKCS11_Jar_Install>`__
|
||||
- `PKCS #11 Conformance Testing - Archived
|
||||
version <https://www-archive.mozilla.org/projects/security/pki/pkcs11/>`__
|
||||
|
||||
.. rubric:: CA certificates pre-loaded into NSS
|
||||
:name: CA_certificates_pre-loaded_into_NSS
|
||||
|
||||
- `Mozilla CA certificate policy <https://www.mozilla.org/projects/security/certs/policy/>`__
|
||||
- `List of pre-loaded CA certificates <https://wiki.mozilla.org/CA/Included_Certificates>`__
|
||||
|
||||
- Consumers of this list must consider the trust bit setting for each included root
|
||||
certificate. `More
|
||||
Information <https://www.imperialviolet.org/2012/01/30/mozillaroots.html>`__, `Extracting
|
||||
roots and their trust bits <https://github.com/agl/extract-nss-root-certs>`__
|
||||
|
||||
.. rubric:: NSS is built on top of Netscape Portable Runtime (NSPR)
|
||||
:name: NSS_is_built_on_top_of_Netscape_Portable_Runtime_NSPR
|
||||
|
||||
- :ref:`NSPR` - NSPR project page.
|
||||
- :ref:`NSPR API Reference` - NSPR API documentation.
|
||||
|
||||
.. rubric:: Additional Information
|
||||
:name: Additional_Information
|
||||
|
||||
- `Using the window.crypto object from
|
||||
JavaScript <https://developer.mozilla.org/en-US/docs/JavaScript_crypto>`__
|
||||
- :ref:`mozilla_projects_nss_http_delegation`
|
||||
- :ref:`mozilla_projects_nss_tls_cipher_suite_discovery`
|
||||
- :ref:`mozilla_projects_nss_certificate_download_specification`
|
||||
- :ref:`mozilla_projects_nss_fips_mode_-_an_explanation`
|
||||
- :ref:`mozilla_projects_nss_key_log_format`
|
||||
|
||||
.. rubric:: Planning
|
||||
:name: Planning
|
||||
|
||||
Information on NSS planning can be found at `wiki.mozilla.org <https://wiki.mozilla.org/NSS>`__,
|
||||
including:
|
||||
|
||||
- `FIPS Validation <https://wiki.mozilla.org/FIPS_Validation>`__
|
||||
- `NSS Roadmap page <https://wiki.mozilla.org/NSS:Roadmap>`__
|
||||
- `NSS Improvement
|
||||
Project <https://fedoraproject.org/wiki/User:Mitr/NSS:DeveloperFriendliness>`__
|
||||
|
|
@ -1,302 +0,0 @@
|
|||
.. _mozilla_projects_nss_an_overview_of_nss_internals:
|
||||
|
||||
An overview of NSS Internals
|
||||
============================
|
||||
|
||||
.. container::
|
||||
|
||||
| A High-Level Overview to the Internals of `Network Security Services
|
||||
(NSS) <https://developer.mozilla.org/en-US/docs/NSS>`__
|
||||
| Software developed by the Mozilla.org projects traditionally used its own implementation of
|
||||
security protocols and cryptographic algorithms, originally called Netscape Security Services,
|
||||
nowadays called Network Security Services (NSS). NSS is a library written in the C programming
|
||||
language. It's free and open source software, and many other software projects have decided to
|
||||
use it. In order to support multiple operating systems (OS), it is based on a cross platform
|
||||
portability layer, called the Netscape Portable Runtime (NSPR), which provides cross platform
|
||||
application programming interfaces (APIs) for OS specific APIs like file system access, memory
|
||||
management, network communication, and multithreaded programming.
|
||||
| NSS offers lots of functionality; we'll walk through the list of modules, design principles,
|
||||
and important relevant standards.
|
||||
| In order to allow interoperability between software and devices that perform cryptographic
|
||||
operations, NSS conforms to a standard called PKCS#11. (Note that it's important to look at the
|
||||
number 11, as there are other PKCS standards with different numbers that define quite different
|
||||
topics.)
|
||||
| A software or hardware module conforming to the PKCS#11 standard implements an interface of C
|
||||
calls, which allow querying the characteristics and offered services of the module. Multiple
|
||||
elements of NSS's own modules have been implemented with this interface, and NSS makes use of
|
||||
this interface when talking to those modules. This strategy allows NSS to work with many
|
||||
hardware devices (e.g., to speed up the calculations required for cryptographic operations, or
|
||||
to access smartcards that securely protect a secret key) and software modules (e.g., to allow
|
||||
to load such modules as a plugin that provides additional algorithms or stores key or trust
|
||||
information) that implement the PKCS#11 interface.
|
||||
| A core element of NSS is FreeBL, a base library providing hash functions, big number
|
||||
calculations, and cryptographic algorithms.
|
||||
| Softoken is an NSS module that exposes most FreeBL functionality as a PKCS#11 module.
|
||||
| Some cryptography uses the same secret key for both encrypting and decrypting, for example
|
||||
password based encryption (PBE). This is often sufficient if you encrypt data for yourself, but
|
||||
as soon as you need to exchange signed/encrypted data with communication partners, using public
|
||||
key encryption simplifies the key management. The environment that describes how to use public
|
||||
key encryption is called Public Key Infrastructure (PKI). The public keys that are exchanged
|
||||
between parties are transported using a container; the container is called a certificate,
|
||||
following standard X.509 version 3. A certificate contains lots of other details; for example,
|
||||
it contains a signature by a third party that expresses trust in the ownership relationship for
|
||||
the certificate. The trust assigned by the third party might be restricted to certain uses,
|
||||
which are listed in certificate extensions that are contained in the certificate.
|
||||
| Many (if not most) of the operations performed by NSS involve the use of X.509 certificates
|
||||
(often abbreviated as “cert”, unfortunately making it easy to confuse with the term “computer
|
||||
emergency response team“).
|
||||
| When checking whether a certificate is trusted or not, it's necessary to find a relevant trust
|
||||
anchor (root certificate) that represents the signing capability of a trusted third party,
|
||||
usually called a Certificate Authority (CA). A trust anchor is just another X.509 certificate
|
||||
that is already known and has been deliberately marked as trusted by a software vendor,
|
||||
administrators inside an organizational infrastructure, or the software user. NSS ships a
|
||||
predefined set of CA certificates. This set, including their trust assignments, is provided by
|
||||
NSS as a software module, called CKBI (“built-in root certificates”), which also implements the
|
||||
PKCS#11 interface. On an organizational level the contents of the set are managed according to
|
||||
the Mozilla CA policy. On a technical level the set is a binary software module.
|
||||
| A cryptographic transaction, such as encryption or decryption related to a data exchange,
|
||||
usually involves working with the X.509 certs of your communication partners (peer). It's also
|
||||
required that you safely keep your own secret keys that belong to your own certificates. You
|
||||
might want to protect the storage of your secret keys with PBE. You might decide to modify the
|
||||
default trust provided by NSS. All of this requires storing, looking up, and retrieving data.
|
||||
NSS simplifies performing these operations by offering storage and management APIs. NSS doesn't
|
||||
require the programmer to manage individual files containing individual certificates or keys.
|
||||
Instead, NSS offers to use its own database(s). Once you have imported certificates and keys
|
||||
into the NSS database, you can easily look them up and use them again.
|
||||
| Because of NSS's expectation to operate with an NSS database, it's mandatory that you perform
|
||||
an initialization call, where you tell NSS which database you will be using. In the most simple
|
||||
scenario, the programmer will provide a directory on your filesystem as a parameter to the init
|
||||
function, and NSS is designed to do the rest. It will detect and open an existing database, or
|
||||
it can create a new one. Alternatively, should you decide that you don't want to work with any
|
||||
persistent recording of certificates, you may initialize NSS in a no-database mode. Usually,
|
||||
NSS will flush all data to disk as soon as new data has been added to permanent storage.
|
||||
Storage consists of multiple files: a key database file, which contains your secret keys, and a
|
||||
certificate database file which contains the public portion of your own certificates, the
|
||||
certificates of peers or CAs, and a list of trust decisions (such as to not trust a built-in
|
||||
CA, or to explicitly trust other CAs). Examples for the database files are key3.db and
|
||||
cert8.db, where the numbers are file version numbers. A third file contains the list of
|
||||
external PKCS#11 modules that have been registered to be used by NSS. The file could be named
|
||||
secmod.db, but in newer database generations a file named pkcs11.txt is used.
|
||||
| Only NSS is allowed to access and manipulate these database files directly; a programmer using
|
||||
NSS must go through the APIs offered by NSS to manipulate the data stored in these files. The
|
||||
programmer's task is to initialize NSS with the required parameters (such as a database), and
|
||||
NSS will then transparently manage the database files.
|
||||
| Most of the time certificates and keys are supposed to be stored in the NSS database.
|
||||
Therefore, after initial import or creation, the programmer usually doesn't deal with their raw
|
||||
bytes. Instead, the programmer will use lookup functions, and NSS will provide an access handle
|
||||
that will be subsequently used by the application's code. Those handles are reference counted.
|
||||
NSS will usually create an in-memory (RAM) presentation of certificates, once a certificate has
|
||||
been received from the network, read from disk, or looked up from the database, and prepare
|
||||
in-memory data structures that contain the certificate's properties, as well as providing a
|
||||
handle for the programmer to use. Once the application is done with a handle, it should be
|
||||
released, allowing NSS to free the associated resources. When working with handles to private
|
||||
keys it's usually difficult (and undesired) that an application gets access to the raw key
|
||||
data; therefore it may be difficult to extract such data from NSS. The usual minimum
|
||||
requirement is that private keys must be wrapped using a protective layer (such as
|
||||
password-based encryption). The intention is to make it easier to review code for security. The
|
||||
less code that has access to raw secret keys, the less code that must be reviewed.
|
||||
| NSS has only limited functionality to look up raw keys. The preferred approach is to use
|
||||
certificates, and to look up certificates by properties such as the contained subject name
|
||||
(information that describes the owner of the certificate). For example, while NSS supports
|
||||
random calculation (creation) of a new public/private key pair, it's difficult to work with
|
||||
such a raw key pair. The usual approach is to create a certificate signing request (CSR) as
|
||||
soon as an application is done with the creation step, which will have created a handle to the
|
||||
key pair, and which can be used for the necessary related operations, like producing a
|
||||
proof-of-ownership of the private key, which is usually required when submitting the public key
|
||||
with a CSR to a CA. The usual follow up action is receiving a signed certificate from a CA.
|
||||
(However, it's also possible to use NSS functionality to create a self-signed certificate,
|
||||
which, however, usually won't be trusted by other parties.) Once received, it's sufficient to
|
||||
tell NSS to import such a new certificate into the NSS database, and NSS will automatically
|
||||
perform a lookup of the embedded public key, be able to find the associated private key, and
|
||||
subsequently be able to treat it as a personal certificate. (A personal certificate is a
|
||||
certificate for which the private key is in possession, and which could be used for signing
|
||||
data or for decrypting data.) A unique nickname can/should be assigned to the certificate at
|
||||
the time of import, which can later be used to easily identify and retrieve it.
|
||||
| It's important to note that NSS requires strict cleanup for all handles returned by NSS. The
|
||||
application should always call the appropriate dereference (destroy) functions once a handle is
|
||||
no longer needed. This is particularly important for applications that might need to close a
|
||||
database and reinitialize NSS using a different one, without restarting. Such an operation
|
||||
might fail at runtime if data elements are still being referenced.
|
||||
| In addition to the FreeBL, Softoken, and CKBI modules, there is an utility library for general
|
||||
operations (e.g., encoding/decoding between data formats, a list of standardized object
|
||||
identifiers (OID)). NSS has an SSL/TLS module that implements the Secure Sockets
|
||||
Layer/Transport Layer Security network protocols, an S/MIME module that implements CMS
|
||||
messaging used by secure email and some instant messaging implementations, a DBM library that
|
||||
implements the classic database storage, and finally a core NSS library for the big set of
|
||||
“everything else”. Newer generations of the database use the SQLite database to allow
|
||||
concurrent access by multiple applications.
|
||||
| All of the above are provided as shared libraries. The CRMF library, which is used to produce
|
||||
certain kinds of certificate requests, is available as a library for static linking only.
|
||||
| When dealing with certificates (X.509), file formats such as PKCS#12 (certificates and keys),
|
||||
PKCS#7 (signed data), and message formats as CMS, we should mention ASN.1, which is a syntax
|
||||
for storing structured data in a very efficient (small sized) presentation. It was originally
|
||||
developed for telecommunication systems at times where it was critical to minimize data as much
|
||||
as possible (although it still makes sense to use that principle today for good performance).
|
||||
In order to process data available in the ASN.1 format, the usual approach is to parse it and
|
||||
transfer it to a presentation that requires more space but is easier to work with, such as
|
||||
(nested) C data structures. Over the time NSS has received three different ASN.1 parser
|
||||
implementations, each having their own specific properties, advantages and disadvantages, which
|
||||
is why all of them are still being used (nobody has yet dared to replace the older with the
|
||||
newer ones because of risks for side effects). When using the ASN.1 parser(s), a template
|
||||
definition is passed to the parser, which will analyze the ASN.1 data stream accordingly. The
|
||||
templates are usually closely aligned to definitions found in RFC documents.
|
||||
| A data block described as DER is usually in ASN.1 format. You must know which data you are
|
||||
expecting, and use the correct template for parsing, based on the context of your software's
|
||||
interaction. Data described as PEM is a base64 encoded presentation of DER, usually wrapped
|
||||
between human readable BEGIN/END lines. NSS prefers the binary presentation, but is often
|
||||
capable to use base64 or ASCII presentations, especially when importing data from files. A
|
||||
recent development adds support for loading external PEM files that contain private keys, in a
|
||||
software library called nss-pem, which is separately available, but should eventually become a
|
||||
core part of NSS.
|
||||
| Looking at the code level, NSS deals with blocks of raw data all the time. The common structure
|
||||
to store such an untyped block is SECItem, which contains a size and an untyped C pointer
|
||||
variable.
|
||||
| When dealing with memory, NSS makes use of arenas, which are an attempt to simplify management
|
||||
with the limited offerings of C (because there are no destructors). The idea is to group
|
||||
multiple memory allocations in order to simplify cleanup. Performing an operation often
|
||||
involves allocating many individual data items, and the code might be required to abort a task
|
||||
at many positions in the logic. An arena is requested once processing of a task starts, and all
|
||||
memory allocations that are logically associated to that task are requested from the associated
|
||||
arena. The implementation of arenas makes sure that all individual memory blocks are tracked.
|
||||
Once a task is done, regardless whether it completed or was aborted, the programmer simply
|
||||
needs to release the arena, and all individually allocated blocks will be released
|
||||
automatically. Often freeing is combined with immediately erasing (zeroing, zfree) the memory
|
||||
associated to the arena, in order to make it more difficult for attackers to extract keys from
|
||||
a memory dump.
|
||||
| NSS uses many C data structures. Often NSS has multiple implementations for the same or similar
|
||||
concepts. For example, there are multiple presentations of certificates, and the NSS internals
|
||||
(and sometimes even the application using NSS) might have to convert between them.
|
||||
| Key responsibilites of NSS are verification of signatures and certificates. In order to verify
|
||||
a digital signature, we have to look at the application data (e.g., a document that was
|
||||
signed), the signature data block (the digital signature), and a public key (as found in a
|
||||
certificate that is believed to be the signer, e.g., identified by metadata received together
|
||||
with the signature). The signature is verified if it can be shown that the signature data block
|
||||
must have been produced by the owner of the public key (because only that owner has the
|
||||
associated private key).
|
||||
| Verifying a certificate (A) requires some additional steps. First, you must identify the
|
||||
potential signer (B) of a certificate (A). This is done by reading the “issuer name” attribute
|
||||
of a certificate (A), and trying to find that issuer certificate (B) (by looking for a
|
||||
certificate that uses that name as its “subject name”). Then you attempt to verify the
|
||||
signature found in (A) using the public key found in (B). It might be necessary to try multiple
|
||||
certificates (B1, B2, ...) each having the same subject name.
|
||||
| After succeeding, it might be necessary to repeat this procedure recursively. The goal is to
|
||||
eventually find a certificate B (or C or ...) that has an appropriate trust assigned (e.g.,
|
||||
because it can be found in the CKBI module and the user hasn't made any overriding trust
|
||||
decisions, or it can be found in a NSS database file managed by the user or by the local
|
||||
environment).
|
||||
| After having successfully verified the signatures in a (chain of) issuer certificate(s), we're
|
||||
still not done with verifying the certificate A. In a PKI it's suggested/required to perform
|
||||
additional checks. For example: Certificates were valid at the time the signature was made,
|
||||
name in certificates matches the expected signer (check subject name, common name, email, based
|
||||
on application), the trust restrictions recorded inside the certificate (extensions) permit the
|
||||
use (e.g., encryption might be allowed, but not signing), and based on environment/application
|
||||
policy it might be required to perform a revocation check (OCSP or CRL), that asks the
|
||||
issuer(s) of the certificates whether there have been events that made it necessary to revoke
|
||||
the trust (revoke the validity of the cert).
|
||||
| Trust anchors contained in the CKBI module are usually self signed, which is defined as having
|
||||
identical subject name and issuer name fields. If a self-signed certificate is marked as
|
||||
explicitly trusted, NSS will skip checking the self-signature for validity.
|
||||
| NSS has multiple APIs to perform verification of certificates. There is a classic engine that
|
||||
is very stable and works fine in all simple scenarios, for example if all (B) candidate issuer
|
||||
certificates have the same subject and issuer names and differ by validity period; however, it
|
||||
works only in a limited amount of more advanced scenarios. Unfortunately, the world of
|
||||
certificates has become more complex in the recent past. New Certificate Authorities enter the
|
||||
global PKI market, and in order to get started with their business, they might make deals with
|
||||
established CAs and receive so-called cross-signing-certificates. As a result, when searching
|
||||
for a trust path from (A) to a trusted anchor (root) certificate (Z), the set of candidate
|
||||
issuer certificates might have different issuer names (referring to the second or higher issuer
|
||||
level). As a consequence, it will be necessary to try multiple different alternative routes
|
||||
while searching for (Z), in a recursive manner. Only the newer verification engine (internally
|
||||
named libPKIX) is capable of doing that properly.
|
||||
| It's worth mentioning the Extended Validation (EV) principle, which is an effort by software
|
||||
vendors and CAs to define a stricter set of rules for issuing certificates for web site
|
||||
certificates. Instead of simply verifying that the requester of a certificate is in control of
|
||||
an administrative email address at the desired web site's domain, it's required that the CA
|
||||
performs a verification of real world identity documents (such as a company registration
|
||||
document with the country's authority), and it's also required that a browser software performs
|
||||
a revocation check with the CA, prior to granting validity to the certificate. In order to
|
||||
distinguish an EV certificate, CAs will embed a policy OID in the certificate, and the browser
|
||||
is expected to verify that a trust chain permits the end entity (EE) certificate to make use of
|
||||
the policy. Only the APIs of the newer libPKIX engine are capable of performing a policy
|
||||
verification.
|
||||
| That's a good opportunity to talk about SSL/TLS connections to servers in general (not just EV,
|
||||
not just websites). Whenever this document mentions SSL, it refers to either SSL or TLS. (TLS
|
||||
is a newer version of SSL with enhanced features.)
|
||||
| When establishing an SSL connection to a server, (at least) a server certificate (and its trust
|
||||
chain) is exchanged from the server to the client (e.g., the browser), and the client verifies
|
||||
that the certificate can be verified (including matching the name of the expected destination
|
||||
server). Another part of the handshake between both parties is a key exchange. Because public
|
||||
key encryption is more expensive (more calculations required) than symmetric encryption (where
|
||||
both parties use the same key), a key agreement protocol will be executed, where the public and
|
||||
private keys are used to proof and verify the exchanged initial information. Once the key
|
||||
agreement is done, a symmetric encryption will be used (until a potential re-handshake on an
|
||||
existing channel). The combination of the hash and encryption algorithms used for a SSL
|
||||
connection is called a cipher suite.
|
||||
| NSS ships with a set of cipher suites that it supports at a technical level. In addition, NSS
|
||||
ships with a default policy that defines which cipher suites are enabled by default. An
|
||||
application is able to modify the policy used at program runtime, by using function calls to
|
||||
modify the set of enabled cipher suites.
|
||||
| If a programmer wants to influence how NSS verifies certificates or how NSS verifies the data
|
||||
presented in a SSL connection handshake, it is possible to register application-defined
|
||||
callback functions which will be called by NSS at the appropriate point of time, and which can
|
||||
be used to override the decisions made by NSS.
|
||||
| If you would like to use NSS as a toolkit that implements SSL, remember that you must init NSS
|
||||
first. But if you don't care about modifying the default trust permanently (recorded on disk),
|
||||
you can use the no-database init calls. When creating the network socket for data exchange,
|
||||
note that you must use the operating system independent APIs provided by NSPR and NSS. It might
|
||||
be interesting to mention a property of the NSPR file descriptors, which are stacked in layers.
|
||||
This means you can define multiple layers that are involved in data processing. A file
|
||||
descriptor has a pointer to the first layer handling the data. That layer has a pointer to a
|
||||
potential second layer, which might have another pointer to a third layer, etc. Each layer
|
||||
defines its own functions for the open/close/read/write/poll/select (etc.) functions. When
|
||||
using an SSL network connection, you'll already have two layers, the basic NSPR layer and an
|
||||
SSL library layer. The Mozilla applications define a third layer where application specific
|
||||
processing is performed. You can find more details in the NSPR reference documents.
|
||||
| NSS occassionally has to create outbound network connections, in addition to the connections
|
||||
requested by the application. Examples are retrieving OCSP (Online Certificate Status Protocol)
|
||||
information or downloading a CRL (Certificate Revocation List). However, NSS doesn't have an
|
||||
implementation to work with network proxies. If you must support proxies in your application,
|
||||
you are able to register your own implementation of an http request callback interface, and NSS
|
||||
can use your application code that supports proxies.
|
||||
| When using hashing, encryption, and decryption functions, it is possible to stream data (as
|
||||
opposed to operating on a large buffer). Create a context handle while providing all the
|
||||
parameters required for the operation, then call an “update” function multiple times to pass
|
||||
subsets of the input to NSS. The data will be processed and either returned directly or sent to
|
||||
a callback function registered in the context. When done, you call a finalization function that
|
||||
will flush out any pending data and free the resources.
|
||||
| This line is a placeholder for future sections that should explain how libpkix works and is
|
||||
designed.
|
||||
| If you want to work with NSS, it's often helpful to use the command line utilities that are
|
||||
provided by the NSS developers. There are tools for managing NSS databases, for dumping or
|
||||
verifying certificates, for registering PKCS#11 modules with a database, for processing CMS
|
||||
encrypted/signed messages, etc.
|
||||
| For example, if you wanted to create your own pair of keys and request a new certificate from a
|
||||
CA, you could use certutil to create an empty database, then use certutil to operate on your
|
||||
database and create a certificate request (which involves creating the desired key pair) and
|
||||
export it to a file, submit the request file to the CA, receive the file from the CA, and
|
||||
import the certificate into your database. You should assign a good nickname to a certificate
|
||||
when importing it, making it easier for you to refer to it later.
|
||||
| It should be noted that the first database format that can be accessed simultaneously by
|
||||
multiple applications is key4.db/cert9.db – database files with lower numbers will most likely
|
||||
experience unrecoverable corruption if you access them with multiple applications at the same
|
||||
time. In other words, if your browser or your server operates on an older NSS database format,
|
||||
don't use the NSS tools to operate on it while the other software is executing. At the time of
|
||||
writing NSS and the Mozilla applications still use the older database file format by default,
|
||||
where each application has its own NSS database.
|
||||
| If you require a copy of a certificate stored in an NSS database, including its private key,
|
||||
you can use pk12util to export it to the PKCS#12 file format. If you require it in PEM format,
|
||||
you could use the openssl pkcs12 command (that's not NSS) to convert the PKCS#12 file to PEM.
|
||||
| This line is a placeholder for how to prepare a database, how to dump a cert, and how to
|
||||
convert data.
|
||||
| You might have been motivated to work with NSS because it is used by the Mozilla applications
|
||||
such as Firefox, Thunderbird, etc. If you build the Mozilla application, it will automatically
|
||||
build the NSS library, too. However, if you want to work with the NSS command line tools, you
|
||||
will have to follow the standalone NSS build instructions, and build NSS outside of the Mozilla
|
||||
application sources.
|
||||
| The key database file will contain at least one symmetric key, which NSS will automatically
|
||||
create on demand, and which will be used to protect your secret (private) keys. The symmetric
|
||||
key can be protected with PBE by setting a master password on the database. As soon as you set
|
||||
a master password, an attacker stealing your key database will no longer be able to get access
|
||||
to your private key, unless the attacker would also succeed in stealing the master password.
|
||||
| Now you might be interest in how to get the
|
||||
:ref:`mozilla_projects_nss_nss_sources_building_testing`
|
||||
|
|
@ -1,70 +0,0 @@
|
|||
.. _mozilla_projects_nss_blank_function:
|
||||
|
||||
Function_Name
|
||||
=============
|
||||
|
||||
.. container::
|
||||
|
||||
One-line description of what the function does (more than just what it returns).
|
||||
|
||||
`Syntax <#syntax>`__
|
||||
~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
.. code::
|
||||
|
||||
#include <headers.h>
|
||||
ReturnType Function_Name(
|
||||
|
||||
ParamType ParamName,
|
||||
ParamType ParamName, );
|
||||
|
||||
`Parameters <#parameters>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
+---------------+---------------------------------------------------------------------------------+
|
||||
| ``ParamName`` | Sample: *in* pointer to a `CERTCertDBHandle </en-US/NSS/CERTCertDBHandle>`__ |
|
||||
| | representing the certificate database to look in |
|
||||
+---------------+---------------------------------------------------------------------------------+
|
||||
| ``ParamName`` | Sample: *in* pointer to an `SECItem </en-US/NSS/SECItem>`__ whose ``type`` must |
|
||||
| | be ``siDERCertBuffer`` and whose ``data`` contains a DER-encoded certificate |
|
||||
+---------------+---------------------------------------------------------------------------------+
|
||||
|
||||
`Description <#description>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
Long description of this function, what it does, and why you would use it. Describe all
|
||||
side-effects on "out" parameters. Avoid describing the return until the next section, for
|
||||
example:
|
||||
|
||||
This function looks in the NSSCryptoContext and the NSSTrustDomain to find the certificate that
|
||||
matches the DER-encoded certificate. A match is found when the issuer and serial number of the
|
||||
DER-encoded certificate are found on a certificate in the certificate database.
|
||||
|
||||
`Returns <#returns>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
Full description of the return value, for example:
|
||||
|
||||
A pointer to a `CERTCertificate </en-US/NSS/CERTCertificate>`__ representing the certificate in
|
||||
the database that matched the ``derCert``, or ``NULL`` if none was found. The certificate is a
|
||||
shallow copy, use `CERT_DestroyCertificate </en-US/NSS/CERT_DestroyCertificate>`__ to decrement
|
||||
the reference count on the certificate instance.
|
||||
|
||||
.. _see_also:
|
||||
|
||||
`See Also <#see_also>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
Copy of the MXR link, with the following text
|
||||
|
||||
Occurrences of ``Function_Name`` in the current NSS source code (generated by MXR).
|
||||
|
|
@ -1,159 +0,0 @@
|
|||
.. _mozilla_projects_nss_building_ported:
|
||||
|
||||
Building NSS
|
||||
============
|
||||
|
||||
`Introduction <#introduction>`__
|
||||
--------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
This page has detailed information on how to build NSS. Because NSS is a cross-platform library
|
||||
that builds on many different platforms and has many options, it may be complex to build. Please
|
||||
read these instructions carefully before attempting to build.
|
||||
|
||||
.. _build_environment:
|
||||
|
||||
`Build environment <#build_environment>`__
|
||||
------------------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
NSS needs a C and C++ compiler. It has minimal dependencies, including only standard C and C++
|
||||
libraries, plus `zlib <https://www.zlib.net/>`__.
|
||||
|
||||
For building, you also need `make <https://www.gnu.org/software/make/>`__. Ideally, also install
|
||||
`gyp <https://gyp.gsrc.io/>`__ and `ninja <https://ninja-build.org/>`__ and put them on your
|
||||
path. This is recommended, as the build is faster and more reliable.
|
||||
|
||||
`Windows <#windows>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
NSS compilation on Windows uses the same shared build system as Mozilla Firefox. You must first
|
||||
install the `Windows
|
||||
Prerequisites <https://developer.mozilla.org/en-US/docs/Mozilla/Developer_guide/Build_Instructions/Windows_Prerequisites>`__,
|
||||
including **MozillaBuild**.
|
||||
|
||||
You can also build NSS on the Windows Subsystem for Linux, but the resulting binaries aren't
|
||||
usable by other Windows applications.
|
||||
|
||||
.. _get_the_source:
|
||||
|
||||
`Get the source <#get_the_source>`__
|
||||
------------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
NSS and NSPR use Mercurial for source control like other Mozilla projects. To check out the
|
||||
latest sources for NSS and NSPR--which may not be part of a stable release--use the following
|
||||
commands:
|
||||
|
||||
.. code::
|
||||
|
||||
hg clone https://hg.mozilla.org/projects/nspr
|
||||
hg clone https://hg.mozilla.org/projects/nss
|
||||
|
||||
To get the source of a specific release, see :ref:`mozilla_projects_nss_nss_releases`.
|
||||
|
||||
`Build <#build>`__
|
||||
------------------
|
||||
|
||||
.. container::
|
||||
|
||||
Build NSS using our build script:
|
||||
|
||||
.. code::
|
||||
|
||||
nss/build.sh
|
||||
|
||||
This builds both NSPR and NSS.
|
||||
|
||||
.. _build_with_make:
|
||||
|
||||
`Build with make <#build_with_make>`__
|
||||
--------------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
Alternatively, there is a ``make`` target called "nss_build_all", which produces a similar
|
||||
result. This supports some alternative options, but can be a lot slower.
|
||||
|
||||
.. code::
|
||||
|
||||
make -C nss nss_build_all USE_64=1
|
||||
|
||||
The make-based build system for NSS uses a variety of variables to control the build. Below are
|
||||
some of the variables, along with possible values they may be set to.
|
||||
|
||||
BUILD_OPT
|
||||
0
|
||||
Build a debug (non-optimized) version of NSS. *This is the default.*
|
||||
1
|
||||
Build an optimized (non-debug) version of NSS.
|
||||
|
||||
USE_64
|
||||
0
|
||||
Build for a 32-bit environment/ABI. *This is the default.*
|
||||
1
|
||||
Build for a 64-bit environment/ABI. *This is recommended.*
|
||||
|
||||
USE_ASAN
|
||||
0
|
||||
Do not create an `AddressSanitizer <http://clang.llvm.org/docs/AddressSanitizer.html>`__
|
||||
build. *This is the default.*
|
||||
1
|
||||
Create an AddressSanitizer build.
|
||||
|
||||
.. _unit_testing:
|
||||
|
||||
`Unit testing <#unit_testing>`__
|
||||
--------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
NSS contains extensive unit tests. Scripts to run these are found in the ``tests`` directory.
|
||||
Run the standard suite by:
|
||||
|
||||
.. code::
|
||||
|
||||
HOST=localhost DOMSUF=localdomain USE_64=1 nss/tests/all.sh
|
||||
|
||||
.. _unit_test_configuration:
|
||||
|
||||
`Unit test configuration <#unit_test_configuration>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
| NSS tests are configured using environment variables.
|
||||
| The scripts will attempt to infer values for ``HOST`` and ``DOMSUF``, but can fail. Replace
|
||||
``localhost`` and ``localdomain`` with the hostname and domain suffix for your host. You need
|
||||
to be able to connect to ``$HOST.$DOMSUF``.
|
||||
|
||||
If you don't have a domain suffix you can add an entry to ``/etc/hosts`` (on
|
||||
Windows,\ ``c:\Windows\System32\drivers\etc\hosts``) as follows:
|
||||
|
||||
.. code::
|
||||
|
||||
127.0.0.1 localhost.localdomain
|
||||
|
||||
Validate this opening a command shell and typing: ``ping localhost.localdomain``.
|
||||
|
||||
Remove the ``USE_64=1`` override if using a 32-bit build.
|
||||
|
||||
.. _test_results:
|
||||
|
||||
`Test results <#test_results>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
Running all tests can take a considerable amount of time.
|
||||
|
||||
Test output is stored in ``tests_results/security/$HOST.$NUMBER/``. The file ``results.html``
|
||||
summarizes the results, ``output.log`` captures all the test output.
|
||||
|
||||
Other subdirectories of ``nss/tests`` contain scripts that run a subset of the full suite. Those
|
||||
can be run directly instead of ``all.sh``, which might save some time at the cost of coverage.
|
||||
|
|
@ -1,64 +0,0 @@
|
|||
.. _mozilla_projects_nss_cert_findcertbydercert:
|
||||
|
||||
CERT_FindCertByDERCert
|
||||
======================
|
||||
|
||||
.. container::
|
||||
|
||||
Find a certificate in the database that matches a DER-encoded certificate.
|
||||
|
||||
`Syntax <#syntax>`__
|
||||
~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
.. code::
|
||||
|
||||
#include <cert.h>
|
||||
CERTCertificate *CERT_FindCertByDERCert(
|
||||
|
||||
CERTCertDBHandle *handle,
|
||||
SECItem *derCert );
|
||||
|
||||
`Parameters <#parameters>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
+-------------+-----------------------------------------------------------------------------------+
|
||||
| ``handle`` | *in* pointer to a `CERTCertDBHandle </en-US/NSS/CERTCertDBHandle>`__ representing |
|
||||
| | the certificate database to look in |
|
||||
+-------------+-----------------------------------------------------------------------------------+
|
||||
| ``derCert`` | *in* pointer to an `SECItem </en-US/NSS/SECItem>`__ whose ``type`` must be |
|
||||
| | ``siDERCertBuffer`` and whose ``data`` contains a DER-encoded certificate |
|
||||
+-------------+-----------------------------------------------------------------------------------+
|
||||
|
||||
`Description <#description>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
This function looks in the ?NSSCryptoContext? and the ?NSSTrustDomain? to find the certificate
|
||||
that matches the DER-encoded certificate. A match is found when the issuer and serial number of
|
||||
the DER-encoded certificate are found on a certificate in the certificate database.
|
||||
|
||||
`Returns <#returns>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
A pointer to a `CERTCertificate </en-US/NSS/CERTCertificate>`__ representing the certificate in
|
||||
the database that matched the ``derCert``, or ``NULL`` if none was found. The certificate is a
|
||||
shallow copy, use `CERT_DestroyCertificate </en-US/NSS/CERT_DestroyCertificate>`__ to decrement
|
||||
the reference count on the certificate instance.
|
||||
|
||||
.. _see_also:
|
||||
|
||||
`See Also <#see_also>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
Occurrences of
|
||||
```CERT_FindCertByDERCert`` <http://lxr.mozilla.org/security/ident?i=CERT_FindCertByDERCert>`__
|
||||
in the current NSS source code (generated by `LXR <http://lxr.mozilla.org/security/>`__).
|
||||
|
|
@ -1,82 +0,0 @@
|
|||
.. _mozilla_projects_nss_cert_findcertbyissuerandsn:
|
||||
|
||||
CERT_FindCertByIssuerAndSN
|
||||
==========================
|
||||
|
||||
.. container::
|
||||
|
||||
Find a certificate in the database with the given issuer and serial number.
|
||||
|
||||
`Syntax <#syntax>`__
|
||||
~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
.. code::
|
||||
|
||||
#include <cert.h>
|
||||
CERTCertificate *CERT_FindCertByIssuerAndSN (
|
||||
|
||||
CERTCertDBHandle *handle,
|
||||
CERTIssuerAndSN *issuerAndSN );
|
||||
|
||||
`Parameters <#parameters>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
+-----------------+-------------------------------------------------------------------------------+
|
||||
| ``handle`` | *in* pointer to a `CERTCertDBHandle </en-US/NSS/CERTCertDBHandle>`__ |
|
||||
| | representing the certificate database to look in |
|
||||
+-----------------+-------------------------------------------------------------------------------+
|
||||
| ``issuerAndSN`` | *in* pointer to a `CERTIssuerAndSN </en-US/NSS/CERTIssuerAndSN>`__ that must |
|
||||
| | be properly formed to contain the issuer name and the serial number (see |
|
||||
| | [Example]) |
|
||||
+-----------------+-------------------------------------------------------------------------------+
|
||||
|
||||
`Description <#description>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
This function creates a certificate key using the ``issuerAndSN`` and it then uses the key to
|
||||
find the matching certificate in the database.
|
||||
|
||||
`Returns <#returns>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
A pointer to a `CERTCertificate </en-US/NSS/CERTCertificate>`__ representing the certificate in
|
||||
the database that matched the issuer and serial number, or ``NULL`` if none was found. The
|
||||
certificate is a shallow copy, use
|
||||
`CERT_DestroyCertificate </en-US/NSS/CERT_DestroyCertificate>`__ to decrement the reference count
|
||||
on the certificate instance.
|
||||
|
||||
`Example <#example>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
.. code::
|
||||
|
||||
CERTIssuerAndSN issuerSN;
|
||||
issuerSN.derIssuer.data = caName->data;
|
||||
issuerSN.derIssuer.len = caName->len;
|
||||
issuerSN.serialNumber.data = authorityKeyID->authCertSerialNumber.data;
|
||||
issuerSN.serialNumber.len = authorityKeyID->authCertSerialNumber.len;
|
||||
issuerCert = CERT_FindCertByIssuerAndSN(cert->dbhandle, &issuerSN);
|
||||
if ( issuerCert == NULL ) {
|
||||
PORT_SetError (SEC_ERROR_UNKNOWN_ISSUER);
|
||||
}
|
||||
|
||||
.. _see_also:
|
||||
|
||||
`See Also <#see_also>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
Occurrences of
|
||||
```CERT_FindCertByIssuerAndSN`` <http://lxr.mozilla.org/security/ident?i=CERT_FindCertByIssuerAndSN>`__
|
||||
in the current NSS source code (generated by `LXR <http://lxr.mozilla.org/security/>`__).
|
||||
|
|
@ -1,186 +0,0 @@
|
|||
.. _mozilla_projects_nss_certificate_download_specification:
|
||||
|
||||
NSS Certificate Download Specification
|
||||
======================================
|
||||
|
||||
.. container::
|
||||
|
||||
This document describes the data formats used by NSS 3.x for installing certificates. This
|
||||
document is currently being revised and has not yet been reviewed for accuracy.
|
||||
|
||||
.. _data_formats:
|
||||
|
||||
`Data Formats <#data_formats>`__
|
||||
--------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
NSS can accept certificates in several formats. In all cases the certificates are X509 version 1,
|
||||
2, or 3.
|
||||
|
||||
.. _binary_formats:
|
||||
|
||||
`Binary Formats <#binary_formats>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
NSS's certificate loader will recognize several binary formats. They are:
|
||||
|
||||
- **DER encoded certificate:** This is a single binary DER encoded certificate.
|
||||
- **PKCS#7 certificate chain:** This is a single
|
||||
`PKCS#7 <ftp://ftp.rfc-editor.org/in-notes/rfc2315.txt>`__ ``SignedData`` object. The only
|
||||
significant field in the ``SignedData`` object is the ``certificates`` field, which may
|
||||
contain multiple certificates to be imported together. The contents of the ``version``,
|
||||
``digestAlgorithms``, ``contentInfo``, ``crls``, and ``signerInfos`` fields are ignored.
|
||||
- **Netscape Certificate Sequence:** This is another
|
||||
`PKCS#7 <ftp://ftp.rfc-editor.org/in-notes/rfc2315.txt>`__ object format, and like the
|
||||
``SignedData`` format, it allows multiple certificates to be imported together. This format is
|
||||
simpler than the `PKCS#7 <ftp://ftp.rfc-editor.org/in-notes/rfc2315.txt>`__ ``SignedData``
|
||||
object format. It consists of a `PKCS#7 <ftp://ftp.rfc-editor.org/in-notes/rfc2315.txt>`__
|
||||
``ContentInfo`` structure, wrapping a sequence of certificates. The ``contentType`` field OID
|
||||
must be ``netscape-cert-sequence`` (see
|
||||
:ref:`mozilla_projects_nss_certificate_download_specification#object_identifiers`). The
|
||||
``content`` field is the following ASN.1 structure:
|
||||
|
||||
.. code::
|
||||
|
||||
CertificateSequence ::= SEQUENCE OF Certificate
|
||||
|
||||
See the section below on
|
||||
:ref:`mozilla_projects_nss_certificate_download_specification#importing_certificate_chains` for
|
||||
more information about how multiple certificates are handled.
|
||||
|
||||
.. _text_formats:
|
||||
|
||||
`Text Formats <#text_formats>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
Any of the above :ref:`mozilla_projects_nss_certificate_download_specification#binary_formats`
|
||||
can also be imported in text form. The text form begins with the following line:
|
||||
|
||||
.. code::
|
||||
|
||||
-----BEGIN CERTIFICATE-----
|
||||
|
||||
Following this line should be the certificate data, which can be in any of the
|
||||
:ref:`mozilla_projects_nss_certificate_download_specification#binary_formats` described above.
|
||||
This data must be base64 encoded as described by `RFC
|
||||
1113 <https://datatracker.ietf.org/doc/html/rfc1113>`__. Following the data should be the
|
||||
following line:
|
||||
|
||||
.. code::
|
||||
|
||||
-----END CERTIFICATE-----
|
||||
|
||||
In a text format download, NSS ignores any text before the first ``BEGIN CERTIFICATE`` line, and
|
||||
ignores any text after the first ``END CERTIFICATE`` line. Between those two lines, there must be
|
||||
exactly ONE item of any of the supported binary formats described above, and that one item must
|
||||
be base64 encoded. Regardless of which of the supported binary formats is used, the ``BEGIN`` and
|
||||
``END`` lines must say ``CERTIFICATE``, and not any other word (such as ``KEY``). The ``BEGIN``
|
||||
and ``END`` lines must begin and end with 5 dashes, with no extra leading or trailing white space
|
||||
(excluding the End Of Line characters).
|
||||
|
||||
.. _importing_certificate_chains:
|
||||
|
||||
`Importing Certificate Chains <#importing_certificate_chains>`__
|
||||
----------------------------------------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
Several of the formats described above can contain several certificates. When NSS's certificate
|
||||
decoder encounters one of these collections of multiple certificates they are handled in the
|
||||
following way:
|
||||
|
||||
- The first certificate is processed in a context specific manner, depending upon how it is
|
||||
being imported. For Mozilla browsers, this handling will depend upon the mime ``Content-Type``
|
||||
that is used on the object being downloaded. For NSS-based servers it will depend upon the
|
||||
options selected in the server's administration interface.
|
||||
|
||||
- Subsequent certificates are all treated the same. If the certificates contain a
|
||||
``BasicConstraints`` certificate extension that indicates they are CA certificates, and do not
|
||||
already exist in the local certificate database, they are added as untrusted CAs. In this way
|
||||
they may be used for certificate chain validation, as long as there is a trusted CA somewhere
|
||||
along the chain.
|
||||
|
||||
.. _importing_certificates_into_mozilla_browsers:
|
||||
|
||||
`Importing Certificates into Mozilla browsers <#importing_certificates_into_mozilla_browsers>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
Mozilla browsers import certificates found in HTTP protocol responses. There are several mime
|
||||
content types that are used to indicate to the browser what type of certificate is being
|
||||
imported. These mime types are:
|
||||
|
||||
- **``application/x-x509-user-cert``** The certificate being downloaded is a user certificate
|
||||
belonging to the user operating the browser. If the private key associated with the
|
||||
certificate does not exist in the user's local key database, then an error dialog is generated
|
||||
and the certificate is not imported. If a certificate chain is being imported then the first
|
||||
certificate in the chain must be the user certificate, and any subsequent certificates will be
|
||||
added as untrusted CA certificates to the local database.
|
||||
- **``application/x-x509-ca-cert``** The certificate being downloaded represents a Certificate
|
||||
Authority. When it is downloaded the user will be shown a sequence of dialogs that will guide
|
||||
them through the process of accepting the Certificate Authority and deciding if they wish to
|
||||
trust sites certified by the CA. If a certificate chain is being imported then the first
|
||||
certificate in the chain must be the CA certificate, and any subsequent certificates will be
|
||||
added as untrusted CA certificates to the local database.
|
||||
- **``application/x-x509-email-cert``** The certificate being downloaded is a user certificate
|
||||
belonging to another user for use with S/MIME. If a certificate chain is being imported then
|
||||
the first certificate in the chain must be the user certificate, and any subsequent
|
||||
certificates will be added as untrusted CA certificates to the local database. This is
|
||||
intended to allow people or CAs to post their e-mail certificates on web pages for download by
|
||||
other users who want to send them encrypted mail.
|
||||
|
||||
Note: the browser checks that the size of the object being downloaded matches the size of the
|
||||
encoded certificates. Therefore it is important to ensure that no extra characters, such as NULLs
|
||||
or LineFeeds are added at the end of the object.
|
||||
|
||||
.. _importing_certificates_into_nss-based_servers:
|
||||
|
||||
`Importing Certificates into NSS-based servers <#importing_certificates_into_nss-based_servers>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
Consult your server's administration guide for the most accurate information. For some NSS-base
|
||||
servers, the following information is correct.
|
||||
|
||||
Server certificates are imported via the server admin interface. Certificates are pasted into a
|
||||
text input field in an HTML form, and then the form is submitted to the admin server. Since the
|
||||
certificates are pasted into text fields, only the
|
||||
:ref:`mozilla_projects_nss_certificate_download_specification#text_formats` described above are
|
||||
supported for servers. The type of certificate being imported (e.g. server or CA or cert chain)
|
||||
is specified by the server administrator by selections made on the admin pages. If a certificate
|
||||
chain is being imported then the first certificate in the chain must be the server or CA
|
||||
certificate, and any subsequent certificates will be added as untrusted CA certificates to the
|
||||
local database.
|
||||
|
||||
.. _object_identifiers:
|
||||
|
||||
`Object Identifiers <#object_identifiers>`__
|
||||
--------------------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
The base of all Netscape object ids is:
|
||||
|
||||
.. code::
|
||||
|
||||
netscape OBJECT IDENTIFIER ::= { 2 16 840 1 113730 }
|
||||
|
||||
The hexadecimal byte value of this OID when DER encoded is:
|
||||
|
||||
.. code::
|
||||
|
||||
0x60, 0x86, 0x48, 0x01, 0x86, 0xf8, 0x42
|
||||
|
||||
The following OIDs are mentioned in this document:
|
||||
|
||||
.. code::
|
||||
|
||||
netscape-data-type OBJECT IDENTIFIER :: = { netscape 2 }
|
||||
netscape-cert-sequence OBJECT IDENTIFIER :: = { netscape-data-type 5 }
|
||||
|
|
@ -1,410 +0,0 @@
|
|||
.. _mozilla_projects_nss_certificate_functions:
|
||||
|
||||
Certificate functions
|
||||
=====================
|
||||
|
||||
.. container::
|
||||
|
||||
The public functions listed here are used to interact with certificate databases.
|
||||
|
||||
If documentation is available for a function listed below, the function name is linked to either
|
||||
its MDC wiki page or its entry in the
|
||||
:ref:`mozilla_projects_nss_ssl_functions_old_ssl_reference`. The `Mozilla Cross
|
||||
Reference <http://mxr.mozilla.org/>`__ (MXR) link for each function provides access to the
|
||||
function definition, prototype definition, and source code references. The NSS version column
|
||||
indicates which versions of NSS support the function.
|
||||
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| Function name/documentation | Source code | NSS versions |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_AddCertToListTail`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_AddExtension`` | MXR | 3.5 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_AddOCSPAcceptableResponses`` | MXR | 3.6 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_AddOKDomainName`` | MXR | 3.4 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_AddRDN`` | MXR | 3.2.1 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_AsciiToName`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_CacheCRL`` | MXR | 3.10 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_ClearOCSPCache`` | MXR | 3.11.7 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_CertChainFromCert`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_CertListFromCert`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_CertTimesValid`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_ChangeCertTrust`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| :ref:`mozilla_pro | MXR | 3.2 and later |
|
||||
| jects_nss_ssl_functions_sslcrt#1056662` | | |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_CheckNameSpace`` | MXR | 3.12 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_CheckCertUsage`` | MXR | 3.3 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_CompareName`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_CompareValidityTimes`` | MXR | 3.11 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_CompleteCRLDecodeEntries`` | MXR | 3.6 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_ConvertAndDecodeCertificate`` | MXR | 3.9.3 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_CopyName`` | MXR | 3.4 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_CopyRDN`` | MXR | 3.5 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_CreateAVA`` | MXR | 3.2.1 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_CreateCertificate`` | MXR | 3.5 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_CreateCertificateRequest`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_CreateName`` | MXR | 3.2.1 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_CreateOCSPCertID`` | MXR | 3.6 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_CreateOCSPRequest`` | MXR | 3.6 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_CreateRDN`` | MXR | 3.2.1 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_CreateSubjectCertList`` | MXR | 3.4 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_CreateValidity`` | MXR | 3.5 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_CRLCacheRefreshIssuer`` | MXR | 3.7 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_DecodeAltNameExtension`` | MXR | 3.10 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_DecodeAuthInfoAccessExtension`` | MXR | 3.10 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_DecodeAuthKeyID`` | MXR | 3.10 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_DecodeAVAValue`` | MXR | 3.4 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_DecodeBasicConstraintValue`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_DecodeCertFromPackage`` | MXR | 3.4 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CE | MXR | 3.2 and later |
|
||||
| RT_DecodeCertificatePoliciesExtension`` | | |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_DecodeCertPackage`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_DecodeCRLDistributionPoints`` | MXR | 3.10 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_DecodeDERCrl`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_DecodeDERCrlWithFlags`` | MXR | 3.6 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_DecodeGeneralName`` | MXR | 3.4 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_DecodeNameConstraintsExtension`` | MXR | 3.10 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_DecodeOCSPResponse`` | MXR | 3.6 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_DecodeOidSequence`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``C | MXR | 3.10 and later |
|
||||
| ERT_DecodePrivKeyUsagePeriodExtension`` | | |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_DecodeTrustString`` | MXR | 3.4 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_DecodeUserNotice`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_DerNameToAscii`` | MXR | 3.4 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_DestroyCertArray`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| :ref:`mozilla_pro | MXR | 3.2 and later |
|
||||
| jects_nss_ssl_functions_sslcrt#1050532` | | |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_DestroyCertificateList`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CER | MXR | 3.2 and later |
|
||||
| T_DestroyCertificatePoliciesExtension`` | | |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_DestroyCertificateRequest`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_DestroyCertList`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_DestroyName`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_DestroyOCSPCertID`` | MXR | 3.6 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_DestroyOCSPRequest`` | MXR | 3.6 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_DestroyOCSPResponse`` | MXR | 3.7 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_DestroyOidSequence`` | MXR | 3.9 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_DestroyUserNotice`` | MXR | 3.10 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_DestroyValidity`` | MXR | 3.5 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| :ref:`mozilla_pro | MXR | 3.2 and later |
|
||||
| jects_nss_ssl_functions_sslcrt#1058344` | | |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_DupCertList`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_EnableOCSPChecking`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_EncodeAltNameExtension`` | MXR | 3.7 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_EncodeAndAddBitStrExtension`` | MXR | 3.5 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_EncodeAuthKeyID`` | MXR | 3.5 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_EncodeBasicConstraintValue`` | MXR | 3.5 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_EncodeCertPoliciesExtension`` | MXR | 3.12 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_EncodeCRLDistributionPoints`` | MXR | 3.5 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_EncodeGeneralName`` | MXR | 3.4 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_EncodeInfoAccessExtension`` | MXR | 3.12 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_EncodeInhibitAnyExtension`` | MXR | 3.12 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_EncodeNoticeReference`` | MXR | 3.12 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_EncodeOCSPRequest`` | MXR | 3.6 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| `` | MXR | 3.12 and later |
|
||||
| CERT_EncodePolicyConstraintsExtension`` | | |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_EncodePolicyMappingExtension`` | MXR | 3.12 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_EncodeSubjectKeyID`` | MXR | 3.12 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_EncodeUserNotice`` | MXR | 3.12 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_ExtractPublicKey`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_FindCertByName`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_FindCRLEntryReasonExten`` | MXR | 3.12 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_FindCRLNumberExten`` | MXR | 3.12 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_FindNameConstraintsExten`` | MXR | 3.12 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_FilterCertListByCANames`` | MXR | 3.4 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_FilterCertListByUsage`` | MXR | 3.4 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_FilterCertListForUserCerts`` | MXR | 3.6 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| :ref:`mozil | MXR | 3.2 and later |
|
||||
| la_projects_nss_cert_findcertbydercert` | | |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| :ref:`mozilla_p | MXR | 3.2 and later |
|
||||
| rojects_nss_cert_findcertbyissuerandsn` | | |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_FindCertByNickname`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_FindCertByNicknameOrEmailAddr`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_FindCertBySubjectKeyID`` | MXR | 3.7 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_FindCertExtension`` | MXR | 3.4 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_FindCertIssuer`` | MXR | 3.3 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_FindKeyUsageExtension`` | MXR | 3.4 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_FindSMimeProfile`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_FindSubjectKeyIDExtension`` | MXR | 3.7 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_FindUserCertByUsage`` | MXR | 3.4 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_FindUserCertsByUsage`` | MXR | 3.4 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CE | MXR | 3.10 and later |
|
||||
| RT_FinishCertificateRequestAttributes`` | | |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_FinishExtensions`` | MXR | 3.5 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_FormatName`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_FreeDistNames`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| :ref:`mozilla_pro | MXR | 3.2 and later |
|
||||
| jects_nss_ssl_functions_sslcrt#1050349` | | |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_GetAVATag`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_GetCertChainFromCert`` | MXR | 3.4 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_GetCertEmailAddress`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_GetCertificateNames`` | MXR | 3.10 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ` | MXR | 3.10 and later |
|
||||
| `CERT_GetCertificateRequestExtensions`` | | |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_GetCertIssuerAndSN`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| :ref:`mozilla_pro | MXR | 3.2 and later |
|
||||
| jects_nss_ssl_functions_sslcrt#1050346` | | |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_GetCertTrust`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_GetCertUid`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_GetClassicOCSPDisabledPolicy`` | MXR | 3.12 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_G | MXR | 3.12 and later |
|
||||
| etClassicOCSPEnabledHardFailurePolicy`` | | |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_G | MXR | 3.12 and later |
|
||||
| etClassicOCSPEnabledSoftFailurePolicy`` | | |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_GetCommonName`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_GetCountryName`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_GetDBContentVersion`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| :ref:`mozilla_pro | MXR | 3.2 and later |
|
||||
| jects_nss_ssl_functions_sslcrt#1052308` | | |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_GetDomainComponentName`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_GetFirstEmailAddress`` | MXR | 3.7 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_GetLocalityName`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_GetNextEmailAddress`` | MXR | 3.7 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_GetNextGeneralName`` | MXR | 3.10 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_GetNextNameConstraint`` | MXR | 3.10 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_GetOCSPResponseStatus`` | MXR | 3.6 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_GetOCSPStatusForCertID`` | MXR | 3.6 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_GetOidString`` | MXR | 3.9 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_GetOrgName`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_GetOrgUnitName`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CE | MXR | 3.4 and later |
|
||||
| RT_GetOCSPAuthorityInfoAccessLocation`` | | |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``C | MXR | 3.12 and later |
|
||||
| ERT_GetPKIXVerifyNistRevocationPolicy`` | | |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_GetPrevGeneralName`` | MXR | 3.10 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_GetPrevNameConstraint`` | MXR | 3.10 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_GetSlopTime`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_GetSSLCACerts`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_GetStateName`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_GetUsePKIXForValidation`` | MXR | 3.12 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_GetValidDNSPatternsFromCert`` | MXR | 3.12 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_GenTime2FormattedAscii`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_Hexify`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_ImportCAChain`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_ImportCerts`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_IsRootDERCert`` | MXR | 3.8 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_IsUserCert`` | MXR | 3.6 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_KeyFromDERCrl`` | MXR | 3.4 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_MakeCANickname`` | MXR | 3.4 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_MergeExtensions`` | MXR | 3.10 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_NameToAscii`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_NewCertList`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_NewTempCertificate`` | MXR | 3.12 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_NicknameStringsFromCertList`` | MXR | 3.4 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_OpenCertDBFilename`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_OCSPCacheSettings`` | MXR | 3.11.7 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_PKIXVerifyCert`` | MXR | 3.12 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_RemoveCertListNode`` | MXR | 3.6 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_RFC1485_EscapeAndQuote`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_SaveSMimeProfile`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_SetSlopTime`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_SetOCSPFailureMode`` | MXR | 3.11.7 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_SetOCSPTimeout`` | MXR | 3.12 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_SetUsePKIXForValidation`` | MXR | 3.12 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_StartCertExtensions`` | MXR | 3.5 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``C | MXR | 3.10 and later |
|
||||
| ERT_StartCertificateRequestAttributes`` | | |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_StartCRLEntryExtensions`` | MXR | 3.10 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_StartCRLExtensions`` | MXR | 3.10 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_UncacheCRL`` | MXR | 3.10 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| :ref:`mozilla_pro | MXR | 3.2 and later |
|
||||
| jects_nss_ssl_functions_sslcrt#1050342` | | |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_VerifyCACertForUsage`` | MXR | 3.6 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_VerifyCert`` | MXR | 3.2 and later. If you need to verify |
|
||||
| | | for multiple usages use |
|
||||
| | | CERT_VerifyCertificate |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_VerifyCertificate`` | MXR | 3.6 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_VerifyCertificateNow`` | MXR | 3.6 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| :ref:`mozilla_pro | MXR | 3.2 and later. If you need to verify |
|
||||
| jects_nss_ssl_functions_sslcrt#1058011` | | for multiple usages use |
|
||||
| | | CERT_VerifyCertificateNow |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_VerifyOCSPResponseSignature`` | MXR | 3.6 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_VerifySignedData`` | MXR | 3.4 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``CERT_VerifySignedDataWithPublicKey`` | MXR | 3.7 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``C | MXR | 3.7 and later |
|
||||
| ERT_VerifySignedDataWithPublicKeyInfo`` | | |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| :ref:`mozilla_pro | MXR | 3.2 and later |
|
||||
| jects_nss_ssl_functions_sslcrt#1056760` | | |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| :ref:`mozilla_pro | MXR | 3.2 and later |
|
||||
| jects_nss_ssl_functions_sslcrt#1056950` | | |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
|
|
@ -1,55 +0,0 @@
|
|||
.. _mozilla_projects_nss_certverify_log:
|
||||
|
||||
NSS CERTVerify Log
|
||||
==================
|
||||
|
||||
`CERTVerifyLog <#certverifylog>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
All the NSS verify functions except, the \*VerifyNow() functions, take a parameter called
|
||||
'CERTVerifyLog'. If you supply the log parameter, NSS will continue chain validation after each
|
||||
error . The log tells you what the problem was with the chain and what certificate in the chain
|
||||
failed.
|
||||
|
||||
To create a log:
|
||||
|
||||
.. code::
|
||||
|
||||
#include "secport.h"
|
||||
#include "certt.h"
|
||||
|
||||
CERTVerifyLog *log;
|
||||
|
||||
arena = PORT_NewArena(512);
|
||||
log = PORT_ArenaZNew(arena,log);
|
||||
log->arena = arena;
|
||||
|
||||
You can then pass this log into your favorite cert verify function. On return:
|
||||
|
||||
- log->count is the number of entries.
|
||||
- log->head is the first entry;
|
||||
- log->tail is the last entry.
|
||||
|
||||
Each entry is a CERTVerifyLogNode. Defined in certt.h:
|
||||
|
||||
.. code::
|
||||
|
||||
/*
|
||||
* This structure is used to keep a log of errors when verifying
|
||||
* a cert chain. This allows multiple errors to be reported all at
|
||||
* once.
|
||||
*/
|
||||
struct CERTVerifyLogNodeStr {
|
||||
CERTCertificate *cert; /* what cert had the error */
|
||||
long error; /* what error was it? */
|
||||
unsigned int depth; /* how far up the chain are we */
|
||||
void *arg; /* error specific argument */
|
||||
struct CERTVerifyLogNodeStr *next; /* next in the list */
|
||||
struct CERTVerifyLogNodeStr *prev; /* next in the list */
|
||||
};
|
||||
|
||||
The list is a doubly linked NULL terminated list sorted from low to high based on depth into the
|
||||
cert chain. When you are through, you will need to walk the list and free all the cert entries,
|
||||
then free the arena.
|
||||
|
|
@ -1,73 +0,0 @@
|
|||
.. _mozilla_projects_nss_code_coverage:
|
||||
|
||||
NSS Code Coverage
|
||||
=================
|
||||
|
||||
.. _nss_-_code_coverage:
|
||||
|
||||
`NSS - Code Coverage <#nss_-_code_coverage>`__
|
||||
----------------------------------------------
|
||||
|
||||
.. _results_link:
|
||||
|
||||
`Results link <#results_link>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
- `2007-08-14 - Solaris/Sparc
|
||||
platform <ftp://ftp.mozilla.org/pub/mozilla.org/security/nss/coverage/20070814-sparc/nss.html>`__
|
||||
|
||||
.. _results_explanation:
|
||||
|
||||
`Results explanation <#results_explanation>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
.. rubric:: Files
|
||||
:name: files
|
||||
|
||||
- Results from every C file are on new line.
|
||||
- If file was tested, link points to annotated source file (in TCOV directory), otherwise to
|
||||
original source file (CVS directory).
|
||||
|
||||
.. rubric:: Colors
|
||||
:name: colors
|
||||
|
||||
- Green: 70-100% of blocks tested.
|
||||
- Yellow: 40-70% of blocks tested.
|
||||
- Orange: 0-40% of blocks tested.
|
||||
- Red: file not tested. File is not part of any binary or library used by test suite.
|
||||
|
||||
.. rubric:: Numbers in tested files
|
||||
:name: numbers_in_tested_files
|
||||
|
||||
- Example: 72.69% (165/227/731)
|
||||
|
||||
- 72.69% - ratio of tested blocks and total blocks in file (generated by TCOV).
|
||||
- 165 - tested blocks in file (generated by TCOV).
|
||||
- 227 - total blocks in file (generated by TCOV).
|
||||
- 31 - total lines in file (by wc -l command).
|
||||
|
||||
.. rubric:: Numbers in not tested files
|
||||
:name: numbers_in_not_tested_files
|
||||
|
||||
- Example: Not tested (0/?/878).
|
||||
|
||||
- 0 - tested blocks in file (always 0).
|
||||
- ? - total blocks in file (there is no trivial method to get this number without TCOV).
|
||||
- 878 - total lines in file (by wc -l command).
|
||||
|
||||
.. rubric:: Numbers in total count
|
||||
:name: numbers_in_total_count
|
||||
|
||||
- Example: Total: 42% (574/1351).
|
||||
|
||||
- 42% - ratio of tested blocks and total blocks in file.
|
||||
- 165 - tested blocks in all files in directory (sum of numbers generated by TCOV).
|
||||
- 227 - total blocks in all files in directory (sum of numbers generated by TCOV).
|
||||
|
||||
- These numbers doesn't count blocks in files which are not tested (marked with red color),
|
||||
because we don't know number of blocks there.
|
||||
- Total count at the end of report counts blocks in all tested files in all directories.
|
||||
|
|
@ -1,500 +0,0 @@
|
|||
.. _mozilla_projects_nss_cryptography_functions:
|
||||
|
||||
Cryptography functions
|
||||
======================
|
||||
|
||||
.. container::
|
||||
|
||||
The public functions listed here perform cryptographic operations based on the PKCS #11
|
||||
interface.
|
||||
|
||||
If documentation is available for a function listed below, the function name is linked to either
|
||||
its MDC wiki page or its entry in the
|
||||
:ref:`mozilla_projects_nss_ssl_functions_old_ssl_reference`. The `Mozilla Cross
|
||||
Reference <http://mxr.mozilla.org/>`__ (MXR) link for each function provides access to the
|
||||
function definition, prototype definition, and source code references. The NSS version column
|
||||
indicates which versions of NSS support the function.
|
||||
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| Function name/documentation | Source code | NSS versions |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_AlgtagToMechanism`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_Authenticate`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_BlockData`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_ChangePW`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_CheckUserPassword`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_CipherOp`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_CloneContext`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_ConfigurePKCS11`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK1 | MXR | 3.6 and later |
|
||||
| 1_ConvertSessionPrivKeyToTokenPrivKey`` | | |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``P | MXR | 3.6 and later |
|
||||
| K11_ConvertSessionSymKeyToTokenSymKey`` | | |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| `` | MXR | 3.11 and later |
|
||||
| PK11_CopyTokenPrivKeyToSessionPrivKey`` | | |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_CreateContextBySymKey`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_CreateDigestContext`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_CreateGenericObject`` | MXR | 3.12 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_CreateMergeLog`` | MXR | 3.12 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_CreatePBEAlgorithmID`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_CreatePBEV2AlgorithmID`` | MXR | 3.12 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_DeleteTokenPrivateKey`` | MXR | 3.4 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_DeleteTokenPublicKey`` | MXR | 3.4 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_DeleteTokenSymKey`` | MXR | 3.4 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_Derive`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_DeriveWithFlags`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_DeriveWithFlagsPerm`` | MXR | 3.9 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_DestroyContext`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_DestroyGenericObject`` | MXR | 3.9.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_DestroyGenericObjects`` | MXR | 3.9.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_DestroyMergeLog`` | MXR | 3.12 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_DestroyObject`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_DestroyTokenObject`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_DigestBegin`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_DigestKey`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_DigestOp`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_DigestFinal`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_DoesMechanism`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_ExportEncryptedPrivateKeyInfo`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_ExportEncryptedPrivKeyInfo`` | MXR | 3.9 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_ExportPrivateKeyInfo`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_Finalize`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_FindBestKEAMatch`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_FindCertAndKeyByRecipientList`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| `` | MXR | 3.2 and later |
|
||||
| PK11_FindCertAndKeyByRecipientListNew`` | | |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_FindCertByIssuerAndSN`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_FindCertFromDERCert`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| :ref:`mozilla_pr | MXR | 3.2 and later |
|
||||
| ojects_nss_ssl_functions_pkfnc#1035673` | | |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_FindCertInSlot`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_FindGenericObjects`` | MXR | 3.9.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_FindFixedKey`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| :ref:`mozilla_pr | MXR | 3.2 and later |
|
||||
| ojects_nss_ssl_functions_pkfnc#1026891` | | |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_FindKeyByDERCert`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_FindPrivateKeyFromCert`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_FindSlotByName`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_FindSlotsByNames`` | MXR | 3.9 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_FortezzaHasKEA`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_FortezzaMapSig`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_FreeSlot`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_FreeSlotList`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_FreeSlotListElement`` | MXR | 3.11 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_FreeSymKey`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_GenerateFortezzaIV`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_GenerateKeyPair`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_GenerateKeyPairWithFlags`` | MXR | 3.10.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_GenerateKeyPairWithOpFlags`` | MXR | 3.12 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_GenerateNewParam`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_GenerateRandom`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_GenerateRandomOnSlot`` | MXR | 3.11 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_GetAllTokens`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_GetAllSlotsForCert`` | MXR | 3.12 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_GetBestKeyLength`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_GetBestSlot`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_GetBestSlotMultiple`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_GetBestWrapMechanism`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_GetBlockSize`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_GetCertFromPrivateKey`` | MXR | 3.9.3 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_GetCurrentWrapIndex`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_GetDefaultArray`` | MXR | 3.8 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_GetDefaultFlags`` | MXR | 3.8 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_GetDisabledReason`` | MXR | 3.8 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_GetFirstSafe`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_GetInternalKeySlot`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_GetInternalSlot`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_GetKeyGen`` | MXR | 3.4 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_GetKeyLength`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_GetKeyStrength`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_GetMechanism`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_GetMinimumPwdLength`` | MXR | 3.4 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_GetModInfo`` | MXR | 3.6 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_GetModule`` | MXR | 3.3 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_GetModuleID`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_GetNextGenericObject`` | MXR | 3.9.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_GetNextSafe`` | MXR | 3.4 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_GetNextSymKey`` | MXR | 3.4 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_GetPadMechanism`` | MXR | 3.4 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_GetPBECryptoMechanism`` | MXR | 3.12 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_GetPBEIV`` | MXR | 3.6 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_GetPQGParamsFromPrivateKey`` | MXR | 3.4 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_GetPrevGenericObject`` | MXR | 3.9.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_GetPrivateKeyNickname`` | MXR | 3.4 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_GetPrivateModulusLen`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_GetPublicKeyNickname`` | MXR | 3.4 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_GetSlotFromKey`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_GetSlotFromPrivateKey`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_GetSlotID`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_GetSlotInfo`` | MXR | 3.4 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| :ref:`mozilla_pr | MXR | 3.2 and later |
|
||||
| ojects_nss_ssl_functions_pkfnc#1030779` | | |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_GetSlotSeries`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_GetSymKeyNickname`` | MXR | 3.4 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_GetSymKeyType`` | MXR | 3.9 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_GetSymKeyUserData`` | MXR | 3.11 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_GetTokenInfo`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| :ref:`mozilla_pro | MXR | 3.2 and later |
|
||||
| jects_nss_ssl_functions_sslcrt#1026964` | | |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_GetWindow`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_GetWrapKey`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_HashBuf`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_HasRootCerts`` | MXR | 3.4 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_ImportCert`` | MXR | 3.5 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_ImportCertForKeyToSlot`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_ImportCRL`` | MXR | 3.6 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_ImportDERCert`` | MXR | 3.6 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK1 | MXR | 3.4 and later |
|
||||
| 1_ImportDERPrivateKeyInfoAndReturnKey`` | | |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_ImportEncryptedPrivateKeyInfo`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_ImportPrivateKeyInfo`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| `` | MXR | 3.4 and later |
|
||||
| PK11_ImportPrivateKeyInfoAndReturnKey`` | | |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_ImportPublicKey`` | MXR | 3.4 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_ImportSymKeyWithFlags`` | MXR | 3.4 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_InitPin`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_IsFIPS`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_IsDisabled`` | MXR | 3.4 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_IsFriendly`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| :ref:`mozilla_pr | MXR | 3.2 and later |
|
||||
| ojects_nss_ssl_functions_pkfnc#1026762` | | |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_IsInternal`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| :ref:`mozilla_pro | MXR | 3.2 and later |
|
||||
| jects_nss_ssl_functions_sslcrt#1026762` | | |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| :ref:`mozilla_pr | MXR | 3.2 and later |
|
||||
| ojects_nss_ssl_functions_pkfnc#1022991` | | |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_IsRemovable`` | MXR | 3.12 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_IVFromParam`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_KeyGen`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_LinkGenericObject`` | MXR | 3.9.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_ListCerts`` | MXR | 3.2 and later. Updated 3.8 with new |
|
||||
| | | options. See bug |
|
||||
| | | `215186 <https://bugzilla |
|
||||
| | | .mozilla.org/show_bug.cgi?id=215186>`__ |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_ListFixedKeysInSlot`` | MXR | 3.4 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_ListPrivKeysInSlot`` | MXR | 3.4 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_ListPublicKeysInSlot`` | MXR | 3.4 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_LoadPrivKey`` | MXR | 3.4 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_LogoutAll`` | MXR | 3.4 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_MakeKEAPubKey`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| `` | MXR | 3.2 and later |
|
||||
| PK11_MapPBEMechanismToCryptoMechanism`` | | |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_MapSignKeyType`` | MXR | 3.11 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_MechanismToAlgtag`` | MXR | 3.4 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_MergeTokens`` | MXR | 3.12 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_MoveSymKey`` | MXR | 3.9 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_NeedLogin`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_NeedUserInit`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_ParamFromIV`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_ParamFromAlgid`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_ParamToAlgid`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_PBEKeyGen`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_PrivDecryptPKCS1`` | MXR | 3.9.3 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_ProtectedAuthenticationPath`` | MXR | 3.4 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_PubDecryptRaw`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_PubDerive`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_PubDeriveWithKDF`` | MXR | 3.9 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_PubEncryptPKCS1`` | MXR | 3.9.3 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_PubEncryptRaw`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_PubUnwrapSymKey`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_PubUnwrapSymKeyWithFlags`` | MXR | 3.6 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_PubUnwrapSymKeyWithFlagsPerm`` | MXR | 3.9 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_PubWrapSymKey`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_RandomUpdate`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_ReadRawAttribute`` | MXR | 3.9.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_ReferenceSymKey`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_ResetToken`` | MXR | 3.4 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_RestoreContext`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_SaveContext`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_SaveContextAlloc`` | MXR | 3.6 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_SetFortezzaHack`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| :ref:`mozilla_pr | MXR | 3.2 and later |
|
||||
| ojects_nss_ssl_functions_pkfnc#1023128` | | |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_SetPrivateKeyNickname`` | MXR | 3.4 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_SetPublicKeyNickname`` | MXR | 3.4 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_SetSlotPWValues`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_SetSymKeyNickname`` | MXR | 3.4 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_SetSymKeyUserData`` | MXR | 3.11 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_SetWrapKey`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_Sign`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_SignatureLen`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_SymKeyFromHandle`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_TokenExists`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_TokenKeyGen`` | MXR | 3.6 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_TokenKeyGenWithFlags`` | MXR | 3.10.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_TokenRefresh`` | MXR | 3.7.1 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_TraverseCertsForNicknameInSlot`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_TraverseCertsForSubjectInSlot`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_TraverseSlotCerts`` | MXR | 3.4 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_UnlinkGenericObject`` | MXR | 3.9.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_UnwrapSymKey`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_UnwrapSymKeyWithFlags`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_UnwrapSymKeyWithFlagsPerm`` | MXR | 3.9 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_UpdateSlotAttribute`` | MXR | 3.8 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_UserEnableSlot`` | MXR | 3.8 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_UserDisableSlot`` | MXR | 3.8 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_Verify`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_VerifyKeyOK`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_WaitForTokenEvent`` | MXR | 3.7 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_WrapSymKey`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11_WriteRawAttribute`` | MXR | 3.12 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11SDR_Encrypt`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``PK11SDR_Decrypt`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``SEC_DeletePermCertificate`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``SEC_DeletePermCRL`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``SEC_DerSignData`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``SEC_DestroyCrl`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``SEC_FindCrlByDERCert`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``SEC_FindCrlByName`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``SEC_LookupCrls`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``SEC_NewCrl`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``SEC_QuickDERDecodeItem`` | MXR | 3.6 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``SECKEY_CacheStaticFlags`` | MXR | 3.10 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``SECKEY_ConvertToPublicKey`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``SECKEY_CopyPrivateKey`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``SECKEY_CopyPublicKey`` | MXR | 3.6 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``SECKEY_CopySubjectPublicKeyInfo`` | MXR | 3.4 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``SECKEY_CreateDHPrivateKey`` | MXR | 3.3 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``SECKEY_CreateECPrivateKey`` | MXR | 3.8 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``SECKEY_CreateSubjectPublicKeyInfo`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ` | MXR | 3.4 and later |
|
||||
| `SECKEY_DecodeDERSubjectPublicKeyInfo`` | | |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| :ref:`mozilla_pro | MXR | 3.2 and later |
|
||||
| jects_nss_ssl_functions_sslkey#1051017` | | |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``SECKEY_ECParamsToBasePointOrderLen`` | MXR | 3.12 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``SECKEY_ECParamsToKeySize`` | MXR | 3.12 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``SECKEY_DestroyPublicKeyList`` | MXR | 3.4 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``SECKEY_DestroySubjectPublicKeyInfo`` | MXR | 3.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``SECKEY_GetPublicKeyType`` | MXR | 3.3 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``SECKEY_PublicKeyStrengthInBits`` | MXR | 3.8 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| ``SECKEY_SignatureLen`` | MXR | 3.11.2 and later |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
|
|
@ -1,34 +0,0 @@
|
|||
.. _mozilla_projects_nss_deprecated_ssl_functions:
|
||||
|
||||
Deprecated SSL functions
|
||||
========================
|
||||
|
||||
.. container::
|
||||
|
||||
The following SSL functions have been replaced with newer versions. The deprecated functions are
|
||||
not supported by the new SSL shared libraries. Applications that want to use the SSL shared
|
||||
libraries must convert to calling the new replacement functions listed below.
|
||||
|
||||
Each function name is linked to its entry in the
|
||||
:ref:`mozilla_projects_nss_ssl_functions_old_ssl_reference`. The `Mozilla Cross
|
||||
Reference <http://mxr.mozilla.org/>`__ (MXR) link for each function provides access to the
|
||||
function definition, prototype definition, and source code references.
|
||||
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| Function name/documentation | Source code | Replacement in NSS 3.2 |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| :ref:`mozilla_pro | MXR | :ref:`mozilla_pro |
|
||||
| jects_nss_ssl_functions_sslfnc#1220189` | | jects_nss_ssl_functions_sslfnc#1086543` |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| :ref:`mozilla_pro | MXR | :ref:`mozilla_pro |
|
||||
| jects_nss_ssl_functions_sslfnc#1207298` | | jects_nss_ssl_functions_sslfnc#1084747` |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| :ref:`mozilla_pro | MXR | :ref:`mozilla_pro |
|
||||
| jects_nss_ssl_functions_sslfnc#1206365` | | jects_nss_ssl_functions_sslfnc#1068466` |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| :ref:`mozilla_pro | MXR | :ref:`mozilla_pro |
|
||||
| jects_nss_ssl_functions_sslfnc#1231825` | | jects_nss_ssl_functions_sslfnc#1232052` |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
| :ref:`mozilla_pro | MXR | :ref:`mozilla_pro |
|
||||
| jects_nss_ssl_functions_sslfnc#1207350` | | jects_nss_ssl_functions_sslfnc#1104647` |
|
||||
+-----------------------------------------+-------------+-----------------------------------------+
|
||||
File diff suppressed because it is too large
Load diff
File diff suppressed because it is too large
Load diff
|
|
@ -1,280 +0,0 @@
|
|||
.. _mozilla_projects_nss_faq:
|
||||
|
||||
NSS FAQ
|
||||
=======
|
||||
|
||||
.. _general_questions:
|
||||
|
||||
`General Questions <#general_questions>`__
|
||||
------------------------------------------
|
||||
|
||||
.. _what_is_network_security_services_.28nss.29:
|
||||
|
||||
`What is Network Security Services (NSS) <#what_is_network_security_services_.28nss.29>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
NSS is set of libraries, APIs, utilities, and documentation designed to support cross-platform
|
||||
development of security-enabled client and server applications. It provides a complete
|
||||
open-source implementation of the crypto libraries used by Mozilla and other companies in the
|
||||
Firefox browser, AOL Instant Messenger (AIM), server products from Red Hat, and other products.
|
||||
|
||||
For an overview of NSS, see :ref:`mozilla_projects_nss_overview`. For detailed information on the
|
||||
open-source NSS project, see `NSS Project Page <https://wiki.mozilla.org/NSS>`__.
|
||||
|
||||
.. _what_can_i_do_with_nss.3f_is_nss_appropriate_for_my_application.3f:
|
||||
|
||||
`What can I do with NSS? Is NSS appropriate for my application? <#what_can_i_do_with_nss.3f_is_nss_appropriate_for_my_application.3f>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
If you want add support for SSL, S/MIME, or other Internet security standards to your
|
||||
application, you can use Network Security Services (NSS) to do so. Because NSS provides complete
|
||||
support for all versions of SSL and TLS, it is particularly well-suited for applications that
|
||||
need to communicate with the many clients and servers that already support the SSL protocol.
|
||||
|
||||
The PKCS #11 interface included in NSS means that your application can use `hardware
|
||||
accelerators <#what_hardware_accelerators_are_supported.3f>`__ on the server and
|
||||
:ref:`mozilla_projects_nss_faq#how_do_i_integrate_smart_cards_into_my_application_using_nss_3f`
|
||||
for two-factor authentication.
|
||||
|
||||
.. _how_does_nss_compare_to_openssl.3f:
|
||||
|
||||
`How does NSS compare to OpenSSL? <#how_does_nss_compare_to_openssl.3f>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
`OpenSSL <https://www.openssl.org/>`__ is an open source project that implements server-side SSL,
|
||||
TLS, and a general-purpose cryptography library. It does not support PKCS #11. It is based on the
|
||||
SSLeay library developed by Eric A. Young and Tim J. Hudson. OpenSSL is widely used in Apache
|
||||
servers and is licensed under an Apache-style licence.
|
||||
|
||||
NSS supports both server and client applications as well as
|
||||
:ref:`mozilla_projects_nss_pkcs11_faq` and S/MIME. To permit its use in as many contexts as
|
||||
possible, NSS is licensed under the `Mozilla Public License <https://www.mozilla.org/MPL/>`__,
|
||||
version 2.
|
||||
|
||||
.. _how_does_nss_compare_to_sslref.3f:
|
||||
|
||||
`How does NSS compare to SSLRef? <#how_does_nss_compare_to_sslref.3f>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
SSLRef was an early reference implementation of the SSL protocol. It contains bugs that were
|
||||
never fixed, doesn't support TLS or the new 56-bit export cipher suites, and does not contain the
|
||||
fix to the Bleichenbacher attack on PKCS#1.
|
||||
|
||||
Netscape no longer maintains SSLRef or makes it available. It was built as an example of an SSL
|
||||
implementation, not for creating production applications.
|
||||
|
||||
NSS was designed from the ground up for use by commercial developers. It provides a complete
|
||||
software development kit that uses the same architecture used to support security features in
|
||||
many client and server products from Netscape and other companies.
|
||||
|
||||
.. _what_platforms_and_development_environments_are_supported.3f:
|
||||
|
||||
`What platforms and development environments are supported? <#what_platforms_and_development_environments_are_supported.3f>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
.. warning::
|
||||
|
||||
This section is out of date
|
||||
|
||||
iPlanet E-Commerce Solutions has certified NSS 3.1 on 18 platforms, including AIX 4.3, HP-UX
|
||||
11.0, Red Hat Linux 6.0, Solaris (2.6 or later), Windows NT (4.0 or later), and Windows 2000.
|
||||
Other contributors are in the process of certifying additional platforms. The NSS 3.1 API
|
||||
requires C or C++ development environments.
|
||||
|
||||
For the latest NSS release notes and detailed platform information, see `Project
|
||||
Information <https://wiki.mozilla.org/NSS>`__.
|
||||
|
||||
.. _what_cryptography_standards_are_supported.3f:
|
||||
|
||||
`What cryptography standards are supported? <#what_cryptography_standards_are_supported.3f>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
NSS supports `SSL v2 and v3 <https://developer.mozilla.org/en-US/docs/Glossary/SSL>`__,
|
||||
`TLS <https://developer.mozilla.org/en-US/docs/Glossary/TLS>`__, `PKCS
|
||||
#5 <https://developer.mozilla.org/en-US/docs/Glossary/PKCS_.235>`__, `PKCS
|
||||
#7 <https://developer.mozilla.org/en-US/docs/Glossary/PKCS_.237>`__, `PKCS
|
||||
#11 <https://developer.mozilla.org/en-US/docs/Glossary/PKCS_.2311>`__, `PKCS
|
||||
#12 <https://developer.mozilla.org/en-US/docs/Glossary/PKCS_.2312>`__,
|
||||
`S/MIME <https://developer.mozilla.org/en-US/Glossary/en-US/docs/Glossary/S.2FMIME>`__, and
|
||||
`X.509 v3 <https://developer.mozilla.org/en-US/docs/Mozilla/Security/x509_Certificates>`__
|
||||
certificates. For complete details, see `Encryption Technologies Available in NSS
|
||||
3.11 <http://www-archive.mozilla.org/projects/security/pki/nss/nss-3.11/nss-3.11-algorithms.html>`__
|
||||
|
||||
.. _what_is_the_relationship_between_nss_and_psm.3f:
|
||||
|
||||
`What is the relationship between NSS and PSM? <#what_is_the_relationship_between_nss_and_psm.3f>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
Personal Security Manager (PSM) is built on top of NSS. It consists of libraries and a daemon
|
||||
designed to support cross-platform development of security-enabled client applications. The PSM
|
||||
binary provides a client module that performs cryptographic operations on behalf of applications.
|
||||
Netscape Personal Security Manager ships with Netscape 6 and the Gateway Connected Touch Pad with
|
||||
Instant AOL, and is also available for use with Communicator 4.7x.
|
||||
|
||||
.. _where_can_i_get_the_source.3f:
|
||||
|
||||
`Where can I get the source? <#where_can_i_get_the_source.3f>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
For instructions on how to check out and build the NSS source code, see
|
||||
:ref:`mozilla_projects_nss_nss_sources_building_testing`.
|
||||
|
||||
.. _how_much_does_it_cost.3f:
|
||||
|
||||
`How much does it cost? <#how_much_does_it_cost.3f>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
NSS source code and binaries (when they become available) are completely free. No license fees,
|
||||
no royalty fees, no subscription fees.
|
||||
|
||||
.. _developer_questions:
|
||||
|
||||
`Developer Questions <#developer_questions>`__
|
||||
----------------------------------------------
|
||||
|
||||
.. _what_hardware_accelerators_are_supported.3f:
|
||||
|
||||
`What hardware accelerators are supported? <#what_hardware_accelerators_are_supported.3f>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
NSS supports the PKCS #11 interface for hardware acceleration. Since leading accelerator vendors
|
||||
such as Chrysalis-IT, nCipher, and Rainbow Technologies also support this interface, NSS-enabled
|
||||
applications can support a wide variety of hardware accelerators.
|
||||
|
||||
.. _how_do_i_integrate_smart_cards_into_my_application_using_nss.3f:
|
||||
|
||||
`How do I integrate smart cards into my application using NSS? <#how_do_i_integrate_smart_cards_into_my_application_using_nss.3f>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
NSS supports the PKCS #11 interface for smart card integration. Applications that use the PKCS
|
||||
#11 interface provided by NSS will therefore support smart cards from leading vendors such as
|
||||
ActiveCard, Litronic, SafeNet, and SecureID Technologies that also support the PKCS #11
|
||||
interface.
|
||||
|
||||
.. _does_nss_require_netscape_portable_runtime_.28nspr.29.3f:
|
||||
|
||||
`Does NSS require Netscape Portable Runtime (NSPR)? <#does_nss_require_netscape_portable_runtime_.28nspr.29.3f>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
.. rubric:: To provide cross-platform support, NSS utilizes Netscape Portable Runtime (NSPR)
|
||||
libraries as a portability interface and implementation that provides consistent
|
||||
cross-platform semantics for network I/O and threading models. You can use NSPR throughout
|
||||
your application or only in the portion that calls into NSS. Mozilla strongly recommends that
|
||||
multithreaded applications use the NSPR or native OS threading model. (In recent NSPR
|
||||
releases, the NSPR threading model is compatible with the native threading model if the OS has
|
||||
native threads.) Alternatively, you can adapt the open-source NSPR implementation to be
|
||||
compatible with your existing application's threading models. More information about NSPR may
|
||||
be found at `Netscape Portable
|
||||
Runtime <https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSPR>`__.
|
||||
:name: to_provide_cross-platform_support_nss_utilizes_netscape_portable_runtime_nspr_libraries_as_a_portability_interface_and_implementation_that_provides_consistent_cross-platform_semantics_for_network_io_and_threading_models._you_can_use_nspr_throughout_your_application_or_only_in_the_portion_that_calls_into_nss._mozilla_strongly_recommends_that_multithreaded_applications_use_the_nspr_or_native_os_threading_model._in_recent_nspr_releases_the_nspr_threading_model_is_compatible_with_the_native_threading_model_if_the_os_has_native_threads._alternatively_you_can_adapt_the_open-source_nspr_implementation_to_be_compatible_with_your_existing_applications_threading_models._more_information_about_nspr_may_be_found_at_netscape_portable_runtime.
|
||||
|
||||
.. _can_i_use_nss_even_if_my_application_protocol_isn.27t_http.3f:
|
||||
|
||||
`Can I use NSS even if my application protocol isn't HTTP? <#can_i_use_nss_even_if_my_application_protocol_isn.27t_http.3f>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
Yes, TLS is independent of application protocols. It works with common Internet standard
|
||||
application protocols (HTTP, POP3, FTP, SMTP, etc.) as well as custom application protocols using
|
||||
TCP/IP.
|
||||
|
||||
.. _how_long_does_it_take_to_integrate_nss_into_my_application.3f:
|
||||
|
||||
`How long does it take to integrate NSS into my application? <#how_long_does_it_take_to_integrate_nss_into_my_application.3f>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
The integration effort depends on an number of factors, such as developer skill set, application
|
||||
complexity, and the level of security required for your application. NSS includes detailed
|
||||
documentation of the SSL API and sample code that demonstrates basic SSL functionality (setting
|
||||
up an encrypted session, server authentication, and client authentication) to help jump start the
|
||||
integration process. However, there is little or no documentation currently available for the
|
||||
rest of the NSS API. If your application requires sophisticated certificate management, smart
|
||||
card support, or hardware acceleration, your integration effort will be more extensive.
|
||||
|
||||
.. _where_can_i_download_the_nss_tools.3f:
|
||||
|
||||
`Where can I download the NSS tools? <#where_can_i_download_the_nss_tools.3f>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
Binary builds of NSS for several platforms including the command-line tools can be downloaded
|
||||
from
|
||||
`http://ftp.mozilla.org/pub/mozilla.o...y/nss/releases/ <http://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/>`__.
|
||||
NSPR, which you will need as well, can be downloaded from
|
||||
http://ftp.mozilla.org/pub/mozilla.org/nspr/releases/.
|
||||
|
||||
.. _how_can_i_learn_more_about_ssl.3f:
|
||||
|
||||
`How can I learn more about TLS? <#how_can_i_learn_more_about_ssl.3f>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
See https://developer.mozilla.org/en-US/docs/Glossary/TLS.
|
||||
|
||||
.. _licensing_questions:
|
||||
|
||||
`Licensing Questions <#licensing_questions>`__
|
||||
----------------------------------------------
|
||||
|
||||
.. _how_is_nss_licensed.3f:
|
||||
|
||||
`How is NSS licensed? <#how_is_nss_licensed.3f>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
NSS is available under the `Mozilla Public License <https://www.mozilla.org/MPL/>`__, version 2.
|
||||
|
||||
.. _is_nss_available_outside_the_united_states.3f:
|
||||
|
||||
`Is NSS available outside the United States? <#is_nss_available_outside_the_united_states.3f>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
.. warning::
|
||||
|
||||
This section is out of date
|
||||
|
||||
Yes; see `Build Instructions for NSS
|
||||
3.1. <NSS_reference/Building_and_installing_NSS/Build_instructions>`__ and
|
||||
ftp://ftp.mozilla.org/pub/mozilla.org/security/. However, NSS source code is subject to the U.S.
|
||||
Export Administration Regulations and other U.S. law, and may not be exported or re-exported to
|
||||
certain countries (Cuba, Iran, Iraq, Libya, North Korea, Serbia, Sudan, Syria, and
|
||||
Taleban-controlled areas of Afghanistan as of January 2000) or to persons or entities prohibited
|
||||
from receiving U.S. exports (including those (a) on the Bureau of Industry and Security Denied
|
||||
Parties List or Entity List, (b) on the Office of Foreign Assets Control list of Specially
|
||||
Designated Nationals and Blocked Persons, and (c) involved with missile technology or nuclear,
|
||||
chemical or biological weapons).
|
||||
|
||||
For more information about U.S. export controls on encryption software, see the `Mozilla Crypto
|
||||
FAQ <Mozilla_Crypto_FAQ#1-3>`__.
|
||||
|
|
@ -1,129 +0,0 @@
|
|||
.. _mozilla_projects_nss_fips_mode_-_an_explanation:
|
||||
|
||||
FIPS Mode - an explanation
|
||||
==========================
|
||||
|
||||
.. container::
|
||||
|
||||
NSS has a "FIPS Mode" that can be enabled when NSS is compiled in a specific way. (Note: Mozilla
|
||||
does not distribute a "FIPS Mode"-ready NSS with Firefox.) This page attempts to provide an
|
||||
informal explanation of what it is, who would use it, and why.
|
||||
|
||||
.. _what's_a_fips:
|
||||
|
||||
`What's a FIPS? <#what's_a_fips>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
The United States government defines many (several hundred) "Federal Information Processing
|
||||
Standard" (FIPS) documents. (FIPS sounds plural, but is singular; one FIPS document is a FIPS,
|
||||
not a FIP.) FIPS documents define rules, regulations, and standards for many aspects of handling
|
||||
of information by computers and by people. They apply to all US government employees and
|
||||
personnel, including soldiers in the armed forces. Generally speaking, any use of a computer by
|
||||
US government personnel must conform to all the relevant FIPS regulations. If you're a
|
||||
US government worker, and you want to use a Mozilla software product such as Firefox, or any
|
||||
product that uses NSS, you will want to use it in a way that is fully conformant with all the
|
||||
relevant FIPS regulations. Some other governments have also adopted many of the FIPS
|
||||
regulations, so their applicability is somewhat wider than just the US government's personnel.
|
||||
|
||||
.. _what_is_fips_mode:
|
||||
|
||||
`What is "FIPS Mode"? <#what_is_fips_mode>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
One of the FIPS regulations, FIPS 140, governs the use of encryption and cryptographic services.
|
||||
It requires that ALL cryptography done by US government personnel MUST be done in "devices" that
|
||||
have been independently tested, and certified by NIST, to meet the extensive requirements of that
|
||||
document. These devices may be hardware or software, but either way, they must function and
|
||||
behave as prescribed. So, in order for Mozilla Firefox and Thunderbird to be usable by people
|
||||
who are subject to the FIPS regulations, Mozilla's cryptographic software must be able to operate
|
||||
in a mode that is fully compliant with FIPS 140. To that end, Mozilla products can function in a
|
||||
"FIPS Mode", which is really "FIPS 140 Mode", when paired with a compliant copy of NSS. (Note,
|
||||
the current version of FIPS 140 is revision 2, a.k.a. FIPS 140-2. FIPS 140-3 is being devised by
|
||||
NIST now for adoption in the future.) Users who are subject to the FIPS regulations must ensure
|
||||
that they have Mozilla's FIPS Mode enabled when they use Mozilla software, in order to be fully
|
||||
conformant. Instructions for how to configure Firefox into FIPS mode may be found on
|
||||
`support.mozilla.com <https://support.mozilla.com/en-US/kb/Configuring+Firefox+for+FIPS+140-2>`__.
|
||||
|
||||
.. _is_nss_fips-140_compliant:
|
||||
|
||||
`Is NSS FIPS-140 compliant? <#is_nss_fips-140_compliant>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
Mozilla's NSS cryptographic software has been tested by government-approved independent testing
|
||||
labs and certified by NIST as being FIPS 140 compliant *when operated in FIPS mode* on 4 previous
|
||||
occasions. As of this writing, NSS is now being retested to be recertified for the fifth time.
|
||||
NSS was the first open source cryptographic library to be FIPS certified.
|
||||
|
||||
.. _what_is_fips_mode_all_about:
|
||||
|
||||
`What is FIPS Mode all about? <#what_is_fips_mode_all_about>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
A FIPS-140 compliant application must do ALL of its cryptography in a FIPS-140 certified
|
||||
"device". Whether it is hardware or software, that device will have all the cryptographic
|
||||
engines in it, and also will stores keys and perhaps certificates inside. The device must have a
|
||||
way for users to authenticate to it (to "login" to it), to prove to it that they are authorized
|
||||
to use the cryptographic engines and keys it contains. It may not do ANY cryptographic
|
||||
operations that involve the use of cryptographic keys, nor allow ANY of the keys or certificates
|
||||
it holds to be seen or used, except when a user has successfully authenticated to it. If users
|
||||
authenticate to it with a password, it must ensure that their passwords are strong passwords. It
|
||||
must implement the US government standard algorithms (also specified in other FIPS documents)
|
||||
such as AES, triple-DES, SHA-1 and SHA-256, that are needed to do whatever job the application
|
||||
wants it to perform. It must generate or derive cryptographic keys and store them internally.
|
||||
Except for "public keys", it must not allow any keys to leave it (to get outside of it) unless
|
||||
they are encrypted ("wrapped") in a special way. This makes it difficult to move keys from one
|
||||
device to another, and consequently, all crypto engines and key storage must be in a single
|
||||
device rather than being split up into several devices.
|
||||
|
||||
.. _how_does_this_affect_firefox_users:
|
||||
|
||||
`How does this affect Firefox users? <#how_does_this_affect_firefox_users>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
These requirements have several implications for users. In FIPS Mode, every user must have a
|
||||
good strong "master password", and must enter it each time they start or restart Firefox before
|
||||
they can visit any web sites that use cryptography (https). Firefox can only use the latest
|
||||
version of SSL, known as "TLS", and not the older SSL 2 or SSL 3.0 protocols, and Firefox can
|
||||
only talk to those servers that use FIPS standard encryption algorithms such as AES or
|
||||
triple-DES. Servers that can only use non-FIPS-approved encryption, such as RC4, cannot be used
|
||||
in FIPS mode.
|
||||
|
||||
.. _how_is_fips_mode_different_from_normal_non-fips_mode:
|
||||
|
||||
`How is FIPS Mode different from normal non-FIPS Mode? <#how_is_fips_mode_different_from_normal_non-fips_mode>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
In normal non-FIPS Mode, the "master password" is optional and is allowed to be a weak short
|
||||
password. The user is only required to enter his master password to use his own private keys (if
|
||||
he has any) or to access his stored web-site passwords. The user is not required to enter the
|
||||
master password to visit ordinary https servers, nor to view certificates he has previously
|
||||
stored. In non-FIPS mode, NSS is willing and able to use popular non-FIPS approved cryptographic
|
||||
algorithms, such as RC4 and MD5, to communicate with older https servers. NSS divides its
|
||||
operations up into two "devices" rather than just one. One device does all the operations that
|
||||
may be done without needing to authenticate, and the other device stores the user's certificates
|
||||
and private keys and performs operations that use those private keys.
|
||||
|
||||
.. _how_do_i_put_firefox_into_fips_mode:
|
||||
|
||||
`How do I put Firefox into FIPS Mode? <#how_do_i_put_firefox_into_fips_mode>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
Instructions for how to configure Firefox into FIPS mode may be found on
|
||||
`support.mozilla.com <https://support.mozilla.com/en-US/kb/Configuring+Firefox+for+FIPS+140-2>`__.
|
||||
Some third-parties distribute Firefox ready for FIPS mode, `a partial list can be found at the
|
||||
NSS
|
||||
wiki <https://wiki.mozilla.org/FIPS_Validation#Products_Implementing_FIPS_140-2_Validated_NSS>`__.
|
||||
|
|
@ -1,105 +0,0 @@
|
|||
.. _mozilla_projects_nss_http_delegation:
|
||||
|
||||
HTTP delegation
|
||||
===============
|
||||
|
||||
`Background <#background>`__
|
||||
----------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
Up to version 3.11, :ref:`mozilla_projects_nss` connects directly over
|
||||
`HTTP <https://developer.mozilla.org/en-US/docs/Web/HTTP>`__ to an OCSP responder to make the
|
||||
request and fetch the response. It does so in a blocking fashion, and also directly to the
|
||||
responder, ignoring any proxy the application may wish to use. This causes OCSP requests to fail
|
||||
if the network environment requires the use of a proxy.
|
||||
|
||||
There are two possible solutions to this limitation. Instead of improving the simple HTTP client
|
||||
in NSS, the NSS team has decided to provide an NSS API to register application callback
|
||||
functions. If provided by the application, NSS will use the registered HTTP client for querying
|
||||
an OSCP responder.
|
||||
|
||||
This NSS feature is currently targeted to first appear in NSS version 3.11.1. More details can be
|
||||
found in `bug 152426 <https://bugzilla.mozilla.org/show_bug.cgi?id=152426>`__.
|
||||
|
||||
In order to use the HTTP Delegation feature in your NSS-based application, you need to implement
|
||||
several callback functions. Your callback functions might be a full implementation of a HTTP
|
||||
client. Or you might choose to leverage an existing HTTP client library and implement the
|
||||
callback functions as a thin layer that forwards requests from NSS to the HTTP client library.
|
||||
|
||||
To learn about all the details, please read the documentation contained in the NSS C header
|
||||
files. Look for function SEC_RegisterDefaultHttpClient and all functions having names that start
|
||||
with SEC_Http.
|
||||
|
||||
To find an example implementation, you may look at
|
||||
`bug 111384 <https://bugzilla.mozilla.org/show_bug.cgi?id=111384>`__, which tracks the
|
||||
implementation in Mozilla client applications.
|
||||
|
||||
.. _instructions_for_specifying_an_ocsp_proxy:
|
||||
|
||||
`Specifying an OCSP proxy <#instructions_for_specifying_an_ocsp_proxy>`__
|
||||
-------------------------------------------------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
The remainder of this document is a short HOWTO.
|
||||
|
||||
One might expect the API defines a simple function that accepts the URI and data to be sent, and
|
||||
returns the result data. But there is no such simple interface.
|
||||
|
||||
The API should allow NSS to use the HTTP client either asynchronously or synchronously. In
|
||||
addition, during an application session with OCSP enabled, a large number of OCSP requests might
|
||||
have to be sent. Therefore the API should allow for keep-alive (persistent) HTTP connections.
|
||||
|
||||
HTTP URIs consist of host:port and a path, e.g.
|
||||
http://ocsp.provider.com:80/cgi-bin/ocsp-responder
|
||||
|
||||
If NSS needs to access a HTTP server, it will request that an "http server session object" be
|
||||
created (SEC_HttpServer_CreateSessionFcn).
|
||||
|
||||
The http server session object is logically associated with host and port destination
|
||||
information, in our example this is "host ocsp.provider.com port 80". The object may be used by
|
||||
the application to associate it with a physical network connection.
|
||||
|
||||
(NSS might choose to be smart, and only create a single http server session object for each
|
||||
server encountered. NSS might also choose to be simple, and request multiple objects for the same
|
||||
server. The application must support both strategies.)
|
||||
|
||||
The logical http server session object is expected to remain valid until explicitly destroyed
|
||||
(SEC_HttpServer_FreeSessionFcn). Should the application be unable to keep a physical connection
|
||||
alive all the time, the application is expected to create new connections automatically.
|
||||
|
||||
NSS may choose to repeatedly call a "network connection keep alive" function
|
||||
(SEC_HttpServer_KeepAliveSessionFcn) on the server session object, giving application code a
|
||||
chance to do whatever is required.
|
||||
|
||||
For each individual HTTP request, NSS will request the creation of a "http request object"
|
||||
(SEC_HttpRequest_CreateFcn). No full URI is provided as a parameter. Instead, the parameters are
|
||||
a server session object (that carries host and port information already) and the request path. In
|
||||
our example the path is "/cgi-bin/ocsp-responder". (When issueing GET requests, the
|
||||
"?query-string=data" portion should already be appended to the request path)
|
||||
|
||||
After creation, NSS might call functions to provide additional details of the HTTP request (e.g.
|
||||
SEC_HttpRequest_SetPostDataFcn). The application is expected to collect the details for later
|
||||
use.
|
||||
|
||||
Once NSS is finished providing all details, it will request to initiate the actual network
|
||||
communication (SEC_HttpRequest_TrySendAndReceiveFcn). The application should try to reuse
|
||||
existing network connections associated with the server session object.
|
||||
|
||||
Once the HTTP response has been obtained from the HTTP server, the function will provide the
|
||||
results in its "out parameters".
|
||||
|
||||
Please read the source code documentation to learn how to use this API synchronously or
|
||||
asynchronously.
|
||||
|
||||
Now that we have explained the interaction between NSS, the callback functions and the
|
||||
application, let's look at the steps required by the application to initially register the
|
||||
callbacks.
|
||||
|
||||
Make sure you have completed the NSS initialization before you attempt to register the callbacks.
|
||||
|
||||
Look at SEC_HttpClientFcn, which is a (versioned) table of function pointers. Create an instance
|
||||
of this type and supply a pointer to your implementation for each entry in the function table.
|
||||
|
||||
Finally register your HTTP client implementation with a call to SEC_RegisterDefaultHttpClient.
|
||||
|
|
@ -1,105 +0,0 @@
|
|||
.. _mozilla_projects_nss_http_delegation_clone:
|
||||
|
||||
HTTP delegation
|
||||
===============
|
||||
|
||||
`Background <#background>`__
|
||||
----------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
Up to version 3.11, :ref:`mozilla_projects_nss` connects directly over
|
||||
`HTTP <https://developer.mozilla.org/en-US/docs/Web/HTTP>`__ to an OCSP responder to make the
|
||||
request and fetch the response. It does so in a blocking fashion, and also directly to the
|
||||
responder, ignoring any proxy the application may wish to use. This causes OCSP requests to fail
|
||||
if the network environment requires the use of a proxy.
|
||||
|
||||
There are two possible solutions to this limitation. Instead of improving the simple HTTP client
|
||||
in NSS, the NSS team has decided to provide an NSS API to register application callback
|
||||
functions. If provided by the application, NSS will use the registered HTTP client for querying
|
||||
an OSCP responder.
|
||||
|
||||
This NSS feature is currently targeted to first appear in NSS version 3.11.1. More details can be
|
||||
found in `bug 152426 <https://bugzilla.mozilla.org/show_bug.cgi?id=152426>`__.
|
||||
|
||||
In order to use the HTTP Delegation feature in your NSS-based application, you need to implement
|
||||
several callback functions. Your callback functions might be a full implementation of a HTTP
|
||||
client. Or you might choose to leverage an existing HTTP client library and implement the
|
||||
callback functions as a thin layer that forwards requests from NSS to the HTTP client library.
|
||||
|
||||
To learn about all the details, please read the documentation contained in the NSS C header
|
||||
files. Look for function SEC_RegisterDefaultHttpClient and all functions having names that start
|
||||
with SEC_Http.
|
||||
|
||||
To find an example implementation, you may look at
|
||||
`bug 111384 <https://bugzilla.mozilla.org/show_bug.cgi?id=111384>`__, which tracks the
|
||||
implementation in Mozilla client applications.
|
||||
|
||||
.. _instructions_for_specifying_an_ocsp_proxy:
|
||||
|
||||
`Specifying an OCSP proxy <#instructions_for_specifying_an_ocsp_proxy>`__
|
||||
-------------------------------------------------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
The remainder of this document is a short HOWTO.
|
||||
|
||||
One might expect the API defines a simple function that accepts the URI and data to be sent, and
|
||||
returns the result data. But there is no such simple interface.
|
||||
|
||||
The API should allow NSS to use the HTTP client either asynchronously or synchronously. In
|
||||
addition, during an application session with OCSP enabled, a large number of OCSP requests might
|
||||
have to be sent. Therefore the API should allow for keep-alive (persistent) HTTP connections.
|
||||
|
||||
HTTP URIs consist of host:port and a path, e.g.
|
||||
http://ocsp.provider.com:80/cgi-bin/ocsp-responder
|
||||
|
||||
If NSS needs to access a HTTP server, it will request that an "http server session object" be
|
||||
created (SEC_HttpServer_CreateSessionFcn).
|
||||
|
||||
The http server session object is logically associated with host and port destination
|
||||
information, in our example this is "host ocsp.provider.com port 80". The object may be used by
|
||||
the application to associate it with a physical network connection.
|
||||
|
||||
(NSS might choose to be smart, and only create a single http server session object for each
|
||||
server encountered. NSS might also choose to be simple, and request multiple objects for the same
|
||||
server. The application must support both strategies.)
|
||||
|
||||
The logical http server session object is expected to remain valid until explicitly destroyed
|
||||
(SEC_HttpServer_FreeSessionFcn). Should the application be unable to keep a physical connection
|
||||
alive all the time, the application is expected to create new connections automatically.
|
||||
|
||||
NSS may choose to repeatedly call a "network connection keep alive" function
|
||||
(SEC_HttpServer_KeepAliveSessionFcn) on the server session object, giving application code a
|
||||
chance to do whatever is required.
|
||||
|
||||
For each individual HTTP request, NSS will request the creation of a "http request object"
|
||||
(SEC_HttpRequest_CreateFcn). No full URI is provided as a parameter. Instead, the parameters are
|
||||
a server session object (that carries host and port information already) and the request path. In
|
||||
our example the path is "/cgi-bin/ocsp-responder". (When issuing GET requests, the
|
||||
"?query-string=data" portion should already be appended to the request path)
|
||||
|
||||
After creation, NSS might call functions to provide additional details of the HTTP request (e.g.
|
||||
SEC_HttpRequest_SetPostDataFcn). The application is expected to collect the details for later
|
||||
use.
|
||||
|
||||
Once NSS is finished providing all details, it will request to initiate the actual network
|
||||
communication (SEC_HttpRequest_TrySendAndReceiveFcn). The application should try to reuse
|
||||
existing network connections associated with the server session object.
|
||||
|
||||
Once the HTTP response has been obtained from the HTTP server, the function will provide the
|
||||
results in its "out parameters".
|
||||
|
||||
Please read the source code documentation to learn how to use this API synchronously or
|
||||
asynchronously.
|
||||
|
||||
Now that we have explained the interaction between NSS, the callback functions and the
|
||||
application, let's look at the steps required by the application to initially register the
|
||||
callbacks.
|
||||
|
||||
Make sure you have completed the NSS initialization before you attempt to register the callbacks.
|
||||
|
||||
Look at SEC_HttpClientFcn, which is a (versioned) table of function pointers. Create an instance
|
||||
of this type and supply a pointer to your implementation for each entry in the function table.
|
||||
|
||||
Finally register your HTTP client implementation with a call to SEC_RegisterDefaultHttpClient.
|
||||
|
|
@ -1,178 +0,0 @@
|
|||
.. _mozilla_projects_nss:
|
||||
|
||||
Legacy documentation
|
||||
====================
|
||||
|
||||
.. toctree::
|
||||
:maxdepth: 2
|
||||
:glob:
|
||||
:hidden:
|
||||
|
||||
getting_started_with_nss/index.rst
|
||||
introduction_to_network_security_services/index.rst
|
||||
More documentation <more_docs>
|
||||
|
||||
.. warning::
|
||||
This NSS documentation was just imported from our legacy MDN repository. It currently is very deprecated and likely incorrect or broken in many places.
|
||||
|
||||
Legacy Documentation
|
||||
--------------------
|
||||
|
||||
.. container::
|
||||
|
||||
**Network Security Services** (**NSS**) is a set of libraries designed to support cross-platform
|
||||
development of security-enabled client and server applications. Applications built with NSS can
|
||||
support SSL v3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12, S/MIME, X.509 v3 certificates, and
|
||||
other security standards.
|
||||
|
||||
For detailed information on standards supported, see :ref:`mozilla_projects_nss_overview`. For a
|
||||
list of frequently asked questions, see the :ref:`mozilla_projects_nss_faq`.
|
||||
|
||||
NSS is available under the Mozilla Public License. For information on downloading NSS releases as
|
||||
tar files, see :ref:`mozilla_projects_nss_nss_sources_building_testing`.
|
||||
|
||||
If you're a developer and would like to contribute to NSS, you might want to read the documents
|
||||
:ref:`mozilla_projects_nss_an_overview_of_nss_internals` and
|
||||
:ref:`mozilla_projects_nss_getting_started_with_nss`.
|
||||
|
||||
.. rubric:: Background Information
|
||||
:name: Background_Information
|
||||
|
||||
:ref:`mozilla_projects_nss_overview`
|
||||
Provides a brief summary of NSS and its capabilities.
|
||||
:ref:`mozilla_projects_nss_faq`
|
||||
Answers basic questions about NSS.
|
||||
`Introduction to Public-Key Cryptography <https://developer.mozilla.org/en-US/docs/Archive/Security/Introduction_to_Public-Key_Cryptography>`__
|
||||
Explains the basic concepts of public-key cryptography that underlie NSS.
|
||||
`Introduction to SSL <https://developer.mozilla.org/en-US/docs/Archive/Security/Introduction_to_SSL>`__
|
||||
Introduces the SSL protocol, including information about cryptographic ciphers supported by
|
||||
SSL and the steps involved in the SSL handshake.
|
||||
|
||||
.. rubric:: Getting Started
|
||||
:name: Getting_Started
|
||||
|
||||
:ref:`mozilla_projects_nss_nss_releases`
|
||||
This page contains information about the current and past releases of NSS.
|
||||
:ref:`mozilla_projects_nss_nss_sources_building_testing`
|
||||
Instructions on how to build NSS on the different supported platforms.
|
||||
`Get Mozilla Source Code Using Mercurial <https://developer.mozilla.org/en-US/docs/Mozilla/Developer_guide/Source_Code/Mercurial>`__
|
||||
Information about with working with Mercurial.
|
||||
`Get Mozilla Source Code Using CVS (deprecated) <https://developer.mozilla.org/en-US/docs/Mozilla/Developer_guide/Source_Code/CVS>`__
|
||||
Old deprecated CVS documentation.
|
||||
|
||||
.. rubric:: NSS APIs
|
||||
:name: NSS_APIs
|
||||
|
||||
:ref:`mozilla_projects_nss_introduction_to_network_security_services`
|
||||
Provides an overview of the NSS libraries and what you need to know to use them.
|
||||
:ref:`mozilla_projects_nss_ssl_functions`
|
||||
Summarizes the SSL APIs exported by the NSS shared libraries.
|
||||
:ref:`mozilla_projects_nss_reference`
|
||||
API used to invoke SSL operations.
|
||||
:ref:`mozilla_projects_nss_nss_api_guidelines`
|
||||
Explains how the libraries and code are organized, and guidelines for developing code (naming
|
||||
conventions, error handling, thread safety, etc.)
|
||||
:ref:`mozilla_projects_nss_nss_tech_notes`
|
||||
Links to NSS technical notes, which provide latest information about new NSS features and
|
||||
supplementary documentation for advanced topics in programming with NSS.
|
||||
|
||||
.. rubric:: Tools, testing, and other technical details
|
||||
:name: Tools_testing_and_other_technical_details
|
||||
|
||||
:ref:`mozilla_projects_nss_building`
|
||||
Describe how to check out and build NSS releases.
|
||||
|
||||
:ref:`mozilla_projects_nss_nss_developer_tutorial`
|
||||
How to make changes in NSS. Coding style, maintaining ABI compatibility.
|
||||
|
||||
:ref:`mozilla_projects_nss_tools`
|
||||
Tools for developing, debugging, and managing applications that use NSS.
|
||||
:ref:`mozilla_projects_nss_nss_sample_code`
|
||||
Demonstrates how NSS can be used for cryptographic operations, certificate handling, SSL, etc.
|
||||
:ref:`mozilla_projects_nss_nss_third-party_code`
|
||||
A list of third-party code included in the NSS library.
|
||||
`NSS 3.2 Test Suite <https://www-archive.mozilla.org/projects/security/pki/nss/testnss_32.html>`__
|
||||
**Archived version.** Describes how to run the standard NSS tests.
|
||||
`NSS Performance Reports <https://www-archive.mozilla.org/projects/security/pki/nss/performance_reports.html>`__
|
||||
**Archived version.** Links to performance reports for NSS 3.2 and later releases.
|
||||
`Encryption Technologies Available in NSS 3.11 <https://www-archive.mozilla.org/projects/security/pki/nss/nss-3.11/nss-3.11-algorithms.html>`__
|
||||
**Archived version.** Lists the cryptographic algorithms used by NSS 3.11.
|
||||
`NSS 3.1 Loadable Root Certificates <https://www-archive.mozilla.org/projects/security/pki/nss/loadable_certs.html>`__
|
||||
**Archived version.** Describes the scheme for loading root CA certificates.
|
||||
`cert7.db <https://www-archive.mozilla.org/projects/security/pki/nss/db_formats.html>`__
|
||||
**Archived version.** General format of the cert7.db database.
|
||||
|
||||
.. rubric:: PKCS #11 information
|
||||
:name: PKCS_11_information
|
||||
|
||||
- :ref:`mozilla_projects_nss_pkcs11`
|
||||
- :ref:`mozilla_projects_nss_pkcs11_implement`
|
||||
- :ref:`mozilla_projects_nss_pkcs11_module_specs`
|
||||
- :ref:`mozilla_projects_nss_pkcs11_faq`
|
||||
- `Using the JAR Installation Manager to Install a PKCS #11 Cryptographic
|
||||
Module <https://developer.mozilla.org/en-US/docs/PKCS11_Jar_Install>`__
|
||||
- `PKCS #11 Conformance Testing - Archived
|
||||
version <https://www-archive.mozilla.org/projects/security/pki/pkcs11/>`__
|
||||
|
||||
.. rubric:: CA certificates pre-loaded into NSS
|
||||
:name: CA_certificates_pre-loaded_into_NSS
|
||||
|
||||
- `Mozilla CA certificate policy <https://www.mozilla.org/projects/security/certs/policy/>`__
|
||||
- `List of pre-loaded CA certificates <https://wiki.mozilla.org/CA/Included_Certificates>`__
|
||||
|
||||
- Consumers of this list must consider the trust bit setting for each included root
|
||||
certificate. `More
|
||||
Information <https://www.imperialviolet.org/2012/01/30/mozillaroots.html>`__, `Extracting
|
||||
roots and their trust bits <https://github.com/agl/extract-nss-root-certs>`__
|
||||
|
||||
.. rubric:: NSS is built on top of Netscape Portable Runtime (NSPR)
|
||||
:name: NSS_is_built_on_top_of_Netscape_Portable_Runtime_NSPR
|
||||
|
||||
`Netscape Portable Runtime <NSPR>`__
|
||||
NSPR project page.
|
||||
`NSPR Reference <https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSPR/Reference>`__
|
||||
NSPR API documentation.
|
||||
|
||||
.. rubric:: Additional Information
|
||||
:name: Additional_Information
|
||||
|
||||
- `Using the window.crypto object from
|
||||
JavaScript <https://developer.mozilla.org/en-US/docs/JavaScript_crypto>`__
|
||||
- :ref:`mozilla_projects_nss_http_delegation`
|
||||
- :ref:`mozilla_projects_nss_tls_cipher_suite_discovery`
|
||||
- :ref:`mozilla_projects_nss_certificate_download_specification`
|
||||
- :ref:`mozilla_projects_nss_fips_mode_-_an_explanation`
|
||||
- :ref:`mozilla_projects_nss_key_log_format`
|
||||
|
||||
.. rubric:: Planning
|
||||
:name: Planning
|
||||
|
||||
Information on NSS planning can be found at `wiki.mozilla.org <https://wiki.mozilla.org/NSS>`__,
|
||||
including:
|
||||
|
||||
- `FIPS Validation <https://wiki.mozilla.org/FIPS_Validation>`__
|
||||
- `NSS Roadmap page <https://wiki.mozilla.org/NSS:Roadmap>`__
|
||||
- `NSS Improvement
|
||||
Project <https://fedoraproject.org/wiki/User:Mitr/NSS:DeveloperFriendliness>`__
|
||||
|
||||
Community
|
||||
~~~~~~~~~
|
||||
|
||||
- View Mozilla Security forums...
|
||||
|
||||
- `Mailing list <https://lists.mozilla.org/listinfo/dev-security>`__
|
||||
- `Newsgroup <http://groups.google.com/group/mozilla.dev.security>`__
|
||||
- `RSS feed <http://groups.google.com/group/mozilla.dev.security/feeds>`__
|
||||
|
||||
- View Mozilla Cryptography forums...
|
||||
|
||||
- `Mailing list <https://lists.mozilla.org/listinfo/dev-tech-crypto>`__
|
||||
- `Newsgroup <http://groups.google.com/group/mozilla.dev.tech.crypto>`__
|
||||
- `RSS feed <http://groups.google.com/group/mozilla.dev.tech.crypto/feeds>`__
|
||||
|
||||
|
||||
Related Topics
|
||||
~~~~~~~~~~~~~~
|
||||
|
||||
- `Security <https://developer.mozilla.org/en-US/docs/Security>`__
|
||||
|
||||
File diff suppressed because it is too large
Load diff
|
|
@ -1,162 +0,0 @@
|
|||
.. _mozilla_projects_nss_introduction_to_network_security_services:
|
||||
|
||||
Introduction to Network Security Services
|
||||
=========================================
|
||||
|
||||
.. container::
|
||||
|
||||
**Network Security Services (NSS)** is a set of libraries designed to support cross-platform
|
||||
development of communications applications that support SSL, S/MIME, and other Internet security
|
||||
standards. For a general overview of NSS and the standards it supports, see
|
||||
:ref:`mozilla_projects_nss_overview`.
|
||||
|
||||
.. _shared_libraries:
|
||||
|
||||
`Shared libraries <#shared_libraries>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
Network Security Services provides both static libraries and shared libraries. Applications that
|
||||
use the shared libraries must use only the APIs that they export. Three shared libraries export
|
||||
public functions:
|
||||
|
||||
- The SSL library supports core SSL operations.
|
||||
- The S/MIME library supports core S/MIME operations.
|
||||
- The NSS library supports core crypto operations.
|
||||
|
||||
We guarantee that applications using the exported APIs will remain compatible with future
|
||||
versions of those libraries. For a complete list of public functions exported by these shared
|
||||
libraries in NSS 3.2, see :ref:`mozilla_projects_nss_reference_nss_functions`.
|
||||
|
||||
For information on which static libraries in NSS 3.1.1 are replaced by each of the above shared
|
||||
libraries in NSS 3.2 , see `Migration from NSS
|
||||
3.1.1 <https://www-archive.mozilla.org/projects/security/pki/nss/release_notes_32.html#migration>`__.
|
||||
|
||||
Figure 1, below, shows a simplified view of the relationships among the three shared libraries
|
||||
listed above and NSPR, which provides low-level cross platform support for operations such as
|
||||
threading and I/O. (Note that NSPR is a separate Mozilla project; see `Netscape Portable
|
||||
Runtime <https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSPR>`__ for details.)
|
||||
|
||||
.. image:: /en-US/docs/Mozilla/Projects/NSS/Introduction_to_Network_Security_Services/nss.gif
|
||||
:alt: Diagram showing the relationships among core NSS libraries and NSPR.
|
||||
:width: 429px
|
||||
:height: 196px
|
||||
|
||||
.. _naming_conventions_and_special_libraries:
|
||||
|
||||
`Naming conventions and special libraries <#naming_conventions_and_special_libraries>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
Windows and Unix use different naming conventions for static and dynamic libraries:
|
||||
|
||||
======= ======== ==================
|
||||
Windows Unix
|
||||
static ``.lib`` ``.a``
|
||||
dynamic ``.dll`` ``.so`` or ``.sl``
|
||||
======= ======== ==================
|
||||
|
||||
In addition, Windows has "import" libraries that bind to dynamic libraries. So the NSS library
|
||||
has the following forms:
|
||||
|
||||
- ``libnss3.so`` - Unix shared library
|
||||
- ``libnss3.sl`` - HP-UX shared library
|
||||
- ``libnss.a`` - Unix static library
|
||||
- ``nss3.dll`` - Windows shared library
|
||||
- ``nss3.lib`` - Windows import library binding to ``nss3.dll``
|
||||
- ``nss.lib`` - Windows static library
|
||||
|
||||
NSS, SSL, and S/MIME have all of the above forms.
|
||||
|
||||
The following static libraries aren't included in any shared libraries
|
||||
|
||||
- ``libcrmf.a``/``crmf.lib`` provides an API for CRMF operations.
|
||||
- ``libjar.a``/``jar.lib`` provides an API for creating JAR files.
|
||||
|
||||
The following static libraries are included only in external loadable PKCS #11 modules:
|
||||
|
||||
- ``libnssckfw.a``/``nssckfw.lib`` provides an API for writing PKCS #11 modules.
|
||||
- ``libswfci.a``/``swfci.lib`` provides support for software FORTEZZA.
|
||||
|
||||
The following shared libraries are standalone loadable modules, not meant to be linked with
|
||||
directly:
|
||||
|
||||
- ``libfort.so``/``libfort.sl``/``fort32.dll`` provides support for hardware FORTEZZA.
|
||||
- ``libswft.so``/``libswft.sl``/``swft32.dll`` provides support for software FORTEZZA.
|
||||
- ``libnssckbi.so``/``libnssckbi.sl``/``nssckbi.dll`` defines the default set of trusted root
|
||||
certificates.
|
||||
|
||||
.. _support_for_ilp32:
|
||||
|
||||
`Support for ILP32 <#support_for_ilp32>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
In NSS 3.2 and later versions, there are two new shared libraries for the platforms HP-UX for
|
||||
PARisc CPUs and Solaris for (Ultra)Sparc (not x86) CPUs. These HP and Solaris platforms allow
|
||||
programs that use the ILP32 program model to run on both 32-bit CPUs and 64-bit CPUs. The two
|
||||
libraries exist to provide optimal performance on each of the two types of CPUs.
|
||||
|
||||
These two extra shared libraries are not supplied on any other platforms. The names of these
|
||||
libraries are platform-dependent, as shown in the following table.
|
||||
|
||||
================================== ============================ ============================
|
||||
Platform for 32-bit CPUs for 64-bit CPUs
|
||||
Solaris/Sparc ``libfreebl_pure32_3.so`` ``libfreebl_hybrid_3.so``
|
||||
HPUX/PARisc ``libfreebl_pure32_3.sl`` ``libfreebl_hybrid_3.sl``
|
||||
AIX (planned for a future release) ``libfreebl_pure32_3_shr.a`` ``libfreebl_hybrid_3_shr.a``
|
||||
================================== ============================ ============================
|
||||
|
||||
An application should not link against these libraries, because they are dynamically loaded by
|
||||
NSS at run time. Linking the application against one or the other of these libraries may produce
|
||||
an application program that can only run on one type of CPU (e.g. only on 64-bit CPUs, not on
|
||||
32-bit CPUs) or that doesn't use the more efficient 64-bit code on 64-bit CPUs, which defeats the
|
||||
purpose of having these shared libraries.
|
||||
|
||||
On platforms for which these shared libraries exist, NSS 3.2 will fail if these shared libs are
|
||||
not present. So, an application must include these files in its distribution of NSS shared
|
||||
libraries. These shared libraries should be installed in the same directory where the other NSS
|
||||
shared libraries (such as ``libnss3.so``) are installed. Both shared libs should always be
|
||||
installed whether the target system has a 32-bit CPU or a 64-bit CPU. NSS will pick the right one
|
||||
for the local system at run time.
|
||||
|
||||
Note that NSS 3.x is also available in the LP64 model for these platforms, but the LP64 model of
|
||||
NSS 3.x does not have these two extra shared libraries.
|
||||
|
||||
.. _what_you_should_already_know:
|
||||
|
||||
`What you should already know <#what_you_should_already_know>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
Before using NSS, you should be familiar with the following topics:
|
||||
|
||||
- Concepts and techniques of public-key cryptography
|
||||
- The Secure Sockets Layer (SSL) protocol
|
||||
- The PKCS #11 standard for cryptographic token interfaces
|
||||
- Cross-platform development issues and techniques
|
||||
|
||||
.. _where_to_find_more_information:
|
||||
|
||||
`Where to find more information <#where_to_find_more_information>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
For information about PKI and SSL that you should understand before using NSS, see the following:
|
||||
|
||||
- `Introduction to Public-Key
|
||||
Cryptography <https://developer.mozilla.org/en-US/docs/Archive/Security/Introduction_to_Public-Key_Cryptography>`__
|
||||
- `Introduction to
|
||||
SSL <https://developer.mozilla.org/en-US/docs/Archive/Security/Introduction_to_SSL>`__
|
||||
|
||||
For links to API documentation, build instructions, and other useful information, see the
|
||||
:ref:`mozilla_projects_nss`.
|
||||
|
||||
As mentioned above, NSS is built on top of NSPR. The API documentation for NSPR is available at
|
||||
`NSPR API
|
||||
Reference <https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSPR/Reference>`__.
|
||||
|
|
@ -1,174 +0,0 @@
|
|||
.. _mozilla_projects_nss_jss_4_3_1_release_notes:
|
||||
|
||||
4.3.1 Release Notes
|
||||
===================
|
||||
|
||||
.. _release_date_2009-12-02:
|
||||
|
||||
`Release Date: 2009-12-02 <#release_date_2009-12-02>`__
|
||||
-------------------------------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
`Introduction <#introduction>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
Network Security Services for Java (JSS) 4.3.1 is a minor release with the following new
|
||||
features:
|
||||
|
||||
- Support for SSL3 & TLS Renegotiation Vulnerability
|
||||
- Support to explicitly set the key usage for the generated private key
|
||||
|
||||
JSS 4.3.1 is `tri-licensed <https://www.mozilla.org/MPL>`__ under MPL 1.1/GPL 2.0/LGPL 2.1.
|
||||
|
||||
.. _new_in_jss_4.3.1:
|
||||
|
||||
`New in JSS 4.3.1 <#new_in_jss_4.3.1>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
A list of bug fixes and enhancement requests were implemented in this release can be obtained by
|
||||
running this `bugzilla
|
||||
query <http://bugzilla.mozilla.org/buglist.cgi?product=JSS&target_milestone=4.3.1&target_milestone=4.3.1&bug_status=RESOLVED&resolution=FIXED>`__
|
||||
|
||||
**JSS 4.3.1 requires :ref:`mozilla_projects_nss_3_12_5_release_notes` or higher.**
|
||||
|
||||
.. rubric:: SSL3 & TLS Renegotiation Vulnerability
|
||||
:name: ssl3_tls_renegotiation_vulnerability
|
||||
|
||||
See `CVE-2009-3555 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3555>`__ and `US-CERT
|
||||
VU#120541 <http://www.kb.cert.org/vuls/id/120541>`__ for more information about this security
|
||||
vulnerability.
|
||||
|
||||
All SSL/TLS renegotiation is disabled by default in NSS 3.12.5 and therefore will be disabled by
|
||||
default with JSS 4.3.1. This will cause programs that attempt to perform renegotiation to
|
||||
experience failures where they formerly experienced successes, and is necessary for them to not
|
||||
be vulnerable, until such time as a new safe renegotiation scheme is standardized by the IETF.
|
||||
|
||||
If an application depends on renegotiation feature, it can be enabled by setting the environment
|
||||
variable NSS_SSL_ENABLE_RENEGOTIATION to 1. By setting this environmental variable, the fix
|
||||
provided by these patches will have no effect and the application may become vulnerable to the
|
||||
issue.
|
||||
|
||||
This default setting can also be changed within the application by using the following JSS
|
||||
methods:
|
||||
|
||||
- SSLServerSocket.enableRenegotiation(int mode)
|
||||
- SSLSocket.enableRenegotiation(int mode)
|
||||
- SSLSocket.enableRenegotiationDefault(int mode)
|
||||
|
||||
The mode of renegotiation that the peer must use can be set to the following:
|
||||
|
||||
- SSLSocket.SSL_RENEGOTIATE_NEVER - Never renegotiate at all. (Default)
|
||||
- SSLSocket.SSL_RENEGOTIATE_UNRESTRICTED - Renegotiate without
|
||||
restriction, whether or not the peer's client hello bears the
|
||||
renegotiation info extension (like we always did in the past).
|
||||
- SSLSocket.SSL_RENEGOTIATE_REQUIRES_XTN - NOT YET IMPLEMENTED
|
||||
|
||||
.. rubric:: Explicitly set the key usage for the generated private key
|
||||
:name: explicitly_set_the_key_usage_for_the_generated_private_key
|
||||
|
||||
| In PKCS #11, each keypair can be marked with the operations it will
|
||||
| be used to perform. Some tokens require that a key be marked for
|
||||
| an operation before the key can be used to perform that operation;
|
||||
| other tokens don't care. NSS/JSS provides a way to specify a set of
|
||||
| flags and a corresponding mask for these flags.
|
||||
|
||||
- see generateECKeyPairWithOpFlags
|
||||
- see generateRSAKeyPairWithOpFlags
|
||||
- see generateDSAKeyPairWithOpFlags
|
||||
|
||||
.. _distribution_information:
|
||||
|
||||
`Distribution Information <#distribution_information>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
- JSS is checked into ``mozilla/security/jss/``.
|
||||
- The CVS tag for the JSS 4.3.1 release is ``JSS_4_3_1_RTM``.
|
||||
- Source tarballs are available from
|
||||
`ftp://ftp.mozilla.org/pub/mozilla.or...-4.3.1.tar.bz2 <ftp://ftp.mozilla.org/pub/mozilla.org/security/jss/releases/JSS_4_3_1_RTM/src/jss-4.3.1.tar.bz2>`__
|
||||
- Binary releases are no longer available on mozilla. JSS is a JNI library we provide the
|
||||
jss4.jar but expect you to build the JSS's matching JNI shared library. We provide the
|
||||
jss4.jar in case you do not want to obtain your own JCE code signing certificate. JSS is a
|
||||
JCE provider and therefore the jss4.jar must be signed.
|
||||
`ftp://ftp.mozilla.org/pub/mozilla.org/security/jss/releases/JSS_4_3_1_RTM <ftp://ftp.mozilla.org/pub/mozilla.org/security/jss/releases/JSS_4_3_1_RTM/>`__.
|
||||
|
||||
`Documentation <#documentation>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
Documentation for JSS 4.3.1 is available as follows:
|
||||
|
||||
- `Build Instructions for JSS 4.3.1 </jss_build_4.3.1.html>`__
|
||||
- Javadoc `[online] </javadoc>`__
|
||||
`[zipped] <ftp://ftp.mozilla.org/pub/mozilla.org/security/jss/releases/JSS_4_3_1_RTM/doc/JSS_4_3_1_RTM-doc.zip>`__
|
||||
- Read the instructions on `using JSS </using_jss.html>`__.
|
||||
- Source may be viewed with a browser (via the MXR tool) at
|
||||
http://mxr.mozilla.org/mozilla/source/security/jss/
|
||||
- The RUN TIME behavior of JSS can be affected by the
|
||||
:ref:`mozilla_projects_nss_reference_nss_environment_variables`.
|
||||
|
||||
.. _platform_information:
|
||||
|
||||
`Platform Information <#platform_information>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
- You can check out the source from CVS by
|
||||
|
||||
.. note::
|
||||
|
||||
cvs co -r JSS_4_3_1_RTM JSS
|
||||
|
||||
- JSS 4.3.1 works with JDK versions 4 or higher we suggest the latest.
|
||||
|
||||
- JSS 4.3.1 requires :ref:`mozilla_projects_nss_3_12_5` or higher.
|
||||
|
||||
- JSS 4.3.1 requires `NSPR 4.7.1 <https://www.mozilla.org/projects/nspr/release-notes/>`__ or
|
||||
higher.
|
||||
|
||||
- JSS only supports the native threading model (no green threads).
|
||||
|
||||
.. _known_bugs_and_issues:
|
||||
|
||||
`Known Bugs and Issues <#known_bugs_and_issues>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
- For a list of reported bugs that have not yet been fixed, `click
|
||||
here. <http://bugzilla.mozilla.org/buglist.cgi?bug_status=UNCONFIRMED&bug_status=NEW&bug_status=ASSIGNED&bug_status=REOPENED&&product=JSS>`__
|
||||
Note that some bugs may have been fixed since JSS 4.3.1 was released.
|
||||
|
||||
`Compatibility <#compatibility>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
- JSS 4.3.1 is backwards compatible with JSS 4.2. Applications compiled against JSS 4.2 will
|
||||
work with JSS 4.3.1.
|
||||
- The 4.3.1 version of libjss4.so/jss4.dll must only be used with jss4.jar. In general, a JSS
|
||||
JAR file must be used with the JSS shared library from the exact same release.
|
||||
- To obtain the version info from the jar file use,
|
||||
"System.out.println(org.mozilla.jss.CryptoManager.JAR_JSS_VERSION)" and to check the shared
|
||||
library: strings libjss4.so \| grep -i header
|
||||
|
||||
`Feedback <#feedback>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
- Bugs discovered should be reported by filing a bug report with
|
||||
`bugzilla <http://bugzilla.mozilla.org/enter_bug.cgi?product=JSS>`__.
|
||||
- You can also give feedback directly to the developers on the Mozilla Cryptography forums...
|
||||
|
||||
- `Mailing list <https://lists.mozilla.org/listinfo/dev-tech-crypto>`__
|
||||
- `Newsgroup <http://groups.google.com/group/mozilla.dev.tech.crypto>`__
|
||||
- `RSS feed <http://groups.google.com/group/mozilla.dev.tech.crypto/feeds>`__
|
||||
|
|
@ -1,175 +0,0 @@
|
|||
.. _mozilla_projects_nss_jss_4_3_releasenotes:
|
||||
|
||||
4.3 Release Notes
|
||||
=================
|
||||
|
||||
.. _release_date_01_april_2009:
|
||||
|
||||
`Release Date: 01 April 2009 <#release_date_01_april_2009>`__
|
||||
-------------------------------------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
`Introduction <#introduction>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
Network Security Services for Java (JSS) 4.3 is a minor release with the following new features:
|
||||
|
||||
- SQLite-Based Shareable Certificate and Key Databases
|
||||
- libpkix: an RFC 3280 Compliant Certificate Path Validation Library
|
||||
- PKCS11 needsLogin method
|
||||
- support HmacSHA256, HmacSHA384, and HmacSHA512
|
||||
- support for all NSS 3.12 initialization options
|
||||
|
||||
JSS 4.3 is `tri-licensed <https://www.mozilla.org/MPL>`__ under MPL 1.1/GPL 2.0/LGPL 2.1.
|
||||
|
||||
.. _new_in_jss_4.3:
|
||||
|
||||
`New in JSS 4.3 <#new_in_jss_4.3>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
A list of bug fixes and enhancement requests were implemented in this release can be obtained by
|
||||
running this `bugzilla
|
||||
query <http://bugzilla.mozilla.org/buglist.cgi?product=JSS&target_milestone=4.2.5&target_milestone=4.3&bug_status=RESOLVED&resolution=FIXED>`__
|
||||
|
||||
**JSS 4.3 requires**\ `NSS
|
||||
3.12 <https://www.mozilla.org/projects/security/pki/nss/nss-3.12/nss-3.12-release-notes.html>`__\ **or
|
||||
higher.**
|
||||
|
||||
- New `SQLite-Based Shareable Certificate and Key
|
||||
Databases <https://wiki.mozilla.org/NSS_Shared_DB>`__ by prepending the string "sql:" to the
|
||||
directory path passed to configdir parameter for Crypomanager.initialize method or using the
|
||||
NSS environment variable :ref:`mozilla_projects_nss_reference_nss_environment_variables`.
|
||||
- Libpkix: an RFC 3280 Compliant Certificate Path Validation Library (see
|
||||
`PKIXVerify <http://mxr.mozilla.org/mozilla/ident?i=PKIXVerify>`__)
|
||||
- PK11Token.needsLogin method (see needsLogin)
|
||||
- support HmacSHA256, HmacSHA384, and HmacSHA512 (see
|
||||
`HMACTest.java <http://mxr.mozilla.org/mozilla/source/security/jss/org/mozilla/jss/tests/HMACTest.java>`__)
|
||||
- support for all NSS 3.12 initialization options (see InitializationValues)
|
||||
- New SSL error codes (see https://mxr.mozilla.org/security/sour...util/SSLerrs.h)
|
||||
|
||||
- SSL_ERROR_UNSUPPORTED_EXTENSION_ALERT
|
||||
SSL_ERROR_CERTIFICATE_UNOBTAINABLE_ALERT
|
||||
SSL_ERROR_UNRECOGNIZED_NAME_ALERT
|
||||
SSL_ERROR_BAD_CERT_STATUS_RESPONSE_ALERT
|
||||
SSL_ERROR_BAD_CERT_HASH_VALUE_ALERT
|
||||
|
||||
- New TLS cipher suites (see https://mxr.mozilla.org/security/sour...SSLSocket.java):
|
||||
|
||||
- TLS_RSA_WITH_CAMELLIA_128_CBC_SHA
|
||||
TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA
|
||||
TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA
|
||||
TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
|
||||
TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA
|
||||
TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA
|
||||
|
||||
- Note: the following TLS cipher suites are declared but are not yet implemented:
|
||||
|
||||
- TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA
|
||||
TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA
|
||||
TLS_DH_ANON_WITH_CAMELLIA_128_CBC_SHA
|
||||
TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA
|
||||
TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA
|
||||
TLS_DH_ANON_WITH_CAMELLIA_256_CBC_SHA
|
||||
TLS_ECDH_anon_WITH_NULL_SHA
|
||||
TLS_ECDH_anon_WITH_RC4_128_SHA
|
||||
TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA
|
||||
TLS_ECDH_anon_WITH_AES_128_CBC_SHA
|
||||
TLS_ECDH_anon_WITH_AES_256_CBC_SHA
|
||||
|
||||
.. _distribution_information:
|
||||
|
||||
`Distribution Information <#distribution_information>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
- JSS is checked into ``mozilla/security/jss/``.
|
||||
- The CVS tag for the JSS 4.3 release is ``JSS_4_3_RTM``.
|
||||
- Source tarballs are available from
|
||||
https://archive.mozilla.org/pub/security/jss/releases/JSS_4_3_RTM/src/jss-4.3.tar.bz2
|
||||
- Binary releases are no longer available on mozilla. JSS is a JNI library we provide the
|
||||
jss4.jar but expect you to build the JSS's matching JNI shared library. We provide the
|
||||
jss4.jar in case you do not want to obtain your own JCE code signing certificate. JSS is a
|
||||
JCE provider and therefore the jss4.jar must be signed.
|
||||
https://archive.mozilla.org/pub/security/jss/releases/JSS_4_3_RTM/
|
||||
|
||||
--------------
|
||||
|
||||
`Documentation <#documentation>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
Documentation for JSS 4.3 is available as follows:
|
||||
|
||||
- `Build Instructions for JSS 4.3 </jss_build_4.3.html>`__
|
||||
- Javadoc `[online] </javadoc>`__
|
||||
`[zipped] <ftp://ftp.mozilla.org/pub/mozilla.org/security/jss/releases/JSS_4_3_RTM/doc/JSS_4_3_RTM-doc.zip>`__
|
||||
- Read the instructions on `using JSS </using_jss.html>`__.
|
||||
- Source may be viewed with a browser (via the MXR tool) at
|
||||
http://mxr.mozilla.org/mozilla/source/security/jss/
|
||||
- The RUN TIME behavior of JSS can be affected by the
|
||||
:ref:`mozilla_projects_nss_reference_nss_environment_variables`.
|
||||
|
||||
.. _platform_information:
|
||||
|
||||
`Platform Information <#platform_information>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
- JSS 4.3 works with JDK versions 4 or higher we suggest the latest.
|
||||
- JSS 4.3 requires `NSS
|
||||
3.12 <https://www.mozilla.org/projects/security/pki/nss/nss-3.12/nss-3.12-release-notes.html>`__
|
||||
or higher.
|
||||
- JSS 4.3 requires `NSPR 4.7.1 <https://www.mozilla.org/projects/nspr/release-notes/>`__ or
|
||||
higher.
|
||||
- JSS only supports the native threading model (no green threads).
|
||||
|
||||
--------------
|
||||
|
||||
.. _known_bugs_and_issues:
|
||||
|
||||
`Known Bugs and Issues <#known_bugs_and_issues>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
- For a list of reported bugs that have not yet been fixed, `click
|
||||
here. <http://bugzilla.mozilla.org/buglist.cgi?bug_status=UNCONFIRMED&bug_status=NEW&bug_status=ASSIGNED&bug_status=REOPENED&&product=JSS>`__
|
||||
Note that some bugs may have been fixed since JSS 4.3 was released.
|
||||
|
||||
--------------
|
||||
|
||||
`Compatibility <#compatibility>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
- JSS 4.3 is backwards compatible with JSS 4.2. Applications compiled against JSS 4.2 will work
|
||||
with JSS 4.3.
|
||||
- The 4.3 version of libjss4.so/jss4.dll must only be used with jss4.jar. In general, a JSS JAR
|
||||
file must be used with the JSS shared library from the exact same release.
|
||||
- To obtain the version info from the jar file use,
|
||||
"System.out.println(org.mozilla.jss.CryptoManager.JAR_JSS_VERSION)" and to check the shared
|
||||
library: strings libjss4.so \| grep -i header
|
||||
|
||||
--------------
|
||||
|
||||
`Feedback <#feedback>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
- Bugs discovered should be reported by filing a bug report with
|
||||
`bugzilla <http://bugzilla.mozilla.org/enter_bug.cgi?product=JSS>`__.
|
||||
- You can also give feedback directly to the developers on the Mozilla Cryptography forums...
|
||||
|
||||
- `Mailing list <https://lists.mozilla.org/listinfo/dev-tech-crypto>`__
|
||||
- `Newsgroup <http://groups.google.com/group/mozilla.dev.tech.crypto>`__
|
||||
- `RSS feed <http://groups.google.com/group/mozilla.dev.tech.crypto/feeds>`__
|
||||
|
|
@ -1,99 +0,0 @@
|
|||
.. _mozilla_projects_nss_jss_build_instructions_for_jss_4_3_x:
|
||||
|
||||
Build instructions for JSS 4.3.x
|
||||
================================
|
||||
|
||||
.. _build_instructions_for_jss_4.3.x:
|
||||
|
||||
`Build Instructions for JSS 4.3.x <#build_instructions_for_jss_4.3.x>`__
|
||||
------------------------------------------------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
Newsgroup: `mozilla.dev.tech.crypto <news://news.mozilla.org/mozilla.dev.tech.crypto>`__
|
||||
|
||||
Before building JSS, you need to set up your system as follows:
|
||||
|
||||
#. Build NSPR/NSS by following the
|
||||
:ref:`mozilla_projects_nss_reference_building_and_installing_nss_build_instructions`,
|
||||
#. To check that NSS built correctly, run ``all.sh`` (in ``mozilla/security/nss/tests``) and
|
||||
examine the results (in
|
||||
``mozilla/test_results/security/``\ *computername*.#\ ``/results.html``.
|
||||
#. Install a Java compiler and runtime. JSS supports Java version 1.5 or later. We suggest you
|
||||
use the latest.
|
||||
#. You must have Perl version 5.005 or later.
|
||||
|
||||
Now you are ready to build JSS. Follow these steps:
|
||||
|
||||
#. Switch to the appropriate directory and check out JSS from the root of your source tree.
|
||||
|
||||
.. code::
|
||||
|
||||
cvs co -r JSS_4_3_1_RTM mozilla/security/jss
|
||||
|
||||
or
|
||||
|
||||
.. code::
|
||||
|
||||
cvs co -r JSS_4_3_RTM mozilla/security/jss
|
||||
|
||||
#. Setup environment variables needed for compiling Java source. The ``JAVA_HOME`` variable
|
||||
indicates the directory containing your Java SDK installation. Note, on Windows platforms it
|
||||
is best to have JAVA_HOME set to a directory path that doest not have spaces.
|
||||
|
||||
**Unix**
|
||||
|
||||
.. code::
|
||||
|
||||
setenv JAVA_HOME /usr/local/jdk1.5.0 (or wherever your JDK is installed)
|
||||
|
||||
**Windows**
|
||||
|
||||
.. code::
|
||||
|
||||
set JAVA_HOME=c:\programs\jdk1.5.0 (or wherever your JDK is installed)
|
||||
|
||||
**Windows (Cygnus)**
|
||||
|
||||
.. code::
|
||||
|
||||
JAVA_HOME=/cygdrive/c/programs/jdk1.5.0 (or wherever your JDK is installed)
|
||||
export JAVA_HOME
|
||||
|
||||
| **Windows build Configurations WINNT vs WIN95**
|
||||
|
||||
.. code::
|
||||
|
||||
As of NSS 3.15.4, NSPR/NSS/JSS build generates a "WIN95" configuration by default on Windows.
|
||||
We recommend most applications use the "WIN95" configuration. If you want JSS to be used
|
||||
with your applet and the Firefox browser than you must build WIN95. (See JSS FAQ)
|
||||
The "WIN95" configuration supports all versions of Windows. The "WIN95" name is historical;
|
||||
it should have been named "WIN32".
|
||||
To generate a "WINNT" configuration, set OS_TARGET=WINNT and build NSPR/NSS/JSS WIN95.
|
||||
|
||||
| Mac OS X
|
||||
| It has been recently reported that special build instructions are necessary to succeed
|
||||
building JSS on OSX. Please
|
||||
see `HOWTO_successfully_compile_JSS_and_NSS_for_32_and_64_bits_on_OSX_10.6_(10.6.7) </HOWTO_successfully_compile_JSS_and_NSS_for_32_and_64_bits_on_OSX_10.6_(10.6.7)>`__
|
||||
for contributed instructions.
|
||||
|
|
||||
|
||||
#. Build JSS.
|
||||
|
||||
.. code::
|
||||
|
||||
cd mozilla/security/jss
|
||||
gmake
|
||||
|
||||
#. Sign the JSS jar.
|
||||
|
||||
.. code::
|
||||
|
||||
If you're intention is to modify and build the JSS source you
|
||||
need to Apply for your own JCE code-signing certificate
|
||||
|
||||
If you made no changes and your goal is to build JSS you can use the
|
||||
signed binary release of the jss4.jar from ftp.mozilla.org.
|
||||
with your built jss4 JNI shared library.
|
||||
|
||||
Next, you should read the instructions on `using JSS <Using_JSS>`__.
|
||||
|
|
@ -1,19 +0,0 @@
|
|||
.. _mozilla_projects_nss_jss_build_instructions_for_jss_4_4_x:
|
||||
|
||||
Build instructions for JSS 4.4.x
|
||||
================================
|
||||
|
||||
.. _build_instructions_for_jss_4.4.x:
|
||||
|
||||
`Build Instructions for JSS 4.4.x <#build_instructions_for_jss_4.4.x>`__
|
||||
------------------------------------------------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
Newsgroup: `mozilla.dev.tech.crypto <news://news.mozilla.org/mozilla.dev.tech.crypto>`__
|
||||
|
||||
To build JSS see `Upstream JSS Build/Test
|
||||
Instructions <https://hg.mozilla.org/projects/jss/file/tip/README>`__
|
||||
|
||||
`Next, you should read the instructions
|
||||
on <https://hg.mozilla.org/projects/jss/file/tip/README>`__ `using JSS <Using_JSS>`__.
|
||||
|
|
@ -1,165 +0,0 @@
|
|||
.. _mozilla_projects_nss_jss:
|
||||
|
||||
JSS
|
||||
===
|
||||
|
||||
`Documentation <#documentation>`__
|
||||
----------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
.. warning::
|
||||
|
||||
**The JSS project has been relocated!**
|
||||
|
||||
As of April 6, 2018, JSS has been migrated from Mercurial on Mozilla to Git on Github.
|
||||
|
||||
JSS source should now be checked out from the Github:
|
||||
|
||||
- git clone git@github.com:dogtagpki/jss.git
|
||||
-- OR --
|
||||
- git clone https://github.com/dogtagpki/jss.git
|
||||
|
||||
All future upstream enquiries to JSS should now use the Pagure Issue Tracker system:
|
||||
|
||||
- https://pagure.io/jss/issues
|
||||
|
||||
Documentation regarding the JSS project should now be viewed at:
|
||||
|
||||
- http://www.dogtagpki.org/wiki/JSS
|
||||
|
||||
**NOTE: As much of the JSS documentation is sorely out-of-date, updated information will be a
|
||||
work in progress, and many portions of any legacy documentation will be re-written over the
|
||||
course of time. Stay tuned!**
|
||||
|
||||
Legacy JSS information can still be found at:
|
||||
|
||||
- SOURCE: https://hg.mozilla.org/projects/jss
|
||||
- ISSUES: https://bugzilla.mozilla.org/buglist.cgi?product=JSS
|
||||
- WIKI: :ref:`mozilla_projects_nss_jss`
|
||||
|
||||
Network Security Services for Java (JSS) is a Java interface to
|
||||
`NSS <https://developer.mozilla.org/en-US/docs/NSS>`__. JSS supports most of the security
|
||||
standards and encryption technologies supported by :ref:`mozilla_projects_nss_reference`. JSS
|
||||
also provides a pure Java interface for ASN.1 types and BER/DER encoding.
|
||||
|
||||
JSS offers a implementation of Java SSL sockets that uses NSS's SSL/TLS implementation rather
|
||||
than Sun's JSSE implementation. You might want to use JSS's own `SSL
|
||||
classes <ftp://ftp.mozilla.org/pub/mozilla.org/security/jss/releases>`__ if you want to use some
|
||||
of the capabilities found in NSS's SSL/TLS library but not found in JSSE.
|
||||
|
||||
NSS is the cryptographic module where all cryptographic operations are performed. JSS essentially
|
||||
provides a Java JNI bridge to NSS C shared libraries. When NSS is put in FIPS mode, JSS ensures
|
||||
FIPS compliance by ensuring that all cryptographic operations are performed by the NSS
|
||||
cryptographic module.
|
||||
|
||||
JSS offers a JCE provider, `"Mozilla-JSS" JCA Provider notes <JSS/JSS_Provider_Notes>`__.
|
||||
|
||||
JSS, jss4.jar, is still built with JDK 1.4.2. While JDK 1.4.2 is EOL'd and all new product
|
||||
development should be using the latest
|
||||
`JavaSE <http://java.sun.com/javase/downloads/index.jsp>`__, legacy business products that must
|
||||
use JDK 1.4 or 1.5 can continue to add NSS/JSS security fixes/enhancements.
|
||||
|
||||
JSS is used by Red Hat and Sun products that do crypto in Java. JSS is available under the
|
||||
Mozilla Public License, the GNU General Public License, and the GNU Lesser General Public
|
||||
License. JSS requires `NSPR <https://developer.mozilla.org/en-US/docs/NSPR>`__ and
|
||||
`NSS <https://developer.mozilla.org/en-US/docs/NSS>`__.
|
||||
|
||||
Java provides a JCE provider called SunPKCS11 (see `Java PKCS#11 Reference
|
||||
Guide <http://download.java.net/jdk7/docs/technotes/guides/security/p11guide.html>`__.) SunPKCS11
|
||||
can be configured to use the NSS module as the crytographic provider. If you are planning to just
|
||||
use JSS JCE provider as a bridge to NSS's FIPS validated PKCS#11 module, then the SunPKCS11 JCE
|
||||
provider may do all that you need. Note that Java 1.5 claimed no FIPS compliance, and `Java
|
||||
1.6 <http://java.sun.com/javase/6/docs/technotes/guides/security/enhancements.html>`__ or higher
|
||||
needs to be used. A current limitation to the configured SunPKCS11-NSS bridge configuration is if
|
||||
you add a PKCS#11 module to the NSS database such as for a smartcard, you won't be able to access
|
||||
that smartcard through the SunPKCS11-NSS bridge. If you use JSS, you can easily get lists of
|
||||
modules and tokens that are configured in the NSS DB and freely access all of it.
|
||||
|
||||
+-------------------------------------------------+-------------------------------------------------+
|
||||
| Before you use JSS, you should have a good | .. rubric:: Community |
|
||||
| understanding of the crypto technologies it | :name: Community |
|
||||
| uses. You might want to read these documents: | |
|
||||
| | - View Mozilla Cryptography forums... |
|
||||
| - `Introduction to Public-Key | |
|
||||
| Crypt | - `Mailing |
|
||||
| ography <https://developer.mozilla.org/en-US/do | list <https:/ |
|
||||
| cs/Introduction_to_Public-Key_Cryptography>`__. | /lists.mozilla.org/listinfo/dev-tech-crypto>`__ |
|
||||
| Explains the basic concepts of public-key | - `Newsgroup <http://grou |
|
||||
| cryptography that underlie NSS and JSS. | ps.google.com/group/mozilla.dev.tech.crypto>`__ |
|
||||
| - `Introduction to | - `RSS |
|
||||
| SSL <https://developer. | feed <http://groups.goo |
|
||||
| mozilla.org/en-US/docs/Introduction_to_SSL>`__. | gle.com/group/mozilla.dev.tech.crypto/feeds>`__ |
|
||||
| Introduces the SSL protocol, including | |
|
||||
| information about cryptographic ciphers | .. rubric:: Related Topics |
|
||||
| supported by SSL and the steps involved in | :name: Related_Topics |
|
||||
| the SSL handshake. | |
|
||||
| | - `Security <https: |
|
||||
| For information on downloading NSS releases, | //developer.mozilla.org/en-US/docs/Security>`__ |
|
||||
| see `NSS sources building | |
|
||||
| testing <NSS_Sources_Building_Te | |
|
||||
| sting>`__\ `. <NSS_Sources_Building_Testing>`__ | |
|
||||
| | |
|
||||
| Read `Using JSS <JSS/Using_JSS>`__ to get you | |
|
||||
| started with development after you've built and | |
|
||||
| downloaded it. | |
|
||||
| | |
|
||||
| .. rubric:: Release Notes | |
|
||||
| :name: Release_Notes | |
|
||||
| | |
|
||||
| - `4.3.1 Release | |
|
||||
| Notes </4.3.1_Release_Notes>`__ | |
|
||||
| - `4.3 Release | |
|
||||
| Notes <https://developer. | |
|
||||
| mozilla.org/en-US/docs/JSS/4_3_ReleaseNotes>`__ | |
|
||||
| - `Older Release | |
|
||||
| Notes <http://www-archive.mozil | |
|
||||
| la.org/projects/security/pki/jss/index.html>`__ | |
|
||||
| | |
|
||||
| .. rubric:: Build Instructions | |
|
||||
| :name: Build_Instructions | |
|
||||
| | |
|
||||
| - :re | |
|
||||
| f:`mozilla_projects_nss_jss_build_instructions_ | |
|
||||
| for_jss_4_4_x#build_instructions_for_jss_4_4_x` | |
|
||||
| - `Building JSS | |
|
||||
| 4.3.x <https://developer.mozilla.org/en-U | |
|
||||
| S/docs/JSS/Build_instructions_for_JSS_4.3.x>`__ | |
|
||||
| - `Older Build | |
|
||||
| Instructions <http://www-archive.mozil | |
|
||||
| la.org/projects/security/pki/jss/index.html>`__ | |
|
||||
| | |
|
||||
| .. rubric:: Download or View Source | |
|
||||
| :name: Download_or_View_Source | |
|
||||
| | |
|
||||
| - `Download binaries, source, and | |
|
||||
| javadoc <ftp://ftp.mozilla | |
|
||||
| .org/pub/mozilla.org/security/jss/releases/>`__ | |
|
||||
| - `View the source | |
|
||||
| online <http://m | |
|
||||
| xr.mozilla.org/mozilla/source/security/jss/>`__ | |
|
||||
| | |
|
||||
| .. rubric:: Testing | |
|
||||
| :name: Testing | |
|
||||
| | |
|
||||
| - `JSS | |
|
||||
| tests <https:// | |
|
||||
| hg.mozilla.org/projects/jss/file/tip/README>`__ | |
|
||||
| | |
|
||||
| .. rubric:: Frequently Asked Questions | |
|
||||
| :name: Frequently_Asked_Questions | |
|
||||
| | |
|
||||
| - `JSS FAQ <JSS/JSS_FAQ>`__ | |
|
||||
| | |
|
||||
| Information on JSS planning can be found at | |
|
||||
| `wik | |
|
||||
| i.mozilla.org <http://wiki.mozilla.org/NSS>`__, | |
|
||||
| including: | |
|
||||
| | |
|
||||
| - `NSS FIPS | |
|
||||
| Validati | |
|
||||
| on <http://wiki.mozilla.org/FIPS_Validation>`__ | |
|
||||
| - `NSS Roadmap | |
|
||||
| | |
|
||||
| page <http://wiki.mozilla.org/NSS:Roadmap>`__ | |
|
||||
+-------------------------------------------------+-------------------------------------------------+
|
||||
|
|
@ -1,217 +0,0 @@
|
|||
.. _mozilla_projects_nss_jss_jss_faq:
|
||||
|
||||
JSS FAQ
|
||||
=======
|
||||
|
||||
.. _jss_frequently_asked_questions:
|
||||
|
||||
`JSS Frequently Asked Questions <#jss_frequently_asked_questions>`__
|
||||
--------------------------------------------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
Newsgroup: `mozilla.dev.tech.crypto <news://news.mozilla.org:119/mozilla.dev.tech.crypto>`__
|
||||
|
||||
**Content:**
|
||||
|
||||
- `What versions of JDK and JCE do you suggest? <#jdkjce1>`__
|
||||
- `Does JSS have 64 bit support? <#64bit>`__
|
||||
- `Is JSS FIPS Compliant? <#fips>`__
|
||||
- `Is there any sample code and documentation? <#sample>`__
|
||||
- `If I don't call setCipherPolicy, is the DOMESTIC policy used by
|
||||
default? <#setcipherpolicy>`__
|
||||
- `My SSL connection is hanging on Windows? <#ssl_hanging>`__
|
||||
- `How can I tell which SSL/TLS ciphers JSS supports? <#ssltls_cipher>`__
|
||||
- `How can I debug my SSL connection? <#ssl_debug>`__
|
||||
- `Can you explain JSS SSL certificate approval callbacks? <#ssl_callback>`__
|
||||
- `Can I have multiple JSS instances reading separate db's? <#jss_instance>`__
|
||||
- `Once JSS initialized, I can't get anymore instances with
|
||||
CertificateFactory.getInstance(X.509)? <#jss_init>`__
|
||||
- `Is it possible to sign data in Java with JSS? <#sign_date>`__
|
||||
- `How do I convert org.mozilla.jss.crypto.X509Certificate to
|
||||
org.mozilla.jss.pkix.cert.Certificate? <#convertx509>`__
|
||||
- `How do I convert org.mozilla.jss.pkix.cert to
|
||||
org.mozilla.jss.crypto.X509Certificate? <#convertpkix>`__
|
||||
- `Is it possible to use JSS to access cipher functionality from pkcs11 modules? <#pkc11>`__
|
||||
- `Can you explain token names and keys with regards to JSS? <#token_name>`__
|
||||
- `JSS 3.2 has JCA support. When will JSS have JSSE support? <#jssjsse>`__
|
||||
|
||||
**What versions of JDK and JRE do you suggest?**
|
||||
|
||||
- JSS 3.x works with JDK versions 1.2 or higher, except version 1.3.0. Most attention for future
|
||||
development and bug fixing will go to JDK 1.4 and later, so use that if you can. If you are
|
||||
using JDK 1.3.x, you will need to use at least version 1.3.1--see `bug
|
||||
113808 <http://bugzilla.mozilla.org/show_bug.cgi?id=113808>`__. JSS only supports the native
|
||||
threading model (no green threads). For JSS 3.2 and higher, if you use JDK 1.4 or higher you
|
||||
will not need to install the JCE, but if you using an earlier version of the JDK then you will
|
||||
also have to install JCE 1.2.1. See also the document `Using JSS <Using_JSS>`__.
|
||||
|
||||
**Does JSS have 64 bit support?**
|
||||
|
||||
- Yes, JSS 3.2 and higher supports 64 bit. You will need JDK 1.4 or higher and all the 64 bit
|
||||
versions of NSPR, and NSS. As well you must use the java flag -d64 to specify the 64-bit data
|
||||
model.
|
||||
|
||||
**Is JSS FIPS Compliant?**
|
||||
|
||||
- NSS is a FIPS-certified software library. JSS is considered a FIPS-compliant software library
|
||||
since it only uses NSS for any and all crypto routines.
|
||||
|
||||
**Is there any sample code and documentation?**
|
||||
|
||||
- The `Using JSS <Using_JSS>`__ document describes how to set up your environment to run JSS.
|
||||
The only other documentation is the
|
||||
`Javadoc <ftp://ftp.mozilla.org/pub/mozilla.org/security/jss/releases/JSS_4_3_RTM/doc/JSS_4_3_RTM-doc.zip>`__.
|
||||
|
||||
JSS example code is essentially developer test code; with that understanding, the best
|
||||
directory to look for sample code is in the org/mozilla/jss/tests directory:
|
||||
|
||||
http://lxr.mozilla.org/mozilla/source/security/jss/org/mozilla/jss/tests
|
||||
|
||||
| `org/mozilla/jss/tests/CloseDBs.java <http://lxr.mozilla.org/security/source/security/jss/org/mozilla/jss/tests/CloseDBs.java#47>`__
|
||||
| `org/mozilla/jss/tests/KeyFactoryTest.java <http://lxr.mozilla.org/security/source/security/jss/org/mozilla/jss/tests/KeyFactoryTest.java#81>`__
|
||||
| `org/mozilla/jss/tests/DigestTest.java <http://lxr.mozilla.org/security/source/security/jss/org/mozilla/jss/tests/DigestTest.java#44>`__
|
||||
| `org/mozilla/jss/tests/JCASigTest.java <http://lxr.mozilla.org/security/source/security/jss/org/mozilla/jss/tests/JCASigTest.java#50>`__
|
||||
| `org/mozilla/jss/tests/KeyWrapping.java <http://lxr.mozilla.org/security/source/security/jss/org/mozilla/jss/tests/KeyWrapping.java#45>`__
|
||||
| `org/mozilla/jss/tests/ListCerts.java <http://lxr.mozilla.org/security/source/security/jss/org/mozilla/jss/tests/ListCerts.java#40>`__
|
||||
| `org/mozilla/jss/tests/PK10Gen.java <http://lxr.mozilla.org/security/source/security/jss/org/mozilla/jss/tests/PK10Gen.java#43>`__
|
||||
| `org/mozilla/jss/tests/SDR.java <http://lxr.mozilla.org/security/source/security/jss/org/mozilla/jss/tests/SDR.java#47>`__
|
||||
| `org/mozilla/jss/tests/SelfTest.java <http://lxr.mozilla.org/security/source/security/jss/org/mozilla/jss/tests/SelfTest.java#46>`__
|
||||
| `org/mozilla/jss/tests/SetupDBs.java <http://lxr.mozilla.org/security/source/security/jss/org/mozilla/jss/tests/SetupDBs.java#42>`__
|
||||
| `org/mozilla/jss/tests/SigTest.java <http://lxr.mozilla.org/security/source/security/jss/org/mozilla/jss/tests/SigTest.java#64>`__
|
||||
| `org/mozilla/jss/tests/SymKeyGen.java <http://lxr.mozilla.org/security/source/security/jss/org/mozilla/jss/tests/SymKeyGen.java#44>`__
|
||||
| `org/mozilla/jss/tests/TestKeyGen.java <http://lxr.mozilla.org/security/source/security/jss/org/mozilla/jss/tests/TestKeyGen.java#64>`__
|
||||
| `org/mozilla/jss/tests/SSLClientAuth.java <http://lxr.mozilla.org/security/source/security/jss/org/mozilla/jss/tests/SSLClientAuth.java#99>`__
|
||||
| `org/mozilla/jss/tests/ListCACerts.java <http://lxr.mozilla.org/security/source/security/jss/org/mozilla/jss/tests/ListCACerts.java#8>`__
|
||||
| `org/mozilla/jss/tests/KeyStoreTest.java <http://lxr.mozilla.org/security/source/security/jss/org/mozilla/jss/tests/KeyStoreTest.java#68>`__
|
||||
| `org/mozilla/jss/tests/VerifyCert.java <http://lxr.mozilla.org/security/source/security/jss/org/mozilla/jss/tests/VerifyCert.java#86>`__
|
||||
|
||||
SSL examples:
|
||||
|
||||
| `org/mozilla/jss/tests/SSLClientAuth.java <http://lxr.mozilla.org/mozilla/source/security/jss/org/mozilla/jss/tests/SSLClientAuth.java>`__
|
||||
| `org/mozilla/jss/ssl/SSLClient.java <http://lxr.mozilla.org/mozilla/source/security/jss/org/mozilla/jss/ssl/SSLClient.java>`__
|
||||
| `org/mozilla/jss/ssl/SSLServer.java <http://lxr.mozilla.org/mozilla/source/security/jss/org/mozilla/jss/ssl/SSLServer.java>`__
|
||||
| `org/mozilla/jss/ssl/SSLTest.java <http://lxr.mozilla.org/mozilla/source/security/jss/org/mozilla/jss/ssl/SSLTest.java>`__
|
||||
|
||||
Other test code that may prove useful:
|
||||
|
||||
| `org/mozilla/jss/asn1/INTEGER.java <http://lxr.mozilla.org/security/source/security/jss/org/mozilla/jss/asn1/INTEGER.java#131>`__
|
||||
| `org/mozilla/jss/asn1/SEQUENCE.java <http://lxr.mozilla.org/security/source/security/jss/org/mozilla/jss/asn1/SEQUENCE.java#574>`__
|
||||
| `org/mozilla/jss/asn1/SET.java <http://lxr.mozilla.org/security/source/security/jss/org/mozilla/jss/asn1/SET.java#876>`__
|
||||
| `org/mozilla/jss/pkcs10/CertificationRequest.java <http://lxr.mozilla.org/security/source/security/jss/org/mozilla/jss/pkcs10/CertificationRequest.java#269>`__
|
||||
| `org/mozilla/jss/pkcs12/PFX.java <http://lxr.mozilla.org/security/source/security/jss/org/mozilla/jss/pkcs12/PFX.java#329>`__
|
||||
| `org/mozilla/jss/pkix/cert/Certificate.java <http://lxr.mozilla.org/security/source/security/jss/org/mozilla/jss/pkix/cert/Certificate.java#279>`__
|
||||
| `org/mozilla/jss/pkix/cmmf/CertRepContent.java <http://lxr.mozilla.org/security/source/security/jss/org/mozilla/jss/pkix/cmmf/CertRepContent.java#148>`__
|
||||
| `org/mozilla/jss/pkix/crmf/CertReqMsg.java <http://lxr.mozilla.org/security/source/security/jss/org/mozilla/jss/pkix/crmf/CertReqMsg.java#265>`__
|
||||
| `org/mozilla/jss/pkix/crmf/CertTemplate.java <http://lxr.mozilla.org/security/source/security/jss/org/mozilla/jss/pkix/crmf/CertTemplate.java#530>`__
|
||||
| `org/mozilla/jss/pkix/primitive/Name.java <http://lxr.mozilla.org/security/source/security/jss/org/mozilla/jss/pkix/primitive/Name.java#276>`__
|
||||
| `org/mozilla/jss/provider/javax/crypto/JSSSecretKeyFactorySpi.java <http://lxr.mozilla.org/security/source/security/jss/org/mozilla/jss/provider/javax/crypto/JSSSecretKeyFactorySpi.java#287>`__
|
||||
| `org/mozilla/jss/util/UTF8Converter.java <http://lxr.mozilla.org/security/source/security/jss/org/mozilla/jss/util/UTF8Converter.java#302>`__
|
||||
| `org/mozilla/jss/util/Base64InputStream.java <http://lxr.mozilla.org/security/source/security/jss/org/mozilla/jss/util/Base64InputStream.java#237>`__
|
||||
| `jss/samples/PQGGen.java <http://lxr.mozilla.org/security/source/security/jss/samples/PQGGen.java#44>`__
|
||||
| `jss/samples/pkcs12.java <http://lxr.mozilla.org/security/source/security/jss/samples/pkcs12.java#57>`__
|
||||
|
||||
**If I don't call setCipherPolicy, is the DOMESTIC policy used by default?**
|
||||
|
||||
- Yes, domestic is the default because we call NSS_SetDomesticPolicy() during
|
||||
CryptoManager.initialize(). setCipherPolicy does not need to be called by a JSS app unless
|
||||
that app wants to limit itself to export-allowed cipher suites.
|
||||
|
||||
**My SSL connection is hanging on Windows?**
|
||||
|
||||
- NSPR makes use of NT vs. Windows distinction and provides different NT and Windows builds.
|
||||
Many Netscape products, including NSS, have NT and Windows builds that are essentially the
|
||||
same except one difference: one is linked with the NT version of NSPR and the other is linked
|
||||
with the Windows version of NSPR. The NT fiber problem affects applications that call blocking
|
||||
system calls from the primordial thread. Either use the WIN 95 version of NSPR/NSS/JSS
|
||||
components (essentially all non-fiber builds) or set the environment variable
|
||||
NSPR_NATIVE_THREADS_ONLY=1. You can find more information in bugzilla bug
|
||||
`102251 <http://bugzilla.mozilla.org/show_bug.cgi?id=102251>`__ SSL session cache locking
|
||||
issue with NT fibers
|
||||
|
||||
**How can I tell which SSL/TLS ciphers JSS supports?**
|
||||
|
||||
- Check
|
||||
http://lxr.mozilla.org/mozilla/source/security/jss/org/mozilla/jss/ssl/SSLSocket.java#730
|
||||
|
||||
**How can I debug my SSL connection?**
|
||||
|
||||
- By using the NSS tool :ref:`mozilla_projects_nss_tools_ssltap`
|
||||
|
||||
**Can you explain JSS SSL certificate approval callbacks?**
|
||||
|
||||
- NSS has three callbacks related to certificates. JSS has two. But JSS combines two of the NSS
|
||||
callbacks into one.
|
||||
|
||||
- NSS's three SSL cert callbacks are:
|
||||
|
||||
#. SSL_AuthCertificateHook sets a callback to authenticate the peer's certificate. It is
|
||||
called instead of NSS's routine for authenticating certificates.
|
||||
#. SSL_BadCertHook sets a callback that is called when NSS's routine fails to authenticate the
|
||||
certificate.
|
||||
#. SSL_GetClientAuthDataHook sets a callback to return the local certificate for SSL client
|
||||
auth.
|
||||
|
||||
JSS's two callbacks are:
|
||||
|
||||
#. SSLCertificateApprovalCallback is a combination of SSL_AuthCertificateHook and
|
||||
SSL_BadCertHook. It runs NSS's cert authentication check, then calls the callback
|
||||
regardless of whether the cert passed or failed. The callback is told whether the cert
|
||||
passed, and then can do anything extra that it wants to do before making a final decision.
|
||||
#. SSLClientCertificateSelectionCallback is analogous to SSL_GetClientAuthDataHook.
|
||||
|
||||
|
|
||||
| **Can I have multiple JSS instances reading separate db's?**
|
||||
|
||||
- No, you can only have one initialized instance of JSS for each database.
|
||||
|
||||
**Once JSS initialized, I can't get anymore instances with
|
||||
CertificateFactory.getInstance("X.509")?**
|
||||
|
||||
- In version previous to JSS 3.1, JSS removes the default SUN provider on startup. Upgrade to
|
||||
the latest JSS, or, in the ``CryptoManager.InitializationValues`` object you pass to
|
||||
``CryptoManager.initialize()``, set ``removeSunProivider=true``.
|
||||
|
||||
**Is it possible to sign data in Java with JSS? What I am trying to do is write a Java applet
|
||||
that will access the Netscape certificate store, retrieve a X509 certificate and then sign some
|
||||
data.**
|
||||
|
||||
- The best way to do this is with the PKCS #7 signedData type. Check out the
|
||||
`javadoc <ftp://ftp.mozilla.org/pub/mozilla.org/security/jss/releases/JSS_4_3_RTM/doc/JSS_4_3_RTM-doc.zip>`__.
|
||||
|
||||
**How do I convert org.mozilla.jss.crypto.X509Certificate to
|
||||
org.mozilla.jss.pkix.cert.Certificate?**
|
||||
|
||||
- .. code::
|
||||
|
||||
import java.io.ByteArrayInputStream;
|
||||
|
||||
[...]
|
||||
|
||||
Certificate cert = (Certificate) ASN1Util.decode(
|
||||
Certificate.getTemplate(),x509Cert.getEncoded() );
|
||||
|
||||
**How do I convert org.mozilla.jss.pkix.cert to org.mozilla.jss.crypto.X509Certificate?**
|
||||
|
||||
- `Cryptomanager.importCertPackage() <ftp://ftp.mozilla.org/pub/mozilla.org/security/jss/releases/JSS_4_3_RTM/doc/JSS_4_3_RTM-doc.zip>`__
|
||||
|
||||
**Is it possible to use JSS to acces cipher functionality from pkcs11 modules?**
|
||||
|
||||
- Yes. Before JSS 3.2 you would use CryptoManager to obtain the CryptoToken you want to use,
|
||||
then call CryptoToken.getCipherContext() to get an encryption engine. But as of JSS 3.2 you
|
||||
would use the `JSS JCA provider <JSS_Provider_Notes>`__.
|
||||
|
||||
**Can you explain token names and keys with regards to JSS?**
|
||||
|
||||
- The token name is different depending on which application you are running. In JSS, the token
|
||||
is called "Internal Key Storage Token". You can look it up by name using
|
||||
CryptoManager.getTokenByName(), but a better way is to call
|
||||
CryptoManager.getInternalKeyStorageToken(), which works no matter what the token is named. In
|
||||
general, a key is a handle to an underlying object on a PKCS #11 token, not merely a Java
|
||||
object residing in memory. Symmetric Key usage: basically encrypt/decrypt is for data and
|
||||
wrap/unwrap is for keys.
|
||||
|
||||
J\ **SS 3.2 has JCA support. When will JSS have JSSE support?**
|
||||
|
||||
- Not in the near future due to pluggability is disabled in the JSSE version included in J2SE
|
||||
1.4.x for export control reasons.
|
||||
|
|
@ -1,489 +0,0 @@
|
|||
.. _mozilla_projects_nss_jss_jss_provider_notes:
|
||||
|
||||
JSS Provider Notes
|
||||
==================
|
||||
|
||||
.. container::
|
||||
|
||||
.. warning::
|
||||
|
||||
This page has been moved to http://www.dogtagpki.org/wiki/JSS_Provider.
|
||||
|
||||
.. _the_mozilla-jss_jca_provider:
|
||||
|
||||
`The Mozilla-JSS JCA Provider <#the_mozilla-jss_jca_provider>`__
|
||||
----------------------------------------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
Newsgroup: `mozilla.dev.tech.crypto <news://news.mozilla.org/mozilla.dev.tech.crypto>`__
|
||||
|
||||
`Overview <#overview>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
This document describes the JCA Provider shipped with JSS. The provider's name is "Mozilla-JSS".
|
||||
It implements cryptographic operations in native code using the `NSS <../nss>`__ libraries.
|
||||
|
||||
`Contents <#contents>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
- `Signed JAR file <#signed-jar>`__
|
||||
- `Installing the Provider <#installing-provider>`__
|
||||
- `Specifying the CryptoToken <#specifying-token>`__
|
||||
- `Supported Classes <#supported-classes>`__
|
||||
- `What's Not Supported <#not-supported>`__
|
||||
|
||||
--------------
|
||||
|
||||
.. _signed_jar_file:
|
||||
|
||||
`Signed JAR file <#signed_jar_file>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
- JSS 3.2 implements several JCE (Java Cryptography Extension) algorithms. These algorithms have
|
||||
at various times been export-controlled by the US government. Sun therefore requires that JAR
|
||||
files implementing JCE algorithms be digitally signed by an approved organization. Netscape
|
||||
has this approval and signs the official builds of ``jss32.jar``. At runtime, the JRE
|
||||
automatically verifies this signature whenever a JSS class is loaded that implements a JCE
|
||||
algorithm. The verification is transparent to the application (unless it fails and throws an
|
||||
exception). If you are curious, you can verify the signature on the JAR file using the
|
||||
``jarsigner`` tool, which is distributed with the JDK.
|
||||
|
||||
If you build JSS yourself from source instead of using binaries downloaded from mozilla.org,
|
||||
your JAR file will not have a valid signature. This means you will not be able to use the JSS
|
||||
provider for JCE algorithms. You have two choices.
|
||||
|
||||
#. Use the binary release of JSS from mozilla.org.
|
||||
#. Apply for your own JCE code-signing certificate following the procedure at `How to
|
||||
Implement a Provider for the Java\ TM Cryptography
|
||||
Extension <http://java.sun.com/javase/6/docs/technotes/guides/security/crypto/HowToImplAProvider.html#Step61>`__.
|
||||
Then you can sign your own JSS JAR file.
|
||||
|
||||
.. _installing_the_provider:
|
||||
|
||||
`Installing the Provider <#installing_the_provider>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
- In order to use any part of JSS, including the JCA provider, you must first call
|
||||
``CryptoManager.initialize()``. By default, the JCA provider will be installed in the list of
|
||||
providers maintained by the ``java.security.Security`` class. If you do not wish the provider
|
||||
to be installed, create a
|
||||
:ref:`mozilla_projects_nss_jss_cryptomanager_cryptomanager_initializationvalues` object, set
|
||||
its ``installJSSProvider`` field to ``false``, and pass the ``InitializationValues`` object to
|
||||
``CryptoManager.initialize()``.
|
||||
|
||||
.. _specifying_the_cryptotoken:
|
||||
|
||||
`Specifying the CryptoToken <#specifying_the_cryptotoken>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
- All cryptographic operations in JSS and NSS occur on a particular PKCS #11 token, implemented
|
||||
in software or hardware. There is no clean way to specify this token through the JCA API. By
|
||||
default, the JSS provider carries out all operations except MessageDigest on the Internal Key
|
||||
Storage Token, a software token included in JSS/NSS. MessageDigest operations take place by
|
||||
default on the Internal Crypto Token, another internal software token in JSS/NSS. There is no
|
||||
good design reason for this difference, but it is necessitated by a quirk in the NSS
|
||||
implementation.
|
||||
|
||||
In order to use a different token, use ``CryptoManager.setThreadToken()``. This sets the token
|
||||
to be used by the JSS JCA provider in the current thread. When you call ``getInstance()`` on a
|
||||
JCA class, the JSS provider checks the current per-thread default token (by calling
|
||||
``CryptoManager.getThreadToken()``) and instructs the new object to use that token for
|
||||
cryptographic operations. The per-thread default token setting is only consulted inside
|
||||
``getInstance()``. Once a JCA object has been created it will continue to use the same token,
|
||||
even if the application later changes the per-thread default token.
|
||||
|
||||
Whenever a new thread is created, its token is initialized to the default, the Internal Key
|
||||
Storage Token. Thus, the thread token is not inherited from the parent thread.
|
||||
|
||||
The following example shows how you can specify which token is used for various JCA
|
||||
operations:
|
||||
|
||||
.. code::
|
||||
|
||||
// Lookup PKCS #11 tokens
|
||||
CryptoManager manager = CryptoManager.getInstance();
|
||||
CryptoToken tokenA = manager.getTokenByName("TokenA");
|
||||
CryptoToken tokenB = manager.getTokenByName("TokenB");
|
||||
|
||||
// Create an RSA KeyPairGenerator using TokenA
|
||||
manager.setThreadToken(tokenA);
|
||||
KeyPairGenerator rsaKpg = KeyPairGenerator.getInstance("RSA", "Mozilla-JSS");
|
||||
|
||||
// Create a DSA KeyPairGenerator using TokenB
|
||||
manager.setThreadToken(tokenB);
|
||||
KeyPairGenerator dsaKpg = KeyPairGenerator.getInstance("DSA", "Mozilla-JSS");
|
||||
|
||||
// Generate an RSA KeyPair. This will happen on TokenA because TokenA
|
||||
// was the per-thread default token when rsaKpg was created.
|
||||
rsaKpg.initialize(1024);
|
||||
KeyPair rsaPair = rsaKpg.generateKeyPair();
|
||||
|
||||
// Generate a DSA KeyPair. This will happen on TokenB because TokenB
|
||||
// was the per-thread default token when dsaKpg was created.
|
||||
dsaKpg.initialize(1024);
|
||||
KeyPair dsaPair = dsaKpg.generateKeyPair();
|
||||
|
||||
.. _supported_classes:
|
||||
|
||||
`Supported Classes <#supported_classes>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
- `Cipher <#cipher>`__
|
||||
|
||||
- `DSAPrivateKey <#dsaprivatekey>`__
|
||||
|
||||
- DSAPublicKey
|
||||
|
||||
- `KeyFactory <#keyfactory>`__
|
||||
|
||||
- `KeyGenerator <#keygenerator>`__
|
||||
|
||||
- `KeyPairGenerator <#keypairgenerator>`__
|
||||
|
||||
- `Mac <#mac>`__
|
||||
|
||||
- `MessageDigest <#messagedigest>`__
|
||||
|
||||
- `RSAPrivateKey <#rsaprivatekey>`__
|
||||
|
||||
- RSAPublicKey
|
||||
|
||||
- `SecretKeyFactory <#secretkeyfactory>`__
|
||||
|
||||
- `SecretKey <#secretkey>`__
|
||||
|
||||
- `SecureRandom <#securerandom>`__
|
||||
|
||||
- `Signature <#signature>`__
|
||||
|
||||
.. rubric:: What's Not Supported
|
||||
:name: What's_Not_Supported
|
||||
|
||||
- The following classes don't work very well:
|
||||
|
||||
- **KeyStore:** There are many serious problems mapping the JCA keystore interface onto
|
||||
NSS's model of PKCS #11 modules. The current implementation is almost useless. Since
|
||||
these problems lie deep in the NSS design and implementation, there is no clear
|
||||
timeframe for fixing them. Meanwhile, the ``org.mozilla.jss.crypto.CryptoStore`` class
|
||||
can be used for some of this functionality.
|
||||
|
||||
.. rubric:: Cipher
|
||||
:name: Cipher_2
|
||||
|
||||
.. rubric:: Supported Algorithms
|
||||
:name: supported_algorithms
|
||||
|
||||
.. rubric:: Notes
|
||||
:name: notes
|
||||
|
||||
-
|
||||
|
||||
- AES
|
||||
- DES
|
||||
- DESede (*DES3* )
|
||||
- RC2
|
||||
- RC4
|
||||
- RSA
|
||||
|
||||
- The following modes and padding schemes are supported:
|
||||
|
||||
|
||||
+------------------------------+------------------------------+------------------------------+
|
||||
| Algorithm | Mode | Padding |
|
||||
+------------------------------+------------------------------+------------------------------+
|
||||
| DES | ECB | NoPadding |
|
||||
+------------------------------+------------------------------+------------------------------+
|
||||
| | CBC | NoPadding |
|
||||
+------------------------------+------------------------------+------------------------------+
|
||||
| | | PKCS5 Padding |
|
||||
+------------------------------+------------------------------+------------------------------+
|
||||
| DESede | ECB | NoPadding |
|
||||
| *DES3* | | |
|
||||
+------------------------------+------------------------------+------------------------------+
|
||||
| | CBC | NoPadding |
|
||||
+------------------------------+------------------------------+------------------------------+
|
||||
| | | PKCS5 Padding |
|
||||
+------------------------------+------------------------------+------------------------------+
|
||||
| AES | ECB | NoPadding |
|
||||
+------------------------------+------------------------------+------------------------------+
|
||||
| | CBC | NoPadding |
|
||||
+------------------------------+------------------------------+------------------------------+
|
||||
| | | PKCS5 Padding |
|
||||
+------------------------------+------------------------------+------------------------------+
|
||||
| RC4 | *None* | *None* |
|
||||
+------------------------------+------------------------------+------------------------------+
|
||||
| RC2 | CBC | NoPadding |
|
||||
+------------------------------+------------------------------+------------------------------+
|
||||
| | | PKCS5Padding |
|
||||
+------------------------------+------------------------------+------------------------------+
|
||||
|
||||
- The SecureRandom argument passed to ``initSign()`` and ``initVerify()`` is ignored, because
|
||||
NSS does not support specifying an external source of randomness.
|
||||
|
||||
.. rubric:: DSAPrivateKey
|
||||
:name: DSAPrivateKey_2
|
||||
|
||||
- ``getX()`` is not supported because NSS does not support extracting data from private keys.
|
||||
|
||||
.. rubric:: KeyFactory
|
||||
:name: KeyFactory_2
|
||||
|
||||
.. rubric:: Supported Algorithms
|
||||
:name: supported_algorithms_2
|
||||
|
||||
.. rubric:: Notes
|
||||
:name: notes_2
|
||||
|
||||
-
|
||||
|
||||
- DSA
|
||||
- RSA
|
||||
|
||||
- The following transformations are supported for ``generatePublic()`` and
|
||||
``generatePrivate()``:
|
||||
|
||||
|
||||
+----------------------------------------------+----------------------------------------------+
|
||||
| From | To |
|
||||
+----------------------------------------------+----------------------------------------------+
|
||||
| ``RSAPublicKeySpec`` | ``RSAPublicKey`` |
|
||||
+----------------------------------------------+----------------------------------------------+
|
||||
| ``DSAPublicKeySpec`` | ``DSAPublicKey`` |
|
||||
+----------------------------------------------+----------------------------------------------+
|
||||
| ``X509EncodedKeySpec`` | ``RSAPublicKey`` |
|
||||
| | ``DSAPublicKey`` |
|
||||
+----------------------------------------------+----------------------------------------------+
|
||||
| ``RSAPrivateCrtKeySpec`` | ``RSAPrivateKey`` |
|
||||
+----------------------------------------------+----------------------------------------------+
|
||||
| ``DSAPrivateKeySpec`` | ``DSAPrivateKey`` |
|
||||
+----------------------------------------------+----------------------------------------------+
|
||||
| ``PKCS8EncodedKeySpec`` | ``RSAPrivateKey`` |
|
||||
| | ``DSAPrivateKey`` |
|
||||
+----------------------------------------------+----------------------------------------------+
|
||||
|
||||
- ``getKeySpec()`` is not supported. This method exports key material in plaintext and is
|
||||
therefore insecure. Note that a public key's data can be accessed directly from the key.
|
||||
- ``translateKey()`` simply gets the encoded form of the given key and then tries to import
|
||||
it by calling ``generatePublic()`` or ``generatePrivate()``. Only ``X509EncodedKeySpec`` is
|
||||
supported for public keys, and only ``PKCS8EncodedKeySpec`` is supported for private keys.
|
||||
|
||||
.. rubric:: KeyGenerator
|
||||
:name: KeyGenerator_2
|
||||
|
||||
.. rubric:: Supported Algorithms
|
||||
:name: supported_algorithms_3
|
||||
|
||||
.. rubric:: Notes
|
||||
:name: notes_3
|
||||
|
||||
-
|
||||
|
||||
- AES
|
||||
- DES
|
||||
- DESede (*DES3* )
|
||||
- RC4
|
||||
|
||||
- The SecureRandom argument passed to ``init()`` is ignored, because NSS does not support
|
||||
specifying an external source of randomness.
|
||||
- None of the key generation algorithms accepts an ``AlgorithmParameterSpec``.
|
||||
|
||||
.. rubric:: KeyPairGenerator
|
||||
:name: KeyPairGenerator_2
|
||||
|
||||
.. rubric:: Supported Algorithms
|
||||
:name: supported_algorithms_4
|
||||
|
||||
.. rubric:: Notes
|
||||
:name: notes_4
|
||||
|
||||
-
|
||||
|
||||
- DSA
|
||||
- RSA
|
||||
|
||||
- The SecureRandom argument passed to initialize() is ignored, because NSS does not support
|
||||
specifying an external source of randomness.
|
||||
|
||||
.. rubric:: Mac
|
||||
:name: Mac_2
|
||||
|
||||
.. rubric:: Supported Algorithms
|
||||
:name: supported_algorithms_5
|
||||
|
||||
.. rubric:: Notes
|
||||
:name: notes_5
|
||||
|
||||
-
|
||||
|
||||
- HmacSHA1 (*Hmac-SHA1* )
|
||||
|
||||
- Any secret key type (AES, DES, etc.) can be used as the MAC key, but it must be a JSS key.
|
||||
That is, it must be an ``instanceof org.mozilla.jss.crypto.SecretKeyFacade``.
|
||||
- The params passed to ``init()`` are ignored.
|
||||
|
||||
.. rubric:: MessageDigest
|
||||
:name: MessageDigest_2
|
||||
|
||||
.. rubric:: Supported Algorithms
|
||||
:name: supported_algorithms_6
|
||||
|
||||
-
|
||||
|
||||
- MD5
|
||||
- MD2
|
||||
- SHA-1 (*SHA1, SHA* )
|
||||
|
||||
.. rubric:: RSAPrivateKey
|
||||
:name: RSAPrivateKey_2
|
||||
|
||||
.. rubric:: Notes
|
||||
:name: notes_6
|
||||
|
||||
-
|
||||
|
||||
- ``getModulus()`` is not supported because NSS does not support extracting data from private
|
||||
keys.
|
||||
- ``getPrivateExponent()`` is not supported because NSS does not support extracting data from
|
||||
private keys.
|
||||
|
||||
.. rubric:: SecretKeyFactory
|
||||
:name: SecretKeyFactory_2
|
||||
|
||||
.. rubric:: Supported Algorithms
|
||||
:name: supported_algorithms_7
|
||||
|
||||
.. rubric:: Notes
|
||||
:name: notes_7
|
||||
|
||||
-
|
||||
|
||||
- AES
|
||||
- DES
|
||||
- DESede (*DES3* )
|
||||
- PBAHmacSHA1
|
||||
- PBEWithMD5AndDES
|
||||
- PBEWithSHA1AndDES
|
||||
- PBEWithSHA1AndDESede (*PBEWithSHA1AndDES3* )
|
||||
- PBEWithSHA1And128RC4
|
||||
- RC4
|
||||
|
||||
- ``generateSecret`` supports the following transformations:
|
||||
|
||||
|
||||
+----------------------------------------------+----------------------------------------------+
|
||||
| KeySpec Class | Key Algorithm |
|
||||
+----------------------------------------------+----------------------------------------------+
|
||||
| PBEKeySpec | *Using the appropriate PBE algorithm:* |
|
||||
| org.mozilla.jss.crypto.PBEKeyGenParams | DES |
|
||||
| | DESede |
|
||||
| | RC4 |
|
||||
+----------------------------------------------+----------------------------------------------+
|
||||
| DESedeKeySpec | DESede |
|
||||
+----------------------------------------------+----------------------------------------------+
|
||||
| DESKeySpec | DES |
|
||||
+----------------------------------------------+----------------------------------------------+
|
||||
| SecretKeySpec | AES |
|
||||
| | DES |
|
||||
| | DESede |
|
||||
| | RC4 |
|
||||
+----------------------------------------------+----------------------------------------------+
|
||||
|
||||
- ``getKeySpec`` supports the following transformations:
|
||||
|
||||
|
||||
+----------------------------------------------+----------------------------------------------+
|
||||
| Key Algorithm | KeySpec Class |
|
||||
+----------------------------------------------+----------------------------------------------+
|
||||
| DESede | DESedeKeySpec |
|
||||
+----------------------------------------------+----------------------------------------------+
|
||||
| DES | DESKeySpec |
|
||||
+----------------------------------------------+----------------------------------------------+
|
||||
| DESede | SecretKeySpec |
|
||||
| DES | |
|
||||
| AES | |
|
||||
| RC4 | |
|
||||
+----------------------------------------------+----------------------------------------------+
|
||||
|
||||
- For increased security, some SecretKeys may not be extractable from their PKCS #11 token.
|
||||
In this case, the key should be wrapped (encrypted with another key), and then the
|
||||
encrypted key might be extractable from the token. This policy varies across PKCS #11
|
||||
tokens.
|
||||
- ``translateKey`` tries two approaches to copying keys. First, it tries to copy the key
|
||||
material directly using NSS calls to PKCS #11. If that fails, it calls ``getEncoded()`` on
|
||||
the source key, and then tries to create a new key on the target token from the encoded
|
||||
bits. Both of these operations will fail if the source key is not extractable.
|
||||
- The class ``java.security.spec.PBEKeySpec`` in JDK versions earlier than 1.4 does not
|
||||
contain the salt and iteration fields, which are necessary for PBE key generation. These
|
||||
fields were added in JDK 1.4. If you are using a JDK (or JRE) version earlier than 1.4, you
|
||||
cannot use class ``java.security.spec.PBEKeySpec``. Instead, you can use
|
||||
``org.mozilla.jss.crypto.PBEKeyGenParams``. If you are using JDK (or JRE) 1.4 or later, you
|
||||
can use ``java.security.spec.PBEKeySpec`` or ``org.mozilla.jss.crypto.PBEKeyGenParams``.
|
||||
|
||||
.. rubric:: SecretKey
|
||||
:name: SecretKey_2
|
||||
|
||||
.. rubric:: Supported Algorithms
|
||||
:name: supported_algorithms_8
|
||||
|
||||
.. rubric:: Notes
|
||||
:name: notes_8
|
||||
|
||||
-
|
||||
|
||||
- AES
|
||||
- DES
|
||||
- DESede (*DES3* )
|
||||
- HmacSHA1
|
||||
- RC2
|
||||
- RC4
|
||||
|
||||
- ``SecretKey`` is implemented by the class ``org.mozilla.jss.crypto.SecretKeyFacade``, which
|
||||
acts as a wrapper around the JSS class ``SymmetricKey``. Any ``SecretKeys`` handled by JSS
|
||||
will actually be ``SecretKeyFacades``. This should usually be transparent.
|
||||
|
||||
.. rubric:: SecureRandom
|
||||
:name: SecureRandom_2
|
||||
|
||||
.. rubric:: Supported Algorithms
|
||||
:name: supported_algorithms_9
|
||||
|
||||
.. rubric:: Notes
|
||||
:name: notes_9
|
||||
|
||||
-
|
||||
|
||||
- pkcs11prng
|
||||
|
||||
- This invokes the NSS internal pseudorandom number generator.
|
||||
|
||||
.. rubric:: Signature
|
||||
:name: Signature_2
|
||||
|
||||
.. rubric:: Supported Algorithms
|
||||
:name: supported_algorithms_10
|
||||
|
||||
.. rubric:: Notes
|
||||
:name: notes_10
|
||||
|
||||
-
|
||||
|
||||
- SHA1withDSA (*DSA, DSS, SHA/DSA, SHA-1/DSA, SHA1/DSA, DSAWithSHA1, SHAwithDSA* )
|
||||
- SHA-1/RSA (*SHA1/RSA, SHA1withRSA* )
|
||||
- MD5/RSA (*MD5withRSA* )
|
||||
- MD2/RSA
|
||||
|
||||
- The ``SecureRandom`` argument passed to ``initSign()`` and ``initVerify()`` is ignored,
|
||||
because NSS does not support specifying an external source of randomness.
|
||||
|
|
@ -1,472 +0,0 @@
|
|||
.. _mozilla_projects_nss_jss_mozilla-jss_jca_provider_notes:
|
||||
|
||||
Mozilla-JSS JCA Provider notes
|
||||
==============================
|
||||
|
||||
.. _the_mozilla-jss_jca_provider:
|
||||
|
||||
`The Mozilla-JSS JCA Provider <#the_mozilla-jss_jca_provider>`__
|
||||
----------------------------------------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
*Newsgroup:*\ `mozilla.dev.tech.crypto <news://news.mozilla.org/mozilla.dev.tech.crypto>`__
|
||||
|
||||
`Overview <#overview>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
This document describes the JCA Provider shipped with JSS. The provider's name is "Mozilla-JSS".
|
||||
It implements cryptographic operations in native code using the
|
||||
`NSS <https://www.mozilla.org/projects/security/pki/nss>`__ libraries.
|
||||
|
||||
`Contents <#contents>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
- `Signed JAR
|
||||
file <https://www.mozilla.org/projects/security/pki/jss/provider_notes.html#signed-jar>`__
|
||||
- `Installing the
|
||||
Provider <https://www.mozilla.org/projects/security/pki/jss/provider_notes.html#installing-provider>`__
|
||||
- `Specifying the
|
||||
CryptoToken <https://www.mozilla.org/projects/security/pki/jss/provider_notes.html#specifying-token>`__
|
||||
- `Supported
|
||||
Classes <https://www.mozilla.org/projects/security/pki/jss/provider_notes.html#supported-classes>`__
|
||||
- `What's Not
|
||||
Supported <https://www.mozilla.org/projects/security/pki/jss/provider_notes.html#not-supported>`__
|
||||
|
||||
.. _signed_jar_file:
|
||||
|
||||
`Signed JAR file <#signed_jar_file>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
JSS implements several JCE (Java Cryptography Extension) algorithms. These algorithms have at
|
||||
various times been export-controlled by the US government. JRE therefore requires that JAR files
|
||||
implementing JCE algorithms be digitally signed by an approved organization. The maintainers of
|
||||
JSS, Sun, Red Hat, and Mozilla, have this approval and signs the official builds of ``jss4.jar``.
|
||||
At runtime, the JRE automatically verifies this signature whenever a JSS class is loaded that
|
||||
implements a JCE algorithm. The verification is transparent to the application (unless it fails
|
||||
and throws an exception). If you are curious, you can verify the signature on the JAR file using
|
||||
the ``jarsigner`` tool, which is distributed with the JDK.
|
||||
|
||||
If you build JSS yourself from source instead of using binaries downloaded from mozilla.org, your
|
||||
JAR file will not have a valid signature. This means you will not be able to use the JSS provider
|
||||
for JCE algorithms. You have two choices.
|
||||
|
||||
#. Use the binary release of JSS from mozilla.org.
|
||||
#. Apply for your own JCE code-signing certificate following the procedure at `How to Implement a
|
||||
Provider for the Java\ TM Cryptography
|
||||
Extension <http://java.sun.com/javase/6/docs/technotes/guides/security/crypto/HowToImplAProvider.html#Step61>`__.
|
||||
Then you can sign your own JSS JAR file.
|
||||
|
||||
.. _installing_the_provider:
|
||||
|
||||
`Installing the Provider <#installing_the_provider>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
In order to use any part of JSS, including the JCA provider, you must first call
|
||||
``CryptoManager.initialize()``. By default, the JCA provider will be installed in the list of
|
||||
providers maintained by the ``java.security.Security`` class. If you do not wish the provider to
|
||||
be installed, create a
|
||||
```CryptoManager.InitializationValues`` <https://www.mozilla.org/projects/security/pki/jss/javadoc/org/mozilla/jss/CryptoManager.InitializationValues.html>`__
|
||||
object, set its ``installJSSProvider`` field to ``false``, and pass the ``InitializationValues``
|
||||
object to ``CryptoManager.initialize()``.
|
||||
|
||||
.. _specifying_the_cryptotoken:
|
||||
|
||||
`Specifying the CryptoToken <#specifying_the_cryptotoken>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
All cryptographic operations in JSS and NSS occur on a particular PKCS #11 token, implemented in
|
||||
software or hardware. There is no clean way to specify this token through the JCA API. By
|
||||
default, the JSS provider carries out all operations except MessageDigest on the Internal Key
|
||||
Storage Token, a software token included in JSS/NSS. MessageDigest operations take place by
|
||||
default on the Internal Crypto Token, another internal software token in JSS/NSS. There is no
|
||||
good design reason for this difference, but it is necessitated by a quirk in the NSS
|
||||
implementation.
|
||||
|
||||
In order to use a different token, use ``CryptoManager.setThreadToken()``. This sets the token to
|
||||
be used by the JSS JCA provider in the current thread. When you call ``getInstance()`` on a JCA
|
||||
class, the JSS provider checks the current per-thread default token (by calling
|
||||
``CryptoManager.getThreadToken()``) and instructs the new object to use that token for
|
||||
cryptographic operations. The per-thread default token setting is only consulted inside
|
||||
``getInstance()``. Once a JCA object has been created it will continue to use the same token,
|
||||
even if the application later changes the per-thread default token.
|
||||
|
||||
Whenever a new thread is created, its token is initialized to the default, the Internal Key
|
||||
Storage Token. Thus, the thread token is not inherited from the parent thread.
|
||||
|
||||
The following example shows how you can specify which token is used for various JCA operations:
|
||||
|
||||
.. code::
|
||||
|
||||
// Lookup PKCS #11 tokens
|
||||
CryptoManager manager = CryptoManager.getInstance();
|
||||
CryptoToken tokenA = manager.getTokenByName("TokenA");
|
||||
CryptoToken tokenB = manager.getTokenByName("TokenB");
|
||||
|
||||
// Create an RSA KeyPairGenerator using TokenA
|
||||
manager.setThreadToken(tokenA);
|
||||
KeyPairGenerator rsaKpg = KeyPairGenerator.getInstance("Mozilla-JSS", "RSA");
|
||||
|
||||
// Create a DSA KeyPairGenerator using TokenB
|
||||
manager.setThreadToken(tokenB);
|
||||
KeyPairGenerator dsaKpg = KeyPairGenerator.getInstance("Mozilla-JSS", "DSA");
|
||||
|
||||
// Generate an RSA KeyPair. This will happen on TokenA because TokenA
|
||||
// was the per-thread default token when rsaKpg was created.
|
||||
rsaKpg.initialize(1024);
|
||||
KeyPair rsaPair = rsaKpg.generateKeyPair();
|
||||
|
||||
// Generate a DSA KeyPair. This will happen on TokenB because TokenB
|
||||
// was the per-thread default token when dsaKpg was created.
|
||||
dsaKpg.initialize(1024);
|
||||
KeyPair dsaPair = dsaKpg.generateKeyPair();
|
||||
|
||||
.. _supported_classes:
|
||||
|
||||
`Supported Classes <#supported_classes>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
- `Cipher <https://www.mozilla.org/projects/security/pki/jss/provider_notes.html#Cipher>`__
|
||||
- `DSAPrivateKey <https://www.mozilla.org/projects/security/pki/jss/provider_notes.html#DSAPrivateKey>`__
|
||||
- DSAPublicKey
|
||||
- `KeyFactory <https://www.mozilla.org/projects/security/pki/jss/provider_notes.html#KeyFactory>`__
|
||||
- `KeyGenerator <https://www.mozilla.org/projects/security/pki/jss/provider_notes.html#KeyGenerator>`__
|
||||
- `KeyPairGenerator <https://www.mozilla.org/projects/security/pki/jss/provider_notes.html#KeyPairGenerator>`__
|
||||
- `Mac <https://www.mozilla.org/projects/security/pki/jss/provider_notes.html#Mac>`__
|
||||
- `MessageDigest <https://www.mozilla.org/projects/security/pki/jss/provider_notes.html#MessageDigest>`__
|
||||
- `RSAPrivateKey <https://www.mozilla.org/projects/security/pki/jss/provider_notes.html#RSAPrivateKey>`__
|
||||
- RSAPublicKey
|
||||
- `SecretKeyFactory <https://www.mozilla.org/projects/security/pki/jss/provider_notes.html#SecretKeyFactory>`__
|
||||
- `SecretKey <https://www.mozilla.org/projects/security/pki/jss/provider_notes.html#SecretKey>`__
|
||||
- `SecureRandom <https://www.mozilla.org/projects/security/pki/jss/provider_notes.html#SecureRandom>`__
|
||||
- `Signature <https://www.mozilla.org/projects/security/pki/jss/provider_notes.html#Signature>`__
|
||||
|
||||
`Cipher <#cipher>`__
|
||||
~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
.. rubric:: Supported Algorithms
|
||||
:name: supported_algorithms
|
||||
|
||||
.. rubric:: Notes
|
||||
:name: notes
|
||||
|
||||
- AES
|
||||
- DES
|
||||
- DESede (*DES3*)
|
||||
- RC2
|
||||
- RC4
|
||||
- RSA
|
||||
|
||||
- The following modes and padding schemes are supported:
|
||||
|
||||
+--------------------------------+--------------------------------+--------------------------------+
|
||||
| Algorithm | Mode | Padding |
|
||||
+--------------------------------+--------------------------------+--------------------------------+
|
||||
| DES | ECB | NoPadding |
|
||||
+--------------------------------+--------------------------------+--------------------------------+
|
||||
| | CBC | NoPadding |
|
||||
+--------------------------------+--------------------------------+--------------------------------+
|
||||
| | | PKCS5 Padding |
|
||||
+--------------------------------+--------------------------------+--------------------------------+
|
||||
| DESede | ECB | NoPadding |
|
||||
| *DES3* | | |
|
||||
+--------------------------------+--------------------------------+--------------------------------+
|
||||
| | CBC | NoPadding |
|
||||
+--------------------------------+--------------------------------+--------------------------------+
|
||||
| | | PKCS5 Padding |
|
||||
+--------------------------------+--------------------------------+--------------------------------+
|
||||
| AES | ECB | NoPadding |
|
||||
+--------------------------------+--------------------------------+--------------------------------+
|
||||
| | CBC | NoPadding |
|
||||
+--------------------------------+--------------------------------+--------------------------------+
|
||||
| | | PKCS5 Padding |
|
||||
+--------------------------------+--------------------------------+--------------------------------+
|
||||
| RC4 | *None* | *None* |
|
||||
+--------------------------------+--------------------------------+--------------------------------+
|
||||
| RC2 | CBC | NoPadding |
|
||||
+--------------------------------+--------------------------------+--------------------------------+
|
||||
| | | PKCS5Padding |
|
||||
+--------------------------------+--------------------------------+--------------------------------+
|
||||
|
||||
- The SecureRandom argument passed to ``initSign()`` and ``initVerify()`` is ignored, because
|
||||
NSS does not support specifying an external source of randomness.
|
||||
|
||||
`DSAPrivateKey <#dsaprivatekey>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
- ``getX()`` is not supported because NSS does not support extracting data from private keys.
|
||||
|
||||
`KeyFactory <#keyfactory>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
.. rubric:: Supported Algorithms
|
||||
:name: supported_algorithms_2
|
||||
|
||||
.. rubric:: Notes
|
||||
:name: notes_2
|
||||
|
||||
- DSA
|
||||
- RSA
|
||||
- The following transformations are supported for ``generatePublic()`` and
|
||||
``generatePrivate()``:
|
||||
|
||||
+-------------------------------------------------+-------------------------------------------------+
|
||||
| From | To |
|
||||
+-------------------------------------------------+-------------------------------------------------+
|
||||
| ``RSAPublicKeySpec`` | ``RSAPublicKey`` |
|
||||
+-------------------------------------------------+-------------------------------------------------+
|
||||
| ``DSAPublicKeySpec`` | ``DSAPublicKey`` |
|
||||
+-------------------------------------------------+-------------------------------------------------+
|
||||
| ``X509EncodedKeySpec`` | ``RSAPublicKey`` |
|
||||
| | ``DSAPublicKey`` |
|
||||
+-------------------------------------------------+-------------------------------------------------+
|
||||
| ``RSAPrivateCrtKeySpec`` | ``RSAPrivateKey`` |
|
||||
+-------------------------------------------------+-------------------------------------------------+
|
||||
| ``DSAPrivateKeySpec`` | ``DSAPrivateKey`` |
|
||||
+-------------------------------------------------+-------------------------------------------------+
|
||||
| ``PKCS8EncodedKeySpec`` | ``RSAPrivateKey`` |
|
||||
| | ``DSAPrivateKey`` |
|
||||
+-------------------------------------------------+-------------------------------------------------+
|
||||
|
||||
- ``getKeySpec()`` is not supported. This method exports key material in plaintext and is
|
||||
therefore insecure. Note that a public key's data can be accessed directly from the key.
|
||||
- ``translateKey()`` simply gets the encoded form of the given key and then tries to import it
|
||||
by calling ``generatePublic()`` or ``generatePrivate()``. Only ``X509EncodedKeySpec`` is
|
||||
supported for public keys, and only ``PKCS8EncodedKeySpec`` is supported for private keys.
|
||||
|
||||
`KeyGenerator <#keygenerator>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
.. rubric:: Supported Algorithms
|
||||
:name: supported_algorithms_3
|
||||
|
||||
.. rubric:: Notes
|
||||
:name: notes_3
|
||||
|
||||
- AES
|
||||
- DES
|
||||
- DESede (*DES3*)
|
||||
- RC4
|
||||
- The SecureRandom argument passed to ``init()`` is ignored, because NSS does not support
|
||||
specifying an external source of randomness.
|
||||
- None of the key generation algorithms accepts an ``AlgorithmParameterSpec``.
|
||||
|
||||
`KeyPairGenerator <#keypairgenerator>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
.. rubric:: Supported Algorithms
|
||||
:name: supported_algorithms_4
|
||||
|
||||
.. rubric:: Notes
|
||||
:name: notes_4
|
||||
|
||||
- DSA
|
||||
- RSA
|
||||
|
||||
- The SecureRandom argument passed to initialize() is ignored, because NSS does not support
|
||||
specifying an external source of randomness.
|
||||
|
||||
`Mac <#mac>`__
|
||||
~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
.. rubric:: Supported Algorithms
|
||||
:name: supported_algorithms_5
|
||||
|
||||
.. rubric:: Notes
|
||||
:name: notes_5
|
||||
|
||||
- HmacSHA1 (*Hmac-SHA1*)
|
||||
|
||||
- Any secret key type (AES, DES, etc.) can be used as the MAC key, but it must be a JSS key.
|
||||
That is, it must be an ``instanceof org.mozilla.jss.crypto.SecretKeyFacade``.
|
||||
- The params passed to ``init()`` are ignored.
|
||||
|
||||
`MessageDigest <#messagedigest>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
.. rubric:: Supported Algorithms
|
||||
:name: supported_algorithms_6
|
||||
|
||||
- MD5
|
||||
- MD2
|
||||
- SHA-1 (*SHA1, SHA*)
|
||||
|
||||
`RSAPrivateKey <#rsaprivatekey>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
.. rubric:: Notes
|
||||
:name: notes_6
|
||||
|
||||
- ``getModulus()`` is not supported because NSS does not support extracting data from private
|
||||
keys.
|
||||
- ``getPrivateExponent()`` is not supported because NSS does not support extracting data from
|
||||
private keys.
|
||||
|
||||
`SecretKeyFactory <#secretkeyfactory>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
.. rubric:: Supported Algorithms
|
||||
:name: supported_algorithms_7
|
||||
|
||||
.. rubric:: Notes
|
||||
:name: notes_7
|
||||
|
||||
- AES
|
||||
- DES
|
||||
- DESede (*DES3*)
|
||||
- PBAHmacSHA1
|
||||
- PBEWithMD5AndDES
|
||||
- PBEWithSHA1AndDES
|
||||
- PBEWithSHA1AndDESede (*PBEWithSHA1AndDES3*)
|
||||
- PBEWithSHA1And128RC4
|
||||
- RC4
|
||||
|
||||
- ``generateSecret`` supports the following transformations:
|
||||
|
||||
+-------------------------------------------------+-------------------------------------------------+
|
||||
| KeySpec Class | Key Algorithm |
|
||||
+-------------------------------------------------+-------------------------------------------------+
|
||||
| PBEKeySpec | *Using the appropriate PBE algorithm:* |
|
||||
| org.mozilla.jss.crypto.PBEKeyGenParams | DES |
|
||||
| | DESede |
|
||||
| | RC4 |
|
||||
+-------------------------------------------------+-------------------------------------------------+
|
||||
| DESedeKeySpec | DESede |
|
||||
+-------------------------------------------------+-------------------------------------------------+
|
||||
| DESKeySpec | DES |
|
||||
+-------------------------------------------------+-------------------------------------------------+
|
||||
| SecretKeySpec | AES |
|
||||
| | DES |
|
||||
| | DESede |
|
||||
| | RC4 |
|
||||
+-------------------------------------------------+-------------------------------------------------+
|
||||
|
||||
- ``getKeySpec`` supports the following transformations:
|
||||
|
||||
+-------------------------------------------------+-------------------------------------------------+
|
||||
| Key Algorithm | KeySpec Class |
|
||||
+-------------------------------------------------+-------------------------------------------------+
|
||||
| DESede | DESedeKeySpec |
|
||||
+-------------------------------------------------+-------------------------------------------------+
|
||||
| DES | DESKeySpec |
|
||||
+-------------------------------------------------+-------------------------------------------------+
|
||||
| DESede | SecretKeySpec |
|
||||
| DES | |
|
||||
| AES | |
|
||||
| RC4 | |
|
||||
+-------------------------------------------------+-------------------------------------------------+
|
||||
|
||||
- For increased security, some SecretKeys may not be extractable from their PKCS #11 token. In
|
||||
this case, the key should be wrapped (encrypted with another key), and then the encrypted key
|
||||
might be extractable from the token. This policy varies across PKCS #11 tokens.
|
||||
- ``translateKey`` tries two approaches to copying keys. First, it tries to copy the key
|
||||
material directly using NSS calls to PKCS #11. If that fails, it calls ``getEncoded()`` on the
|
||||
source key, and then tries to create a new key on the target token from the encoded bits. Both
|
||||
of these operations will fail if the source key is not extractable.
|
||||
- The class ``java.security.spec.PBEKeySpec`` in JDK versions earlier than 1.4 does not contain
|
||||
the salt and iteration fields, which are necessary for PBE key generation. These fields were
|
||||
added in JDK 1.4. If you are using a JDK (or JRE) version earlier than 1.4, you cannot use
|
||||
class ``java.security.spec.PBEKeySpec``. Instead, you can use
|
||||
``org.mozilla.jss.crypto.PBEKeyGenParams``. If you are using JDK (or JRE) 1.4 or later, you
|
||||
can use ``java.security.spec.PBEKeySpec`` or ``org.mozilla.jss.crypto.PBEKeyGenParams``.
|
||||
|
||||
`SecretKey <#secretkey>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
.. rubric:: Supported Algorithms
|
||||
:name: supported_algorithms_8
|
||||
|
||||
.. rubric:: Notes
|
||||
:name: notes_8
|
||||
|
||||
- AES
|
||||
- DES
|
||||
- DESede (*DES3*)
|
||||
- HmacSHA1
|
||||
- RC2
|
||||
- RC4
|
||||
|
||||
- ``SecretKey`` is implemented by the class ``org.mozilla.jss.crypto.SecretKeyFacade``, which
|
||||
acts as a wrapper around the JSS class ``SymmetricKey``. Any ``SecretKeys`` handled by JSS
|
||||
will actually be ``SecretKeyFacades``. This should usually be transparent.
|
||||
|
||||
`SecureRandom <#securerandom>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
.. rubric:: Supported Algorithms
|
||||
:name: supported_algorithms_9
|
||||
|
||||
.. rubric:: Notes
|
||||
:name: notes_9
|
||||
|
||||
- pkcs11prng
|
||||
|
||||
- This invokes the NSS internal pseudorandom number generator.
|
||||
|
||||
`Signature <#signature>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
.. rubric:: Supported Algorithms
|
||||
:name: supported_algorithms_10
|
||||
|
||||
.. rubric:: Notes
|
||||
:name: notes_10
|
||||
|
||||
- SHA1withDSA (*DSA, DSS, SHA/DSA, SHA-1/DSA, SHA1/DSA, DSAWithSHA1, SHAwithDSA*)
|
||||
- SHA-1/RSA (*SHA1/RSA, SHA1withRSA*)
|
||||
- MD5/RSA (*MD5withRSA*)
|
||||
- MD2/RSA
|
||||
|
||||
- The SecureRandom argument passed to ``initSign()`` and ``initVerify()`` is ignored, because
|
||||
NSS does not support specifying an external source of randomness.
|
||||
|
||||
.. _what's_not_supported:
|
||||
|
||||
`What's Not Supported <#what's_not_supported>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
The following classes don't work very well:
|
||||
|
||||
- **KeyStore:** There are many serious problems mapping the JCA keystore interface onto NSS's
|
||||
model of PKCS #11 modules. The current implementation is almost useless. Since these problems
|
||||
lie deep in the NSS design and implementation, there is no clear timeframe for fixing them.
|
||||
Meanwhile, the ``org.mozilla.jss.crypto.CryptoStore`` class can be used for some of this
|
||||
functionality.
|
||||
|
|
@ -1,152 +0,0 @@
|
|||
.. _mozilla_projects_nss_jss_using_jss:
|
||||
|
||||
Using JSS
|
||||
=========
|
||||
|
||||
.. _using_jss:
|
||||
|
||||
`Using JSS <#using_jss>`__
|
||||
--------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
*Newsgroup:*\ `mozilla.dev.tech.crypto <news://news.mozilla.org:119/mozilla.dev.tech.crypto>`__
|
||||
|
||||
If you have already `built
|
||||
JSS <https://developer.mozilla.org/en-US/docs/JSS/Build_instructions_for_JSS_4.3.x>`__, or if you
|
||||
are planning to use a binary release of JSS, here's how to get JSS working with your code.
|
||||
|
||||
| `Gather Components <#components>`__
|
||||
| `Setup your runtime environment <#runtime>`__
|
||||
| `Initialize JSS in your application <#init>`__
|
||||
|
||||
.. _gather_components:
|
||||
|
||||
`Gather components <#gather_components>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
#. You need the JSS classes and the NSPR, NSS, and JSS shared libraries.
|
||||
|
||||
#. **NSPR and NSS Shared Libraries**
|
||||
|
||||
JSS uses the NSPR and NSS libraries for I/O and crypto. JSS version 3.0 linked statically with
|
||||
NSS, so it only required NSPR. JSS versions 3.1 and later link dynamically with NSS, so they
|
||||
also require the NSS shared libraries.
|
||||
|
||||
The exact library names vary according to the convention for each platform. For example, the
|
||||
NSPR library is called ``nspr4.dll`` or ``libnspr4.dll`` on Windows and ``libnspr4.so`` on
|
||||
Solaris. The following table gives the core names of the libraries, omitting the
|
||||
platform-specific prefix and suffix.
|
||||
|
||||
+-------------------+-------------------------------------+--------------------------------------+
|
||||
| JSS Dependencies | | |
|
||||
+-------------------+-------------------------------------+--------------------------------------+
|
||||
| Core Library Name | Description | Binary Release Location |
|
||||
+-------------------+-------------------------------------+--------------------------------------+
|
||||
| nspr4 | NSPR OS abstraction layer | `htt |
|
||||
| | | p://ftp.mozilla.org/pub/mozilla.org/ |
|
||||
| | | nspr/releases <http://ftp.mozilla.or |
|
||||
| | | g/pub/mozilla.org/nspr/releases/>`__ |
|
||||
+-------------------+-------------------------------------+--------------------------------------+
|
||||
| plc4 | | NSPR standard C library replacement |
|
||||
| | | functions |
|
||||
+-------------------+-------------------------------------+--------------------------------------+
|
||||
| plds4 | | NSPR data structure types |
|
||||
+-------------------+-------------------------------------+--------------------------------------+
|
||||
| nss3 | NSS crypto, PKCS #11, and utilities | `http://ftp.mozilla. |
|
||||
| | | org/pub/mozilla.org/security/nss/rel |
|
||||
| | | eases <http://ftp.mozilla.org/pub/mo |
|
||||
| | | zilla.org/security/nss/releases/>`__ |
|
||||
+-------------------+-------------------------------------+--------------------------------------+
|
||||
| ssl3 | | NSS SSL library |
|
||||
+-------------------+-------------------------------------+--------------------------------------+
|
||||
| smime3 | | NSS S/MIME functions and types |
|
||||
+-------------------+-------------------------------------+--------------------------------------+
|
||||
| nssckbi | | PKCS #11 module containing built-in |
|
||||
| | | root CA certificates. Optional. |
|
||||
+-------------------+-------------------------------------+--------------------------------------+
|
||||
| freebl_\* | | Processor-specific optimized |
|
||||
| | | big-number arithmetic library. Not |
|
||||
| | | present on all platforms. |
|
||||
| | | :ref:`mozilla_projects_nss_introd |
|
||||
| | | uction_to_network_security_services` |
|
||||
+-------------------+-------------------------------------+--------------------------------------+
|
||||
| fort | | FORTEZZA support. Optional |
|
||||
+-------------------+-------------------------------------+--------------------------------------+
|
||||
| swft | | PKCS #11 module implementing |
|
||||
| | | FORTEZZA in software. Optional. |
|
||||
+-------------------+-------------------------------------+--------------------------------------+
|
||||
|
||||
If you built JSS from source, you have these libraries in the ``mozilla/dist/<platform>/lib``
|
||||
directory of your build tree. If you are downloading binaries, get them from the binary
|
||||
release locations in the above table. You need to select the right version of the components,
|
||||
based on the version of JSS you are using. Generally, it is safe to use a later version of a
|
||||
component than what JSS was tested with. For example, although JSS 4.2 was tested with NSS
|
||||
3.11.
|
||||
|
||||
================== ========= ==============
|
||||
Component Versions
|
||||
JSS Version Component Tested Version
|
||||
JSS 4.2 NSPR 4.6.4
|
||||
\ NSS 3.11.4
|
||||
JSS 3.4 NSPR 4.2.2
|
||||
\ NSS 3.7.3
|
||||
JSS 3.3 NSPR 4.2.2
|
||||
\ NSS 3.6.1 or 3.7
|
||||
JSS 3.2 NSPR 4.2 or 4.1.2
|
||||
\ NSS 3.4.2
|
||||
JSS 3.1.1 NSPR 4.1.2
|
||||
\ NSS 3.3.1
|
||||
JSS 3.1 NSPR 4.1.2
|
||||
\ NSS 3.3
|
||||
JSS 3.0 NSPR 3.5.1
|
||||
================== ========= ==============
|
||||
|
||||
#. **JSS Shared Library**
|
||||
|
||||
The JSS shared library is ``jss4.dll`` (Windows) or ``libjss4.so`` (Unix). If you built JSS
|
||||
from source, it is in ``mozilla/dist/<platform>/lib``. If you are downloading binaries, get it
|
||||
from http://ftp.mozilla.org/pub/mozilla.org/security/jss/releases/.
|
||||
|
||||
#. **JSS classes**
|
||||
|
||||
If you built JSS from source, the compiled JSS classes are in ``mozilla/dist/classes[_dbg]``.
|
||||
You can put this directory in your classpath to run applications locally; or, you can package
|
||||
the class files into a JAR file for easier distribution:
|
||||
|
||||
.. code::
|
||||
|
||||
cd mozilla/dist/classes[_dbg]
|
||||
zip -r ../jss42.jar .
|
||||
|
||||
If you are downloading binaries, get jss42.jar
|
||||
from http://ftp.mozilla.org/pub/mozilla.org/security/jss/releases/.
|
||||
|
||||
.. _setup_your_runtime_environment:
|
||||
|
||||
`Setup your runtime environment <#setup_your_runtime_environment>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
You need to set some environment variables before building and running Java applications with
|
||||
JSS.
|
||||
|
||||
``CLASSPATH``
|
||||
Include the path containing the JSS classes you built, or the path to ``jss42.jar``. (The path
|
||||
to ``jss34.jar`` ends with the string "/jss42.jar". It is not just the directory that contains
|
||||
``jss42.jar``.)
|
||||
``LD_LIBRARY_PATH`` (Unix) / ``PATH`` (Windows)
|
||||
Include the path to the NSPR, NSS, and JSS shared libraries.
|
||||
|
||||
.. _initialize_jss_in_your_application:
|
||||
|
||||
`Initialize JSS in your application <#initialize_jss_in_your_application>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
Before calling any JSS methods, you must initialize JSS by calling one of the
|
||||
``CryptoManager.initialize`` methods. See the `javadoc <javadoc>`__ for more details.
|
||||
|
|
@ -1,61 +0,0 @@
|
|||
.. _mozilla_projects_nss_key_log_format:
|
||||
|
||||
NSS Key Log Format
|
||||
==================
|
||||
|
||||
.. container::
|
||||
|
||||
Key logs can be written by NSS so that external programs can decrypt TLS connections. Wireshark
|
||||
1.6.0 and above can use these log files to decrypt packets. You can tell Wireshark where to find
|
||||
the key file via *Edit→Preferences→Protocols→TLS→(Pre)-Master-Secret log filename*.
|
||||
|
||||
Key logging is enabled by setting the environment variable ``SSLKEYLOGFILE`` to point to a file.
|
||||
Note: starting with :ref:`mozilla_projects_nss_nss_3_24_release_notes` (used by Firefox 48 and 49
|
||||
only), the ``SSLKEYLOGFILE`` approach is disabled by default for optimized builds using the
|
||||
Makefile (those using gyp via ``build.sh`` are *not* affected). Distributors can re-enable it at
|
||||
compile time though (using the ``NSS_ALLOW_SSLKEYLOGFILE=1`` make variable) which is done for the
|
||||
official Firefox binaries. (See `bug
|
||||
1188657 <https://bugzilla.mozilla.org/show_bug.cgi?id=1188657>`__.) Notably, Debian does not have
|
||||
this option enabled, see `Debian bug
|
||||
842292 <https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=842292>`__.
|
||||
|
||||
This key log file is a series of lines. Comment lines begin with a sharp character ('#') and are
|
||||
ignored. Secrets follow the format ``<Label> <space> <ClientRandom> <space> <Secret>`` where:
|
||||
|
||||
- ``<Label>`` describes the following secret.
|
||||
- ``<ClientRandom>`` is 32 bytes Random value from the Client Hello message, encoded as 64
|
||||
hexadecimal characters.
|
||||
- ``<Secret>`` depends on the Label (see below).
|
||||
|
||||
The following labels are defined, followed by a description of the secret:
|
||||
|
||||
- ``RSA``: 48 bytes for the premaster secret, encoded as 96 hexadecimal characters (removed in
|
||||
NSS 3.34)
|
||||
- ``CLIENT_RANDOM``: 48 bytes for the master secret, encoded as 96 hexadecimal characters (for
|
||||
SSL 3.0, TLS 1.0, 1.1 and 1.2)
|
||||
- ``CLIENT_EARLY_TRAFFIC_SECRET``: the hex-encoded early traffic secret for the client side (for
|
||||
TLS 1.3)
|
||||
- ``CLIENT_HANDSHAKE_TRAFFIC_SECRET``: the hex-encoded handshake traffic secret for the client
|
||||
side (for TLS 1.3)
|
||||
- ``SERVER_HANDSHAKE_TRAFFIC_SECRET``: the hex-encoded handshake traffic secret for the server
|
||||
side (for TLS 1.3)
|
||||
- ``CLIENT_TRAFFIC_SECRET_0``: the first hex-encoded application traffic secret for the client
|
||||
side (for TLS 1.3)
|
||||
- ``SERVER_TRAFFIC_SECRET_0``: the first hex-encoded application traffic secret for the server
|
||||
side (for TLS 1.3)
|
||||
- ``EARLY_EXPORTER_SECRET``: the hex-encoded early exporter secret (for TLS 1.3).
|
||||
- ``EXPORTER_SECRET``: the hex-encoded exporter secret (for TLS 1.3)
|
||||
|
||||
The ``RSA`` form allows ciphersuites using RSA key-agreement to be logged and was the first form
|
||||
supported by Wireshark 1.6.0. It has been superseded by ``CLIENT_RANDOM`` which also works with
|
||||
other key-agreement algorithms (such as those based on Diffie-Hellman) and is supported since
|
||||
Wireshark 1.8.0.
|
||||
|
||||
The TLS 1.3 lines are supported since NSS 3.34 (`bug
|
||||
1287711 <https://bugzilla.mozilla.org/show_bug.cgi?id=1287711>`__) and Wireshark 2.4
|
||||
(``EARLY_EXPORTER_SECRET`` exists since NSS 3.35, `bug
|
||||
1417331 <https://bugzilla.mozilla.org/show_bug.cgi?id=1417331>`__). The size of the hex-encoded
|
||||
secret depends on the selected cipher suite. It is 64, 96 or 128 characters for SHA256, SHA384 or
|
||||
SHA512 respectively.
|
||||
|
||||
For Wireshark usage, see `TLS - Wireshark Wiki <https://wiki.wireshark.org/TLS>`__.
|
||||
|
|
@ -1,52 +0,0 @@
|
|||
.. _mozilla_projects_nss_memory_allocation:
|
||||
|
||||
NSS Memory allocation
|
||||
=====================
|
||||
|
||||
.. container::
|
||||
|
||||
NSS makes extensive use of NSPR's PLArenaPools for memory allocation.
|
||||
|
||||
Each block of memory allocated in a PLArenaPool is called a PLArena. When a PLArenaPool is freed,
|
||||
all the arenas in that pool are put on an arena free list. When NSS attempts to allocate more
|
||||
memory for an arena pool, the PLArenaPool code attempts to use an arena from its free list, and
|
||||
only gets a new arena from the heap if there are no arenas in the free list that are large enough
|
||||
to satisfy the request.
|
||||
|
||||
There are two consequences of the use of PLArenaPools that affect leak analysis. They are:
|
||||
|
||||
1. At the end of execution of a program, all the arenas in the free list will appear to have been
|
||||
leaked. This makes it difficult to tell arenas that are truly leaked from those that are merely
|
||||
in the free list.
|
||||
|
||||
There is a function named PL_ArenaFinish that really frees all the arenas on the free list. See
|
||||
the prototype at
|
||||
`http://mxr.mozilla.org/nspr/source/n.../ds/plarenas.h <http://mxr.mozilla.org/nspr/source/nsprpub/lib/ds/plarenas.h>`__
|
||||
|
||||
A program should call that function at the very end, after having shutdown NSS and NSPR, to
|
||||
really free the contents of the free list. After that function returns, any arenas that still
|
||||
appear to be leaked have truly been leaked, and are not merely on the free list.
|
||||
|
||||
2. Leak analysis tools will frequently report the wrong call stack for the allocation of leaked
|
||||
arenas.
|
||||
|
||||
When the arena free list is in use, the first user of an arena will allocate it from the heap,
|
||||
but will then free it to the free list. The second user will allocated it from the free list and
|
||||
return it to the free list. If and when an arena is leaked, the developer wants to see the call
|
||||
stack of the most recent allocation of the arena, not the stack of the oldest allocation of that
|
||||
arena. But leak analysis tools only record the allocation of memory from the heap, not memory
|
||||
from the arena free list, so they will always show the first allocation (from the heap) and not
|
||||
the most recent allocation (from the arena free list).
|
||||
|
||||
Consequently, when the arena free list is in use, the allocation call stacks shown will typically
|
||||
NOT be the stack of the code that most recently allocated that arena, but rather will be the
|
||||
stack of the code that FIRST allocated that arena from the heap, and then placed it on the free
|
||||
list.
|
||||
|
||||
To solve that problem, it is generally necessary to disable the arena free list, so that arenas
|
||||
are actually freed back to the heap each time they are freed, and are allocated afresh from the
|
||||
heap each time they are allocated. This makes NSS slower, but produces accurate leak allocation
|
||||
stacks. To accomplish that, set an environment variable prior to the initialization of NSS and
|
||||
NSPR. This can be done outside the program entirely, or can be done by the program itself, in the
|
||||
main() function. Set the environment variable NSS_DISABLE_ARENA_FREE_LIST to have any non-empty
|
||||
value, e.g. NSS_DISABLE_ARENA_FREE_LIST=1.
|
||||
|
|
@ -1,24 +0,0 @@
|
|||
.. _mozilla_projects_nss_modutil-tasks_html:
|
||||
|
||||
modutil-tasks.html
|
||||
==================
|
||||
|
||||
.. _nss_security_tools_modutil_tasks:
|
||||
|
||||
`NSS Security Tools: modutil Tasks <#nss_security_tools_modutil_tasks>`__
|
||||
-------------------------------------------------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
Newsgroup: `mozilla.dev.tech.crypto <news://news.mozilla.org/mozilla.dev.tech.crypto>`__
|
||||
|
||||
.. _task_list:
|
||||
|
||||
`Task List <#task_list>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
#. The jar installation script is very fragile with respect to platform definitions (especially
|
||||
version numbers). A fix was made for "HPUX B.11.00," but issues may still arise for platforms
|
||||
like "Linux 2.2.12-20." Documentation needs to be explicit about the use of Fo
|
||||
|
|
@ -1,10 +0,0 @@
|
|||
|
||||
More documentation
|
||||
==================
|
||||
|
||||
.. toctree::
|
||||
:maxdepth: 5
|
||||
:glob:
|
||||
|
||||
**/*
|
||||
|
||||
|
|
@ -1,41 +0,0 @@
|
|||
.. _mozilla_projects_nss_new_nss_samples:
|
||||
|
||||
New NSS Samples
|
||||
===============
|
||||
|
||||
.. _new_nss_sample_code:
|
||||
|
||||
`New NSS Sample Code <#new_nss_sample_code>`__
|
||||
----------------------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
This collection of sample code demonstrates how NSS can be used for cryptographic operations,
|
||||
certificate handling, SSL, etc. It also demonstrates some best practices in the application of
|
||||
cryptography.
|
||||
|
||||
|
|
||||
| These new examples are a work in progress. See
|
||||
https://bugzilla.mozilla.org/show_bug.cgi?id=490238
|
||||
|
||||
How to download the samples:
|
||||
|
||||
.. code:: sh
|
||||
|
||||
hg clone https://hg.mozilla.org/projects/nss; cd nss; hg update SAMPLES_BRANCH
|
||||
|
||||
Samples list:
|
||||
|
||||
#. :ref:`mozilla_projects_nss_nss_sample_code_sample1_-_hashing`
|
||||
#. :ref:`mozilla_projects_nss_nss_sample_code_sample2_-_initialize_nss_database`
|
||||
#. :ref:`mozilla_projects_nss_encrypt_decrypt_mac_using_token`
|
||||
#. :ref:`mozilla_projects_nss_encrypt_decrypt_mac_keys_as_session_objects`
|
||||
#. :ref:`mozilla_projects_nss_nss_sample_code_enc_dec_mac_output_plblic_key_as_csr`
|
||||
#. :ref:`mozilla_projects_nss_nss_sample_code_enc_dec_mac_using_key_wrap_certreq_pkcs10_csr`
|
||||
|
||||
Common code used by these samples:
|
||||
|
||||
#. :ref:`mozilla_projects_nss_nss_sample_code_utiltiies_for_nss_samples`
|
||||
|
||||
Thanks are due to Shailendra Jain, Mozilla Community member, who is the principal author of these
|
||||
samples.
|
||||
|
|
@ -1,172 +0,0 @@
|
|||
.. _mozilla_projects_nss_notes_on_tls_-_ssl_3_0_intolerant_servers:
|
||||
|
||||
Notes on TLS - SSL 3.0 Intolerant Servers
|
||||
=========================================
|
||||
|
||||
`Problem <#problem>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
A number of Netscape 6.x/7.x and Mozilla users have reported that some secure sites -- typically
|
||||
sites featuring online transactions or online banking over the HTTPS protocol -- do not display
|
||||
any content at all. The connection seems terminated and a blank page is displayed. This is the
|
||||
main symptom of the problem when Mozilla based browsers encounter TLS/SSL 3.0 intolerant servers.
|
||||
|
||||
`Cause <#cause>`__
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
There are some number of web servers in production today which incorrectly implement the SSL 3.0
|
||||
specification. This incorrect implementation causes them to reject connection attempts from
|
||||
clients that are compliant with the **SSL 3.0** and **TLS (aka SSL 3.1)** specifications.
|
||||
|
||||
Netscape 6.x/7.x and Mozilla browsers (0.9.1 and later versions) correctly implement the TLS
|
||||
specification, and the users cannot utilize sites which have this problem.
|
||||
|
||||
.. _technical_information:
|
||||
|
||||
`Technical Information <#technical_information>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
The **SSL 3.0** and **TLS (aka SSL 3.1)** specs both contain a provision -- the same provision --
|
||||
for detecting "version rollback attacks". It is designed to permit a server to detect a
|
||||
man-in-the-middle that is altering the SSL client hello (connection) requests as they pass from
|
||||
the client to the server, altering them by changing the protocol version number to a lower
|
||||
version number. This feature was kind of meaningless until **TLS (SSL 3.1)** came along because
|
||||
there was no version higher than 3.0 from which to be rolled back. TLS is now available and used,
|
||||
and products that have implemented the roll-back detection incorrectly are not interoperable with
|
||||
TLS/SSL spec-compliant clients. Normally the servers which have this problem are not equipped to
|
||||
deal with the TLS protocol, but instead of rolling back to SSL 3.0 as the rollback provision
|
||||
provides, they terminate/drop the connection, thus resulting in most cases a blank page display.
|
||||
|
||||
For up-to-date information, you can read a Bugzilla bug report which keeps track of this problem
|
||||
with Mozilla-based browsers. See
|
||||
`bug 59321 <https://bugzilla.mozilla.org/show_bug.cgi?id=59321>`__.
|
||||
|
||||
.. _servers_currently_known_to_exhibit_this_intolerant_behavior:
|
||||
|
||||
`Servers currently known to exhibit this intolerant behavior <#servers_currently_known_to_exhibit_this_intolerant_behavior>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
As of this writing, this problem has been reported for the following servers: (Wherever there is
|
||||
an upgraded version which fixes the problem, it is indicated by an asterisked remark in the
|
||||
parentheses. )
|
||||
|
||||
- Domino-Go-Webserver/4.6.2.6 (and perhaps some later versions)
|
||||
- IBM_HTTP_Server/1.3.6.3 or earlier (\* Update to 1.3.6.4)
|
||||
- IBM_HTTP_Server/1.3.12.1 or earlier (\* `Update to
|
||||
1.3.12.2 <http://www6.software.ibm.com/dl/websphere/http-p>`__)
|
||||
- Java Web Server 2
|
||||
- OSU/3.2 - DECthreads HTTP server for OpenVM
|
||||
- Stronghold/2.2
|
||||
- Webmail v. 3.6.1 by Infinite Technologies (\* Update available)
|
||||
|
||||
N.B. There might be servers other than those listed above which exhibit this problem. If you find
|
||||
such a server, feel free to add it to this page. For up-to-date information, you can read this
|
||||
`bug 59321 <https://bugzilla.mozilla.org/show_bug.cgi?id=59321>`__ which keeps a list of TLS/SSL
|
||||
3.0 intolerant servers.
|
||||
|
||||
.. _users:_how_to_avoid_this_problem.3f:
|
||||
|
||||
`Users: How to avoid this problem? <#users:_how_to_avoid_this_problem.3f>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
.. rubric:: Netscape 6.1 Preview Release 1, or Mozilla 0.9.1 and earlier
|
||||
:name: netscape_6.1_preview_release_1.2c_or_mozilla_0.9.1_and_earlier
|
||||
|
||||
These versions shipped with the TLS option turned **ON** as the default but with no way to deal
|
||||
with the problem servers. If you are using these old versions, please update to the latest
|
||||
Netscape or Mozilla versions. You can also avoid such a problem by editing an existing profile --
|
||||
check the preference option setting at: Edit \| Preferences \| Privacy and Security \| SSL \|
|
||||
Enable TLS, and turn it **OFF** if it is **ON** for these earlier browsers.
|
||||
|
||||
.. rubric:: Netscape 6.1 or Mozilla 0.9.2 and later
|
||||
:name: netscape_6.1_or_mozilla_0.9.2_and_later
|
||||
|
||||
These browsers shipped with the TLS option **ON** but also included a graceful rollback mechanism
|
||||
on the client side when they encounter known TLS/SSL 3.0 intolerant servers.
|
||||
|
||||
.. rubric:: Firefox 2 and later
|
||||
:name: firefox_2_and_later
|
||||
|
||||
Starting with Firefox 2, support for SSL 2.0 has been disabled by default; unless it is expressly
|
||||
re-enabled by the user using about:config. See `Security in Firefox
|
||||
2 <https://developer.mozilla.org/en-US/docs/Mozilla/Firefox/Releases/2/Security_changes>`__ for
|
||||
details.
|
||||
|
||||
.. _website_administrators:_how_to_avoid_this_problem.3f:
|
||||
|
||||
`Website Administrators: How to avoid this problem? <#website_administrators:_how_to_avoid_this_problem.3f>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
- Upgrade to a newer version if available, which corrects this problem. There will be other
|
||||
network clients which implement TLS/SSL 3.0 specification correctly and have a problem with
|
||||
your site. Let's not perpetuate the problem servers.
|
||||
- Contact the manufacturer and inquire if there is a new version available which fixes this
|
||||
problem.
|
||||
- Post a note on your site instructing users of old versions of browsers like Netscape
|
||||
6.0/6.01/6.1 Preview Release 1 and Mozilla 0.9.1 and earlier to turn **OFF** the TLS option
|
||||
at: Edit \| Preferences \| Privacy and Security \| SSL \| Enable TLS. However, this is a
|
||||
temporary workaround at best. We recommend strongly that you urge users to upgrade to the
|
||||
latest Netscape version (or at least Netscape 6.1) since the newer versions have the graceful
|
||||
rollback implemented in the code.
|
||||
- If you have questions concerning Netscape browsers and problem servers, please contact us
|
||||
using the feedback address at the top of this page.
|
||||
|
||||
.. _detecting_intolerant_servers:
|
||||
|
||||
`Detecting intolerant servers <#detecting_intolerant_servers>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
Because newer versions of Netscape and Mozilla have built-in workaround for the problem servers,
|
||||
it is now unlikely that you will experience this problem. But if you're running Netscape
|
||||
6.0/6.01/6.1 PR 1 or Mozilla build (prior to 6/11/2001), you should look out for the symptom
|
||||
described below. You may also run this test with versions later than the older versions of
|
||||
Netscape 6.x or Mozilla -- just in case code changes in Netscape 6.1/Mozilla 0.9.2 or later may
|
||||
not catch all problem servers.
|
||||
|
||||
- When you find a secure site which simply does not display any page content or drops the
|
||||
connection, check to see if the preference option Edit \| Preferences \| Privacy and Security
|
||||
\| SSL \| Enable TLS is turned **ON**. If so, turn it **OFF**.
|
||||
- Now re-visit the problem site. If the content displays this time, you are most likely
|
||||
witnessing a TLS/SSL 3.0 intolerant server.
|
||||
- Report such a problem to the server's administrator.
|
||||
|
||||
.. _how_to_report_an_intolerant_server:
|
||||
|
||||
`How to report an intolerant server <#how_to_report_an_intolerant_server>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
- *Optional:*\ Get the name of the SSL server software used by the website. To do so, add
|
||||
``http://toolbar.netcraft.com/site_report?url=`` to the beginning of the URL. The server
|
||||
software will appear next to **Server** under **SSL Certificate Information**.
|
||||
For instance, to check ``https://bugzilla.mozilla.org/``, then visit
|
||||
`http://toolbar.netcraft.com/site_rep...a.mozilla.org/ <http://toolbar.netcraft.com/site_report?url=https://bugzilla.mozilla.org/>`__.
|
||||
- Add the information on such a server (software, URL) to
|
||||
`bug 59321 <https://bugzilla.mozilla.org/show_bug.cgi?id=59321>`__ at Bugzilla. (Note: You
|
||||
will be asked to provide your email address before you can file a bug at Bugzilla.)
|
||||
|
||||
.. _original_document_information:
|
||||
|
||||
`Original Document Information <#original_document_information>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
- Author : Katsuhiko Momoi
|
||||
- Last Updated Date: January 27th, 2003
|
||||
- Copyright © 2001-2003 Netscape. All rights reserved.
|
||||
File diff suppressed because it is too large
Load diff
|
|
@ -1,271 +0,0 @@
|
|||
'\" t
|
||||
.\" Title: CMSUTIL
|
||||
.\" Author: [see the "Authors" section]
|
||||
.\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>
|
||||
.\" Date: 5 June 2014
|
||||
.\" Manual: NSS Security Tools
|
||||
.\" Source: nss-tools
|
||||
.\" Language: English
|
||||
.\"
|
||||
.TH "CMSUTIL" "1" "5 June 2014" "nss-tools" "NSS Security Tools"
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * Define some portability stuff
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
.\" http://bugs.debian.org/507673
|
||||
.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html
|
||||
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
.ie \n(.g .ds Aq \(aq
|
||||
.el .ds Aq '
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * set default formatting
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" disable hyphenation
|
||||
.nh
|
||||
.\" disable justification (adjust text to left margin only)
|
||||
.ad l
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * MAIN CONTENT STARTS HERE *
|
||||
.\" -----------------------------------------------------------------
|
||||
.SH "NAME"
|
||||
cmsutil \- Performs basic cryptograpic operations, such as encryption and decryption, on Cryptographic Message Syntax (CMS) messages\&.
|
||||
.SH "SYNOPSIS"
|
||||
.HP \w'\fBcmsutil\fR\ 'u
|
||||
\fBcmsutil\fR [\fIoptions\fR] [[\fIarguments\fR]]
|
||||
.SH "STATUS"
|
||||
.PP
|
||||
This documentation is still work in progress\&. Please contribute to the initial review in
|
||||
\m[blue]\fBMozilla NSS bug 836477\fR\m[]\&\s-2\u[1]\d\s+2
|
||||
.SH "DESCRIPTION"
|
||||
.PP
|
||||
The
|
||||
\fBcmsutil\fR
|
||||
command\-line uses the S/MIME Toolkit to perform basic operations, such as encryption and decryption, on Cryptographic Message Syntax (CMS) messages\&.
|
||||
.PP
|
||||
To run cmsutil, type the command cmsutil option [arguments] where option and arguments are combinations of the options and arguments listed in the following section\&. Each command takes one option\&. Each option may take zero or more arguments\&. To see a usage string, issue the command without options\&.
|
||||
.SH "OPTIONS AND ARGUMENTS"
|
||||
.PP
|
||||
.PP
|
||||
\fBOptions\fR
|
||||
.PP
|
||||
Options specify an action\&. Option arguments modify an action\&. The options and arguments for the cmsutil command are defined as follows:
|
||||
.PP
|
||||
\-C
|
||||
.RS 4
|
||||
Encrypt a message\&.
|
||||
.RE
|
||||
.PP
|
||||
\-D
|
||||
.RS 4
|
||||
Decode a message\&.
|
||||
.RE
|
||||
.PP
|
||||
\-E
|
||||
.RS 4
|
||||
Envelope a message\&.
|
||||
.RE
|
||||
.PP
|
||||
\-O
|
||||
.RS 4
|
||||
Create a certificates\-only message\&.
|
||||
.RE
|
||||
.PP
|
||||
\-S
|
||||
.RS 4
|
||||
Sign a message\&.
|
||||
.RE
|
||||
.PP
|
||||
\fBArguments\fR
|
||||
.PP
|
||||
Option arguments modify an action\&.
|
||||
.PP
|
||||
\-b
|
||||
.RS 4
|
||||
Decode a batch of files named in infile\&.
|
||||
.RE
|
||||
.PP
|
||||
\-c content
|
||||
.RS 4
|
||||
Use this detached content (decode only)\&.
|
||||
.RE
|
||||
.PP
|
||||
\-d dbdir
|
||||
.RS 4
|
||||
Specify the key/certificate database directory (default is "\&.")
|
||||
.RE
|
||||
.PP
|
||||
\-e envfile
|
||||
.RS 4
|
||||
Specify a file containing an enveloped message for a set of recipients to which you would like to send an encrypted message\&. If this is the first encrypted message for that set of recipients, a new enveloped message will be created that you can then use for future messages (encrypt only)\&.
|
||||
.RE
|
||||
.PP
|
||||
\-f pwfile
|
||||
.RS 4
|
||||
Use password file to set password on all PKCS#11 tokens\&.
|
||||
.RE
|
||||
.PP
|
||||
\-G
|
||||
.RS 4
|
||||
Include a signing time attribute (sign only)\&.
|
||||
.RE
|
||||
.PP
|
||||
\-H hash
|
||||
.RS 4
|
||||
Use specified hash algorithm (default:SHA1)\&.
|
||||
.RE
|
||||
.PP
|
||||
\-h num
|
||||
.RS 4
|
||||
Generate email headers with info about CMS message (decode only)\&.
|
||||
.RE
|
||||
.PP
|
||||
\-i infile
|
||||
.RS 4
|
||||
Use infile as a source of data (default is stdin)\&.
|
||||
.RE
|
||||
.PP
|
||||
\-k
|
||||
.RS 4
|
||||
Keep decoded encryption certs in permanent cert db\&.
|
||||
.RE
|
||||
.PP
|
||||
\-N nickname
|
||||
.RS 4
|
||||
Specify nickname of certificate to sign with (sign only)\&.
|
||||
.RE
|
||||
.PP
|
||||
\-n
|
||||
.RS 4
|
||||
Suppress output of contents (decode only)\&.
|
||||
.RE
|
||||
.PP
|
||||
\-o outfile
|
||||
.RS 4
|
||||
Use outfile as a destination of data (default is stdout)\&.
|
||||
.RE
|
||||
.PP
|
||||
\-P
|
||||
.RS 4
|
||||
Include an S/MIME capabilities attribute\&.
|
||||
.RE
|
||||
.PP
|
||||
\-p password
|
||||
.RS 4
|
||||
Use password as key database password\&.
|
||||
.RE
|
||||
.PP
|
||||
\-r recipient1,recipient2, \&.\&.\&.
|
||||
.RS 4
|
||||
Specify list of recipients (email addresses) for an encrypted or enveloped message\&. For certificates\-only message, list of certificates to send\&.
|
||||
.RE
|
||||
.PP
|
||||
\-T
|
||||
.RS 4
|
||||
Suppress content in CMS message (sign only)\&.
|
||||
.RE
|
||||
.PP
|
||||
\-u certusage
|
||||
.RS 4
|
||||
Set type of cert usage (default is certUsageEmailSigner)\&.
|
||||
.RE
|
||||
.PP
|
||||
\-v
|
||||
.RS 4
|
||||
Print debugging information\&.
|
||||
.RE
|
||||
.PP
|
||||
\-Y ekprefnick
|
||||
.RS 4
|
||||
Specify an encryption key preference by nickname\&.
|
||||
.RE
|
||||
.SH "USAGE"
|
||||
.PP
|
||||
Encrypt Example
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
cmsutil \-C [\-i infile] [\-o outfile] [\-d dbdir] [\-p password] \-r "recipient1,recipient2, \&. \&. \&." \-e envfile
|
||||
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.PP
|
||||
Decode Example
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
cmsutil \-D [\-i infile] [\-o outfile] [\-d dbdir] [\-p password] [\-c content] [\-n] [\-h num]
|
||||
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.PP
|
||||
Envelope Example
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
cmsutil \-E [\-i infile] [\-o outfile] [\-d dbdir] [\-p password] \-r "recipient1,recipient2, \&.\&.\&."
|
||||
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.PP
|
||||
Certificate\-only Example
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
cmsutil \-O [\-i infile] [\-o outfile] [\-d dbdir] [\-p password] \-r "cert1,cert2, \&. \&. \&."
|
||||
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.PP
|
||||
Sign Message Example
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
cmsutil \-S [\-i infile] [\-o outfile] [\-d dbdir] [\-p password] \-N nickname[\-TGP] [\-Y ekprefnick]
|
||||
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.SH "SEE ALSO"
|
||||
.PP
|
||||
certutil(1)
|
||||
.SH "ADDITIONAL RESOURCES"
|
||||
.PP
|
||||
For information about NSS and other tools related to NSS (like JSS), check out the NSS project wiki at
|
||||
\m[blue]\fBhttp://www\&.mozilla\&.org/projects/security/pki/nss/\fR\m[]\&. The NSS site relates directly to NSS code changes and releases\&.
|
||||
.PP
|
||||
Mailing lists: https://lists\&.mozilla\&.org/listinfo/dev\-tech\-crypto
|
||||
.PP
|
||||
IRC: Freenode at #dogtag\-pki
|
||||
.SH "AUTHORS"
|
||||
.PP
|
||||
The NSS tools were written and maintained by developers with Netscape, Red Hat, Sun, Oracle, Mozilla, and Google\&.
|
||||
.PP
|
||||
Authors: Elio Maldonado <emaldona@redhat\&.com>, Deon Lackey <dlackey@redhat\&.com>\&.
|
||||
.SH "LICENSE"
|
||||
.PP
|
||||
Licensed under the Mozilla Public License, v\&. 2\&.0\&. If a copy of the MPL was not distributed with this file, You can obtain one at http://mozilla\&.org/MPL/2\&.0/\&.
|
||||
.SH "NOTES"
|
||||
.IP " 1." 4
|
||||
Mozilla NSS bug 836477
|
||||
.RS 4
|
||||
\%https://bugzilla.mozilla.org/show_bug.cgi?id=836477
|
||||
.RE
|
||||
|
|
@ -1,389 +0,0 @@
|
|||
'\" t
|
||||
.\" Title: CRLUTIL
|
||||
.\" Author: [see the "Authors" section]
|
||||
.\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
|
||||
.\" Date: 19 May 2021
|
||||
.\" Manual: NSS Security Tools
|
||||
.\" Source: nss-tools
|
||||
.\" Language: English
|
||||
.\"
|
||||
.TH "CRLUTIL" "1" "19 May 2021" "nss-tools" "NSS Security Tools"
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * Define some portability stuff
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
.\" http://bugs.debian.org/507673
|
||||
.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html
|
||||
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
.ie \n(.g .ds Aq \(aq
|
||||
.el .ds Aq '
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * set default formatting
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" disable hyphenation
|
||||
.nh
|
||||
.\" disable justification (adjust text to left margin only)
|
||||
.ad l
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * MAIN CONTENT STARTS HERE *
|
||||
.\" -----------------------------------------------------------------
|
||||
.SH "NAME"
|
||||
crlutil \- List, generate, modify, or delete CRLs within the NSS security database file(s) and list, create, modify or delete certificates entries in a particular CRL\&.
|
||||
.SH "SYNOPSIS"
|
||||
.HP \w'\fBcrlutil\fR\ 'u
|
||||
\fBcrlutil\fR [\fIoptions\fR] [[\fIarguments\fR]]
|
||||
.SH "STATUS"
|
||||
.PP
|
||||
This documentation is still work in progress\&. Please contribute to the initial review in
|
||||
\m[blue]\fBMozilla NSS bug 836477\fR\m[]\&\s-2\u[1]\d\s+2
|
||||
.SH "DESCRIPTION"
|
||||
.PP
|
||||
The Certificate Revocation List (CRL) Management Tool,
|
||||
\fBcrlutil\fR, is a command\-line utility that can list, generate, modify, or delete CRLs within the NSS security database file(s) and list, create, modify or delete certificates entries in a particular CRL\&.
|
||||
.PP
|
||||
The key and certificate management process generally begins with creating keys in the key database, then generating and managing certificates in the certificate database(see certutil tool) and continues with certificates expiration or revocation\&.
|
||||
.PP
|
||||
This document discusses certificate revocation list management\&. For information on security module database management, see Using the Security Module Database Tool\&. For information on certificate and key database management, see Using the Certificate Database Tool\&.
|
||||
.PP
|
||||
To run the Certificate Revocation List Management Tool, type the command
|
||||
.PP
|
||||
crlutil option [arguments]
|
||||
.PP
|
||||
where options and arguments are combinations of the options and arguments listed in the following section\&. Each command takes one option\&. Each option may take zero or more arguments\&. To see a usage string, issue the command without options, or with the \-H option\&.
|
||||
.SH "OPTIONS AND ARGUMENTS"
|
||||
.PP
|
||||
.PP
|
||||
\fBOptions\fR
|
||||
.PP
|
||||
Options specify an action\&. Option arguments modify an action\&. The options and arguments for the crlutil command are defined as follows:
|
||||
.PP
|
||||
\-D
|
||||
.RS 4
|
||||
Delete Certificate Revocation List from cert database\&.
|
||||
.RE
|
||||
.PP
|
||||
\-E
|
||||
.RS 4
|
||||
Erase all CRLs of specified type from the cert database
|
||||
.RE
|
||||
.PP
|
||||
\-G
|
||||
.RS 4
|
||||
Create new Certificate Revocation List (CRL)\&.
|
||||
.RE
|
||||
.PP
|
||||
\-I
|
||||
.RS 4
|
||||
Import a CRL to the cert database
|
||||
.RE
|
||||
.PP
|
||||
\-L
|
||||
.RS 4
|
||||
List existing CRL located in cert database file\&.
|
||||
.RE
|
||||
.PP
|
||||
\-M
|
||||
.RS 4
|
||||
Modify existing CRL which can be located in cert db or in arbitrary file\&. If located in file it should be encoded in ASN\&.1 encode format\&.
|
||||
.RE
|
||||
.PP
|
||||
\-S
|
||||
.RS 4
|
||||
Show contents of a CRL file which isn\*(Aqt stored in the database\&.
|
||||
.RE
|
||||
.PP
|
||||
\fBArguments\fR
|
||||
.PP
|
||||
Option arguments modify an action\&.
|
||||
.PP
|
||||
\-a
|
||||
.RS 4
|
||||
Use ASCII format or allow the use of ASCII format for input and output\&. This formatting follows RFC #1113\&.
|
||||
.RE
|
||||
.PP
|
||||
\-B
|
||||
.RS 4
|
||||
Bypass CA signature checks\&.
|
||||
.RE
|
||||
.PP
|
||||
\-c crl\-gen\-file
|
||||
.RS 4
|
||||
Specify script file that will be used to control crl generation/modification\&. See crl\-cript\-file format below\&. If options \-M|\-G is used and \-c crl\-script\-file is not specified, crlutil will read script data from standard input\&.
|
||||
.RE
|
||||
.PP
|
||||
\-d directory
|
||||
.RS 4
|
||||
Specify the database directory containing the certificate and key database files\&. On Unix the Certificate Database Tool defaults to $HOME/\&.netscape (that is, ~/\&.netscape)\&. On Windows NT the default is the current directory\&.
|
||||
.sp
|
||||
The NSS database files must reside in the same directory\&.
|
||||
.RE
|
||||
.PP
|
||||
\-f password\-file
|
||||
.RS 4
|
||||
Specify a file that will automatically supply the password to include in a certificate or to access a certificate database\&. This is a plain\-text file containing one password\&. Be sure to prevent unauthorized access to this file\&.
|
||||
.RE
|
||||
.PP
|
||||
\-i crl\-file
|
||||
.RS 4
|
||||
Specify the file which contains the CRL to import or show\&.
|
||||
.RE
|
||||
.PP
|
||||
\-l algorithm\-name
|
||||
.RS 4
|
||||
Specify a specific signature algorithm\&. List of possible algorithms: MD2 | MD4 | MD5 | SHA1 | SHA256 | SHA384 | SHA512
|
||||
.RE
|
||||
.PP
|
||||
\-n nickname
|
||||
.RS 4
|
||||
Specify the nickname of a certificate or key to list, create, add to a database, modify, or validate\&. Bracket the nickname string with quotation marks if it contains spaces\&.
|
||||
.RE
|
||||
.PP
|
||||
\-o output\-file
|
||||
.RS 4
|
||||
Specify the output file name for new CRL\&. Bracket the output\-file string with quotation marks if it contains spaces\&. If this argument is not used the output destination defaults to standard output\&.
|
||||
.RE
|
||||
.PP
|
||||
\-P dbprefix
|
||||
.RS 4
|
||||
Specify the prefix used on the NSS security database files (for example, my_cert8\&.db and my_key3\&.db)\&. This option is provided as a special case\&. Changing the names of the certificate and key databases is not recommended\&.
|
||||
.RE
|
||||
.PP
|
||||
\-t crl\-type
|
||||
.RS 4
|
||||
Specify type of CRL\&. possible types are: 0 \- SEC_KRL_TYPE, 1 \- SEC_CRL_TYPE\&. This option is obsolete
|
||||
.RE
|
||||
.PP
|
||||
\-u url
|
||||
.RS 4
|
||||
Specify the url\&.
|
||||
.RE
|
||||
.PP
|
||||
\-w pwd\-string
|
||||
.RS 4
|
||||
Provide db password in command line\&.
|
||||
.RE
|
||||
.PP
|
||||
\-Z algorithm
|
||||
.RS 4
|
||||
Specify the hash algorithm to use for signing the CRL\&.
|
||||
.RE
|
||||
.SH "CRL GENERATION SCRIPT SYNTAX"
|
||||
.PP
|
||||
CRL generation script file has the following syntax:
|
||||
.PP
|
||||
* Line with comments should have # as a first symbol of a line
|
||||
.PP
|
||||
* Set "this update" or "next update" CRL fields:
|
||||
.PP
|
||||
update=YYYYMMDDhhmmssZ nextupdate=YYYYMMDDhhmmssZ
|
||||
.PP
|
||||
Field "next update" is optional\&. Time should be in GeneralizedTime format (YYYYMMDDhhmmssZ)\&. For example: 20050204153000Z
|
||||
.PP
|
||||
* Add an extension to a CRL or a crl certificate entry:
|
||||
.PP
|
||||
addext extension\-name critical/non\-critical [arg1[arg2 \&.\&.\&.]]
|
||||
.PP
|
||||
Where:
|
||||
.PP
|
||||
extension\-name: string value of a name of known extensions\&. critical/non\-critical: is 1 when extension is critical and 0 otherwise\&. arg1, arg2: specific to extension type extension parameters
|
||||
.PP
|
||||
addext uses the range that was set earlier by addcert and will install an extension to every cert entries within the range\&.
|
||||
.PP
|
||||
* Add certificate entries(s) to CRL:
|
||||
.PP
|
||||
addcert range date
|
||||
.PP
|
||||
range: two integer values separated by dash: range of certificates that will be added by this command\&. dash is used as a delimiter\&. Only one cert will be added if there is no delimiter\&. date: revocation date of a cert\&. Date should be represented in GeneralizedTime format (YYYYMMDDhhmmssZ)\&.
|
||||
.PP
|
||||
* Remove certificate entry(s) from CRL
|
||||
.PP
|
||||
rmcert range
|
||||
.PP
|
||||
Where:
|
||||
.PP
|
||||
range: two integer values separated by dash: range of certificates that will be added by this command\&. dash is used as a delimiter\&. Only one cert will be added if there is no delimiter\&.
|
||||
.PP
|
||||
* Change range of certificate entry(s) in CRL
|
||||
.PP
|
||||
range new\-range
|
||||
.PP
|
||||
Where:
|
||||
.PP
|
||||
new\-range: two integer values separated by dash: range of certificates that will be added by this command\&. dash is used as a delimiter\&. Only one cert will be added if there is no delimiter\&.
|
||||
.PP
|
||||
Implemented Extensions
|
||||
.PP
|
||||
The extensions defined for CRL provide methods for associating additional attributes with CRLs of theirs entries\&. For more information see RFC #3280
|
||||
.PP
|
||||
* Add The Authority Key Identifier extension:
|
||||
.PP
|
||||
The authority key identifier extension provides a means of identifying the public key corresponding to the private key used to sign a CRL\&.
|
||||
.PP
|
||||
authKeyId critical [key\-id | dn cert\-serial]
|
||||
.PP
|
||||
Where:
|
||||
.PP
|
||||
authKeyIdent: identifies the name of an extension critical: value of 1 of 0\&. Should be set to 1 if this extension is critical or 0 otherwise\&. key\-id: key identifier represented in octet string\&. dn:: is a CA distinguished name cert\-serial: authority certificate serial number\&.
|
||||
.PP
|
||||
* Add Issuer Alternative Name extension:
|
||||
.PP
|
||||
The issuer alternative names extension allows additional identities to be associated with the issuer of the CRL\&. Defined options include an rfc822 name (electronic mail address), a DNS name, an IP address, and a URI\&.
|
||||
.PP
|
||||
issuerAltNames non\-critical name\-list
|
||||
.PP
|
||||
Where:
|
||||
.PP
|
||||
subjAltNames: identifies the name of an extension should be set to 0 since this is non\-critical extension name\-list: comma separated list of names
|
||||
.PP
|
||||
* Add CRL Number extension:
|
||||
.PP
|
||||
The CRL number is a non\-critical CRL extension which conveys a monotonically increasing sequence number for a given CRL scope and CRL issuer\&. This extension allows users to easily determine when a particular CRL supersedes another CRL
|
||||
.PP
|
||||
crlNumber non\-critical number
|
||||
.PP
|
||||
Where:
|
||||
.PP
|
||||
crlNumber: identifies the name of an extension critical: should be set to 0 since this is non\-critical extension number: value of long which identifies the sequential number of a CRL\&.
|
||||
.PP
|
||||
* Add Revocation Reason Code extension:
|
||||
.PP
|
||||
The reasonCode is a non\-critical CRL entry extension that identifies the reason for the certificate revocation\&.
|
||||
.PP
|
||||
reasonCode non\-critical code
|
||||
.PP
|
||||
Where:
|
||||
.PP
|
||||
reasonCode: identifies the name of an extension non\-critical: should be set to 0 since this is non\-critical extension code: the following codes are available:
|
||||
.PP
|
||||
unspecified (0), keyCompromise (1), cACompromise (2), affiliationChanged (3), superseded (4), cessationOfOperation (5), certificateHold (6), removeFromCRL (8), privilegeWithdrawn (9), aACompromise (10)
|
||||
.PP
|
||||
* Add Invalidity Date extension:
|
||||
.PP
|
||||
The invalidity date is a non\-critical CRL entry extension that provides the date on which it is known or suspected that the private key was compromised or that the certificate otherwise became invalid\&.
|
||||
.PP
|
||||
invalidityDate non\-critical date
|
||||
.PP
|
||||
Where:
|
||||
.PP
|
||||
crlNumber: identifies the name of an extension non\-critical: should be set to 0 since this is non\-critical extension date: invalidity date of a cert\&. Date should be represented in GeneralizedTime format (YYYYMMDDhhmmssZ)\&.
|
||||
.SH "USAGE"
|
||||
.PP
|
||||
The Certificate Revocation List Management Tool\*(Aqs capabilities are grouped as follows, using these combinations of options and arguments\&. Options and arguments in square brackets are optional, those without square brackets are required\&.
|
||||
.PP
|
||||
See "Implemented extensions" for more information regarding extensions and their parameters\&.
|
||||
.PP
|
||||
* Creating or modifying a CRL:
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
crlutil \-G|\-M \-c crl\-gen\-file \-n nickname [\-i crl] [\-u url] [\-d keydir] [\-P dbprefix] [\-l alg] [\-a] [\-B]
|
||||
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.PP
|
||||
* Listing all CRls or a named CRL:
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
crlutil \-L [\-n crl\-name] [\-d krydir]
|
||||
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.PP
|
||||
* Deleting CRL from db:
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
crlutil \-D \-n nickname [\-d keydir] [\-P dbprefix]
|
||||
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.PP
|
||||
* Erasing CRLs from db:
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
crlutil \-E [\-d keydir] [\-P dbprefix]
|
||||
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.PP
|
||||
* Deleting CRL from db:
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
crlutil \-D \-n nickname [\-d keydir] [\-P dbprefix]
|
||||
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.PP
|
||||
* Erasing CRLs from db:
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
crlutil \-E [\-d keydir] [\-P dbprefix]
|
||||
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.PP
|
||||
* Import CRL from file:
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
crlutil \-I \-i crl [\-t crlType] [\-u url] [\-d keydir] [\-P dbprefix] [\-B]
|
||||
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.SH "SEE ALSO"
|
||||
.PP
|
||||
certutil(1)
|
||||
.SH "ADDITIONAL RESOURCES"
|
||||
.PP
|
||||
For information about NSS and other tools related to NSS (like JSS), check out the NSS project wiki at
|
||||
\m[blue]\fBhttp://www\&.mozilla\&.org/projects/security/pki/nss/\fR\m[]\&. The NSS site relates directly to NSS code changes and releases\&.
|
||||
.PP
|
||||
Mailing lists: https://lists\&.mozilla\&.org/listinfo/dev\-tech\-crypto
|
||||
.PP
|
||||
IRC: Freenode at #dogtag\-pki
|
||||
.SH "AUTHORS"
|
||||
.PP
|
||||
The NSS tools were written and maintained by developers with Netscape, Red Hat, Sun, Oracle, Mozilla, and Google\&.
|
||||
.PP
|
||||
Authors: Elio Maldonado <emaldona@redhat\&.com>, Deon Lackey <dlackey@redhat\&.com>\&.
|
||||
.SH "LICENSE"
|
||||
.PP
|
||||
Licensed under the Mozilla Public License, v\&. 2\&.0\&. If a copy of the MPL was not distributed with this file, You can obtain one at http://mozilla\&.org/MPL/2\&.0/\&.
|
||||
.SH "NOTES"
|
||||
.IP " 1." 4
|
||||
Mozilla NSS bug 836477
|
||||
.RS 4
|
||||
\%https://bugzilla.mozilla.org/show_bug.cgi?id=836477
|
||||
.RE
|
||||
|
|
@ -1,92 +0,0 @@
|
|||
'\" t
|
||||
.\" Title: DERDUMP
|
||||
.\" Author: [see the "Authors" section]
|
||||
.\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
|
||||
.\" Date: 19 May 2021
|
||||
.\" Manual: NSS Security Tools
|
||||
.\" Source: nss-tools
|
||||
.\" Language: English
|
||||
.\"
|
||||
.TH "DERDUMP" "1" "19 May 2021" "nss-tools" "NSS Security Tools"
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * Define some portability stuff
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
.\" http://bugs.debian.org/507673
|
||||
.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html
|
||||
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
.ie \n(.g .ds Aq \(aq
|
||||
.el .ds Aq '
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * set default formatting
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" disable hyphenation
|
||||
.nh
|
||||
.\" disable justification (adjust text to left margin only)
|
||||
.ad l
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * MAIN CONTENT STARTS HERE *
|
||||
.\" -----------------------------------------------------------------
|
||||
.SH "NAME"
|
||||
derdump_ \- Dumps C\-sequence strings from a DER encoded certificate file
|
||||
.SH "SYNOPSIS"
|
||||
.HP \w'\fBderdump\fR\ 'u
|
||||
\fBderdump\fR [\fB\-r\fR] [\fB\-i\ \fR\fB\fIinput\-file\fR\fR] [\fB\-o\ \fR\fB\fIoutput\-file\fR\fR]
|
||||
.SH "STATUS"
|
||||
.PP
|
||||
This documentation is still work in progress\&. Please contribute to the initial review in
|
||||
\m[blue]\fBMozilla NSS bug 836477\fR\m[]\&\s-2\u[1]\d\s+2
|
||||
.SH "DESCRIPTION"
|
||||
.PP
|
||||
\fBderdump \fRdumps C\-sequence strings from a DER encode certificate file
|
||||
.SH "OPTIONS"
|
||||
.PP
|
||||
\fB\-r \fR
|
||||
.RS 4
|
||||
For formatted items, dump raw bytes as well
|
||||
.RE
|
||||
.PP
|
||||
\fB\-i \fR \fIDER encoded file\fR
|
||||
.RS 4
|
||||
Define an input file to use (default is stdin)
|
||||
.RE
|
||||
.PP
|
||||
\fB\-o \fR \fIoutput file\fR
|
||||
.RS 4
|
||||
Define an output file to use (default is stdout)\&.
|
||||
.RE
|
||||
.SH "ADDITIONAL RESOURCES"
|
||||
.PP
|
||||
NSS is maintained in conjunction with PKI and security\-related projects through Mozilla dn Fedora\&. The most closely\-related project is Dogtag PKI, with a project wiki at
|
||||
\m[blue]\fBPKI Wiki\fR\m[]\&\s-2\u[2]\d\s+2\&.
|
||||
.PP
|
||||
For information specifically about NSS, the NSS project wiki is located at
|
||||
\m[blue]\fBMozilla NSS site\fR\m[]\&\s-2\u[3]\d\s+2\&. The NSS site relates directly to NSS code changes and releases\&.
|
||||
.PP
|
||||
Mailing lists: pki\-devel@redhat\&.com and pki\-users@redhat\&.com
|
||||
.PP
|
||||
IRC: Freenode at #dogtag\-pki
|
||||
.SH "AUTHORS"
|
||||
.PP
|
||||
The NSS tools were written and maintained by developers with Netscape, Red Hat, Sun, Oracle, Mozilla, and Google\&.
|
||||
.PP
|
||||
Authors: Gerhardus Geldenhuis <gerhardus\&.geldenhuis@gmail\&.com>\&. Elio Maldonado <emaldona@redhat\&.com>, Deon Lackey <dlackey@redhat\&.com>
|
||||
.SH "LICENSE"
|
||||
.PP
|
||||
Licensed under the Mozilla Public License, v\&. 2\&.0\&. If a copy of the MPL was not distributed with this file, You can obtain one at http://mozilla\&.org/MPL/2\&.0/\&.
|
||||
.SH "NOTES"
|
||||
.IP " 1." 4
|
||||
Mozilla NSS bug 836477
|
||||
.RS 4
|
||||
\%https://bugzilla.mozilla.org/show_bug.cgi?id=836477
|
||||
.RE
|
||||
.IP " 2." 4
|
||||
PKI Wiki
|
||||
.RS 4
|
||||
\%http://pki.fedoraproject.org/wiki/
|
||||
.RE
|
||||
.IP " 3." 4
|
||||
Mozilla NSS site
|
||||
.RS 4
|
||||
\%http://www.mozilla.org/projects/security/pki/nss/
|
||||
.RE
|
||||
File diff suppressed because it is too large
Load diff
|
|
@ -1,872 +0,0 @@
|
|||
'\" t
|
||||
.\" Title: PK12UTIL
|
||||
.\" Author: [see the "Authors" section]
|
||||
.\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
|
||||
.\" Date: 19 May 2021
|
||||
.\" Manual: NSS Security Tools
|
||||
.\" Source: nss-tools
|
||||
.\" Language: English
|
||||
.\"
|
||||
.TH "PK12UTIL" "1" "19 May 2021" "nss-tools" "NSS Security Tools"
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * Define some portability stuff
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
.\" http://bugs.debian.org/507673
|
||||
.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html
|
||||
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
.ie \n(.g .ds Aq \(aq
|
||||
.el .ds Aq '
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * set default formatting
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" disable hyphenation
|
||||
.nh
|
||||
.\" disable justification (adjust text to left margin only)
|
||||
.ad l
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * MAIN CONTENT STARTS HERE *
|
||||
.\" -----------------------------------------------------------------
|
||||
.SH "NAME"
|
||||
pk12util \- Export and import keys and certificate to or from a PKCS #12 file and the NSS database
|
||||
.SH "SYNOPSIS"
|
||||
.HP \w'\fBpk12util\fR\ 'u
|
||||
\fBpk12util\fR [\-i\ p12File|\-l\ p12File|\-o\ p12File] [\-c\ keyCipher] [\-C\ certCipher] [\-d\ directory] [\-h\ tokenname] [\-m\ |\ \-\-key\-len\ keyLength] [\-M\ hashAlg] [\-n\ certname] [\-P\ dbprefix] [\-r] [\-v] [\-\-cert\-key\-len\ certKeyLength] [\-k\ slotPasswordFile|\-K\ slotPassword] [\-w\ p12filePasswordFile|\-W\ p12filePassword]
|
||||
.SH "STATUS"
|
||||
.PP
|
||||
This documentation is still work in progress\&. Please contribute to the initial review in
|
||||
\m[blue]\fBMozilla NSS bug 836477\fR\m[]\&\s-2\u[1]\d\s+2
|
||||
.SH "DESCRIPTION"
|
||||
.PP
|
||||
The PKCS #12 utility,
|
||||
\fBpk12util\fR, enables sharing certificates among any server that supports PKCS #12\&. The tool can import certificates and keys from PKCS #12 files into security databases, export certificates, and list certificates and keys\&.
|
||||
.SH "OPTIONS AND ARGUMENTS"
|
||||
.PP
|
||||
\fBOptions\fR
|
||||
.PP
|
||||
\-i p12file
|
||||
.RS 4
|
||||
Import keys and certificates from a PKCS #12 file into a security database\&.
|
||||
.RE
|
||||
.PP
|
||||
\-l p12file
|
||||
.RS 4
|
||||
List the keys and certificates in PKCS #12 file\&.
|
||||
.RE
|
||||
.PP
|
||||
\-o p12file
|
||||
.RS 4
|
||||
Export keys and certificates from the security database to a PKCS #12 file\&.
|
||||
.RE
|
||||
.PP
|
||||
\fBArguments\fR
|
||||
.PP
|
||||
\-c keyCipher
|
||||
.RS 4
|
||||
Specify the key encryption algorithm\&.
|
||||
.RE
|
||||
.PP
|
||||
\-C certCipher
|
||||
.RS 4
|
||||
Specify the certiticate encryption algorithm\&.
|
||||
.RE
|
||||
.PP
|
||||
\-d directory
|
||||
.RS 4
|
||||
Specify the database directory into which to import to or export from certificates and keys\&.
|
||||
.sp
|
||||
\fBpk12util\fR
|
||||
supports two types of databases: the legacy security databases (cert8\&.db,
|
||||
key3\&.db, and
|
||||
secmod\&.db) and new SQLite databases (cert9\&.db,
|
||||
key4\&.db, and
|
||||
pkcs11\&.txt)\&. If the prefix
|
||||
\fBdbm:\fR
|
||||
is not used, then the tool assumes that the given databases are in the SQLite format\&.
|
||||
.RE
|
||||
.PP
|
||||
\-h tokenname
|
||||
.RS 4
|
||||
Specify the name of the token to import into or export from\&.
|
||||
.RE
|
||||
.PP
|
||||
\-k slotPasswordFile
|
||||
.RS 4
|
||||
Specify the text file containing the slot\*(Aqs password\&.
|
||||
.RE
|
||||
.PP
|
||||
\-K slotPassword
|
||||
.RS 4
|
||||
Specify the slot\*(Aqs password\&.
|
||||
.RE
|
||||
.PP
|
||||
\-m | \-\-key\-len keyLength
|
||||
.RS 4
|
||||
Specify the desired length of the symmetric key to be used to encrypt the private key\&.
|
||||
.RE
|
||||
.PP
|
||||
\-M hashAlg
|
||||
.RS 4
|
||||
Specify the hash algorithm used in the pkcs #12 mac\&. This algorithm also specifies the HMAC used in the prf when using pkcs #5 v2\&.
|
||||
.RE
|
||||
.PP
|
||||
\-\-cert\-key\-len certKeyLength
|
||||
.RS 4
|
||||
Specify the desired length of the symmetric key to be used to encrypt the certificates and other meta\-data\&.
|
||||
.RE
|
||||
.PP
|
||||
\-n certname
|
||||
.RS 4
|
||||
Specify the nickname of the cert and private key to export\&.
|
||||
.sp
|
||||
The nickname can also be a PKCS #11 URI\&. For example, if you have a certificate named "my\-server\-cert" on the internal certificate store, it can be unambiguously specified as "pkcs11:token=NSS%20Certificate%20DB;object=my\-server\-cert"\&. For details about the format, see RFC 7512\&.
|
||||
.RE
|
||||
.PP
|
||||
\-P prefix
|
||||
.RS 4
|
||||
Specify the prefix used on the certificate and key databases\&. This option is provided as a special case\&. Changing the names of the certificate and key databases is not recommended\&.
|
||||
.RE
|
||||
.PP
|
||||
\-r
|
||||
.RS 4
|
||||
Dumps all of the data in raw (binary) form\&. This must be saved as a DER file\&. The default is to return information in a pretty\-print ASCII format, which displays the information about the certificates and public keys in the p12 file\&.
|
||||
.RE
|
||||
.PP
|
||||
\-v
|
||||
.RS 4
|
||||
Enable debug logging when importing\&.
|
||||
.RE
|
||||
.PP
|
||||
\-w p12filePasswordFile
|
||||
.RS 4
|
||||
Specify the text file containing the pkcs #12 file password\&.
|
||||
.RE
|
||||
.PP
|
||||
\-W p12filePassword
|
||||
.RS 4
|
||||
Specify the pkcs #12 file password\&.
|
||||
.RE
|
||||
.SH "RETURN CODES"
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
0 \- No error
|
||||
.RE
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
1 \- User Cancelled
|
||||
.RE
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
2 \- Usage error
|
||||
.RE
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
6 \- NLS init error
|
||||
.RE
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
8 \- Certificate DB open error
|
||||
.RE
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
9 \- Key DB open error
|
||||
.RE
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
10 \- File initialization error
|
||||
.RE
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
11 \- Unicode conversion error
|
||||
.RE
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
12 \- Temporary file creation error
|
||||
.RE
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
13 \- PKCS11 get slot error
|
||||
.RE
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
14 \- PKCS12 decoder start error
|
||||
.RE
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
15 \- error read from import file
|
||||
.RE
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
16 \- pkcs12 decode error
|
||||
.RE
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
17 \- pkcs12 decoder verify error
|
||||
.RE
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
18 \- pkcs12 decoder validate bags error
|
||||
.RE
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
19 \- pkcs12 decoder import bags error
|
||||
.RE
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
20 \- key db conversion version 3 to version 2 error
|
||||
.RE
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
21 \- cert db conversion version 7 to version 5 error
|
||||
.RE
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
22 \- cert and key dbs patch error
|
||||
.RE
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
23 \- get default cert db error
|
||||
.RE
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
24 \- find cert by nickname error
|
||||
.RE
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
25 \- create export context error
|
||||
.RE
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
26 \- PKCS12 add password itegrity error
|
||||
.RE
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
27 \- cert and key Safes creation error
|
||||
.RE
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
28 \- PKCS12 add cert and key error
|
||||
.RE
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
29 \- PKCS12 encode error
|
||||
.RE
|
||||
.SH "EXAMPLES"
|
||||
.PP
|
||||
\fBImporting Keys and Certificates\fR
|
||||
.PP
|
||||
The most basic usage of
|
||||
\fBpk12util\fR
|
||||
for importing a certificate or key is the PKCS #12 input file (\fB\-i\fR) and some way to specify the security database being accessed (either
|
||||
\fB\-d\fR
|
||||
for a directory or
|
||||
\fB\-h\fR
|
||||
for a token)\&.
|
||||
.PP
|
||||
pk12util \-i p12File [\-h tokenname] [\-v] [\-d directory] [\-P dbprefix] [\-k slotPasswordFile|\-K slotPassword] [\-w p12filePasswordFile|\-W p12filePassword]
|
||||
.PP
|
||||
For example:
|
||||
.PP
|
||||
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
# pk12util \-i /tmp/cert\-files/users\&.p12 \-d /home/my/sharednssdb
|
||||
|
||||
Enter a password which will be used to encrypt your keys\&.
|
||||
The password should be at least 8 characters long,
|
||||
and should contain at least one non\-alphabetic character\&.
|
||||
|
||||
Enter new password:
|
||||
Re\-enter password:
|
||||
Enter password for PKCS12 file:
|
||||
pk12util: PKCS12 IMPORT SUCCESSFUL
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.PP
|
||||
\fBExporting Keys and Certificates\fR
|
||||
.PP
|
||||
Using the
|
||||
\fBpk12util\fR
|
||||
command to export certificates and keys requires both the name of the certificate to extract from the database (\fB\-n\fR) and the PKCS #12\-formatted output file to write to\&. There are optional parameters that can be used to encrypt the file to protect the certificate material\&.
|
||||
.PP
|
||||
pk12util \-o p12File \-n certname [\-c keyCipher] [\-C certCipher] [\-m|\-\-key_len keyLen] [\-n|\-\-cert_key_len certKeyLen] [\-d directory] [\-P dbprefix] [\-k slotPasswordFile|\-K slotPassword] [\-w p12filePasswordFile|\-W p12filePassword]
|
||||
.PP
|
||||
For example:
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
# pk12util \-o certs\&.p12 \-n Server\-Cert \-d /home/my/sharednssdb
|
||||
Enter password for PKCS12 file:
|
||||
Re\-enter password:
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.PP
|
||||
\fBListing Keys and Certificates\fR
|
||||
.PP
|
||||
The information in a
|
||||
\&.p12
|
||||
file are not human\-readable\&. The certificates and keys in the file can be printed (listed) in a human\-readable pretty\-print format that shows information for every certificate and any public keys in the
|
||||
\&.p12
|
||||
file\&.
|
||||
.PP
|
||||
pk12util \-l p12File [\-h tokenname] [\-r] [\-d directory] [\-P dbprefix] [\-k slotPasswordFile|\-K slotPassword] [\-w p12filePasswordFile|\-W p12filePassword]
|
||||
.PP
|
||||
For example, this prints the default ASCII output:
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
# pk12util \-l certs\&.p12
|
||||
|
||||
Enter password for PKCS12 file:
|
||||
Key(shrouded):
|
||||
Friendly Name: Thawte Freemail Member\*(Aqs Thawte Consulting (Pty) Ltd\&. ID
|
||||
|
||||
Encryption algorithm: PKCS #12 V2 PBE With SHA\-1 And 3KEY Triple DES\-CBC
|
||||
Parameters:
|
||||
Salt:
|
||||
45:2e:6a:a0:03:4d:7b:a1:63:3c:15:ea:67:37:62:1f
|
||||
Iteration Count: 1 (0x1)
|
||||
Certificate:
|
||||
Data:
|
||||
Version: 3 (0x2)
|
||||
Serial Number: 13 (0xd)
|
||||
Signature Algorithm: PKCS #1 SHA\-1 With RSA Encryption
|
||||
Issuer: "E=personal\-freemail@thawte\&.com,CN=Thawte Personal Freemail C
|
||||
A,OU=Certification Services Division,O=Thawte Consulting,L=Cape T
|
||||
own,ST=Western Cape,C=ZA"
|
||||
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.PP
|
||||
Alternatively, the
|
||||
\fB\-r\fR
|
||||
prints the certificates and then exports them into separate DER binary files\&. This allows the certificates to be fed to another application that supports
|
||||
\&.p12
|
||||
files\&. Each certificate is written to a sequentially\-number file, beginning with
|
||||
file0001\&.der
|
||||
and continuing through
|
||||
file000N\&.der, incrementing the number for every certificate:
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
pk12util \-l test\&.p12 \-r
|
||||
Enter password for PKCS12 file:
|
||||
Key(shrouded):
|
||||
Friendly Name: Thawte Freemail Member\*(Aqs Thawte Consulting (Pty) Ltd\&. ID
|
||||
|
||||
Encryption algorithm: PKCS #12 V2 PBE With SHA\-1 And 3KEY Triple DES\-CBC
|
||||
Parameters:
|
||||
Salt:
|
||||
45:2e:6a:a0:03:4d:7b:a1:63:3c:15:ea:67:37:62:1f
|
||||
Iteration Count: 1 (0x1)
|
||||
Certificate Friendly Name: Thawte Personal Freemail Issuing CA \- Thawte Consulting
|
||||
|
||||
Certificate Friendly Name: Thawte Freemail Member\*(Aqs Thawte Consulting (Pty) Ltd\&. ID
|
||||
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.SH "PASSWORD ENCRYPTION"
|
||||
.PP
|
||||
PKCS #12 provides for not only the protection of the private keys but also the certificate and meta\-data associated with the keys\&. Password\-based encryption is used to protect private keys on export to a PKCS #12 file and, optionally, the associated certificates\&. If no algorithm is specified, the tool defaults to using PKCS #12 SHA\-1 and 3\-key triple DES for private key encryption\&. When not in FIPS mode, PKCS #12 SHA\-1 and 40\-bit RC4 is used for certificate encryption\&. When in FIPS mode, there is no certificate encryption\&. If certificate encryption is not wanted, specify
|
||||
\fB"NONE"\fR
|
||||
as the argument of the
|
||||
\fB\-C\fR
|
||||
option\&.
|
||||
.PP
|
||||
The private key is always protected with strong encryption by default\&.
|
||||
.PP
|
||||
Several types of ciphers are supported\&.
|
||||
.PP
|
||||
PKCS #5 password\-based encryption
|
||||
.RS 4
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
PBES2 with AES\-CBC\-Pad as underlying encryption scheme (\fB"AES\-128\-CBC"\fR,
|
||||
\fB"AES\-192\-CBC"\fR, and
|
||||
\fB"AES\-256\-CBC"\fR)
|
||||
.RE
|
||||
.RE
|
||||
.PP
|
||||
PKCS #12 password\-based encryption
|
||||
.RS 4
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
SHA\-1 and 128\-bit RC4 (\fB"PKCS #12 V2 PBE With SHA\-1 And 128 Bit RC4"\fR
|
||||
or
|
||||
\fB"RC4"\fR)
|
||||
.RE
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
SHA\-1 and 40\-bit RC4 (\fB"PKCS #12 V2 PBE With SHA\-1 And 40 Bit RC4"\fR) (used by default for certificate encryption in non\-FIPS mode)
|
||||
.RE
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
SHA\-1 and 3\-key triple\-DES (\fB"PKCS #12 V2 PBE With SHA\-1 And 3KEY Triple DES\-CBC"\fR
|
||||
or
|
||||
\fB"DES\-EDE3\-CBC"\fR)
|
||||
.RE
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
SHA\-1 and 128\-bit RC2 (\fB"PKCS #12 V2 PBE With SHA\-1 And 128 Bit RC2 CBC"\fR
|
||||
or
|
||||
\fB"RC2\-CBC"\fR)
|
||||
.RE
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
SHA\-1 and 40\-bit RC2 (\fB"PKCS #12 V2 PBE With SHA\-1 And 40 Bit RC2 CBC"\fR)
|
||||
.RE
|
||||
.RE
|
||||
.PP
|
||||
With PKCS #12, the crypto provider may be the soft token module or an external hardware module\&. If the cryptographic module does not support the requested algorithm, then the next best fit will be selected (usually the default)\&. If no suitable replacement for the desired algorithm can be found, the tool returns the error
|
||||
\fIno security module can perform the requested operation\fR\&.
|
||||
.SH "NSS DATABASE TYPES"
|
||||
.PP
|
||||
NSS originally used BerkeleyDB databases to store security information\&. The last versions of these
|
||||
\fIlegacy\fR
|
||||
databases are:
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
cert8\&.db for certificates
|
||||
.RE
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
key3\&.db for keys
|
||||
.RE
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
secmod\&.db for PKCS #11 module information
|
||||
.RE
|
||||
.PP
|
||||
BerkeleyDB has performance limitations, though, which prevent it from being easily used by multiple applications simultaneously\&. NSS has some flexibility that allows applications to use their own, independent database engine while keeping a shared database and working around the access issues\&. Still, NSS requires more flexibility to provide a truly shared security database\&.
|
||||
.PP
|
||||
In 2009, NSS introduced a new set of databases that are SQLite databases rather than BerkleyDB\&. These new databases provide more accessibility and performance:
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
cert9\&.db for certificates
|
||||
.RE
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
key4\&.db for keys
|
||||
.RE
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
pkcs11\&.txt, which is listing of all of the PKCS #11 modules contained in a new subdirectory in the security databases directory
|
||||
.RE
|
||||
.PP
|
||||
Because the SQLite databases are designed to be shared, these are the
|
||||
\fIshared\fR
|
||||
database type\&. The shared database type is preferred; the legacy format is included for backward compatibility\&.
|
||||
.PP
|
||||
By default, the tools (\fBcertutil\fR,
|
||||
\fBpk12util\fR,
|
||||
\fBmodutil\fR) assume that the given security databases use the SQLite type Using the legacy databases must be manually specified by using the
|
||||
\fBdbm:\fR
|
||||
prefix with the given security directory\&. For example:
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
# pk12util \-i /tmp/cert\-files/users\&.p12 \-d dbm:/home/my/sharednssdb
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.PP
|
||||
To set the legacy database type as the default type for the tools, set the
|
||||
\fBNSS_DEFAULT_DB_TYPE\fR
|
||||
environment variable to
|
||||
\fBdbm\fR:
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
export NSS_DEFAULT_DB_TYPE="dbm"
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.PP
|
||||
This line can be set added to the
|
||||
~/\&.bashrc
|
||||
file to make the change permanent\&.
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
https://wiki\&.mozilla\&.org/NSS_Shared_DB_Howto
|
||||
.RE
|
||||
.PP
|
||||
For an engineering draft on the changes in the shared NSS databases, see the NSS project wiki:
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
https://wiki\&.mozilla\&.org/NSS_Shared_DB
|
||||
.RE
|
||||
.SH "COMPATIBILITY NOTES"
|
||||
.PP
|
||||
The exporting behavior of
|
||||
\fBpk12util\fR
|
||||
has changed over time, while importing files exported with older versions of NSS is still supported\&.
|
||||
.PP
|
||||
Until the 3\&.30 release,
|
||||
\fBpk12util\fR
|
||||
used the UTF\-16 encoding for the PKCS #5 password\-based encryption schemes, while the recommendation is to encode passwords in UTF\-8 if the used encryption scheme is defined outside of the PKCS #12 standard\&.
|
||||
.PP
|
||||
Until the 3\&.31 release, even when
|
||||
\fB"AES\-128\-CBC"\fR
|
||||
or
|
||||
\fB"AES\-192\-CBC"\fR
|
||||
is given from the command line,
|
||||
\fBpk12util\fR
|
||||
always used 256\-bit AES as the underlying encryption scheme\&.
|
||||
.PP
|
||||
For historical reasons,
|
||||
\fBpk12util\fR
|
||||
accepts password\-based encryption schemes not listed in this document\&. However, those schemes are not officially supported and may have issues in interoperability with other tools\&.
|
||||
.SH "SEE ALSO"
|
||||
.PP
|
||||
certutil (1)
|
||||
.PP
|
||||
modutil (1)
|
||||
.PP
|
||||
The NSS wiki has information on the new database design and how to configure applications to use it\&.
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
https://wiki\&.mozilla\&.org/NSS_Shared_DB_Howto
|
||||
.RE
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
https://wiki\&.mozilla\&.org/NSS_Shared_DB
|
||||
.RE
|
||||
.SH "ADDITIONAL RESOURCES"
|
||||
.PP
|
||||
For information about NSS and other tools related to NSS (like JSS), check out the NSS project wiki at
|
||||
\m[blue]\fBhttp://www\&.mozilla\&.org/projects/security/pki/nss/\fR\m[]\&. The NSS site relates directly to NSS code changes and releases\&.
|
||||
.PP
|
||||
Mailing lists: https://lists\&.mozilla\&.org/listinfo/dev\-tech\-crypto
|
||||
.PP
|
||||
IRC: Freenode at #dogtag\-pki
|
||||
.SH "AUTHORS"
|
||||
.PP
|
||||
The NSS tools were written and maintained by developers with Netscape, Red Hat, Sun, Oracle, Mozilla, and Google\&.
|
||||
.PP
|
||||
Authors: Elio Maldonado <emaldona@redhat\&.com>, Deon Lackey <dlackey@redhat\&.com>\&.
|
||||
.SH "LICENSE"
|
||||
.PP
|
||||
Licensed under the Mozilla Public License, v\&. 2\&.0\&. If a copy of the MPL was not distributed with this file, You can obtain one at http://mozilla\&.org/MPL/2\&.0/\&.
|
||||
.SH "NOTES"
|
||||
.IP " 1." 4
|
||||
Mozilla NSS bug 836477
|
||||
.RS 4
|
||||
\%https://bugzilla.mozilla.org/show_bug.cgi?id=836477
|
||||
.RE
|
||||
|
|
@ -1,108 +0,0 @@
|
|||
'\" t
|
||||
.\" Title: PP
|
||||
.\" Author: [see the "Authors" section]
|
||||
.\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
|
||||
.\" Date: 19 May 2021
|
||||
.\" Manual: NSS Security Tools
|
||||
.\" Source: nss-tools
|
||||
.\" Language: English
|
||||
.\"
|
||||
.TH "PP" "1" "19 May 2021" "nss-tools" "NSS Security Tools"
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * Define some portability stuff
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
.\" http://bugs.debian.org/507673
|
||||
.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html
|
||||
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
.ie \n(.g .ds Aq \(aq
|
||||
.el .ds Aq '
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * set default formatting
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" disable hyphenation
|
||||
.nh
|
||||
.\" disable justification (adjust text to left margin only)
|
||||
.ad l
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * MAIN CONTENT STARTS HERE *
|
||||
.\" -----------------------------------------------------------------
|
||||
.SH "NAME"
|
||||
pp \- Prints certificates, keys, crls, and pkcs7 files
|
||||
.SH "SYNOPSIS"
|
||||
.HP \w'\fBpp\ \-t\ type\ [\-a]\ [\-i\ input]\ [\-o\ output]\ [\-u]\ [\-w]\fR\ 'u
|
||||
\fBpp \-t type [\-a] [\-i input] [\-o output] [\-u] [\-w]\fR
|
||||
.SH "STATUS"
|
||||
.PP
|
||||
This documentation is still work in progress\&. Please contribute to the initial review in
|
||||
\m[blue]\fBMozilla NSS bug 836477\fR\m[]\&\s-2\u[1]\d\s+2
|
||||
.SH "DESCRIPTION"
|
||||
.PP
|
||||
\fBpp \fRpretty\-prints private and public key, certificate, certificate\-request, pkcs7, pkcs12 or crl files
|
||||
.SH "OPTIONS"
|
||||
.PP
|
||||
\fB\-t \fR \fItype\fR
|
||||
.RS 4
|
||||
specify the input, one of {private\-key | public\-key | certificate | certificate\-request | pkcs7 | pkcs12 | crl | name}
|
||||
.sp
|
||||
.RE
|
||||
.PP
|
||||
\fB\-a \fR
|
||||
.RS 4
|
||||
Input is in ascii encoded form (RFC1113)
|
||||
.RE
|
||||
.PP
|
||||
\fB\-i \fR \fIinputfile\fR
|
||||
.RS 4
|
||||
Define an input file to use (default is stdin)
|
||||
.RE
|
||||
.PP
|
||||
\fB\-o \fR \fIoutputfile\fR
|
||||
.RS 4
|
||||
Define an output file to use (default is stdout)
|
||||
.RE
|
||||
.PP
|
||||
\fB\-u \fR
|
||||
.RS 4
|
||||
Use UTF\-8 (default is to show non\-ascii as \&.)
|
||||
.RE
|
||||
.PP
|
||||
\fB\-w \fR
|
||||
.RS 4
|
||||
Don\*(Aqt wrap long output lines
|
||||
.RE
|
||||
.SH "ADDITIONAL RESOURCES"
|
||||
.PP
|
||||
NSS is maintained in conjunction with PKI and security\-related projects through Mozilla and Fedora\&. The most closely\-related project is Dogtag PKI, with a project wiki at
|
||||
\m[blue]\fBPKI Wiki\fR\m[]\&\s-2\u[2]\d\s+2\&.
|
||||
.PP
|
||||
For information specifically about NSS, the NSS project wiki is located at
|
||||
\m[blue]\fBMozilla NSS site\fR\m[]\&\s-2\u[3]\d\s+2\&. The NSS site relates directly to NSS code changes and releases\&.
|
||||
.PP
|
||||
Mailing lists: pki\-devel@redhat\&.com and pki\-users@redhat\&.com
|
||||
.PP
|
||||
IRC: Freenode at #dogtag\-pki
|
||||
.SH "AUTHORS"
|
||||
.PP
|
||||
The NSS tools were written and maintained by developers with Netscape, Red Hat, Sun, Oracle, Mozilla, and Google\&.
|
||||
.PP
|
||||
Authors: Elio Maldonado <emaldona@redhat\&.com>, Deon Lackey <dlackey@redhat\&.com>\&.
|
||||
.SH "LICENSE"
|
||||
.PP
|
||||
Licensed under the Mozilla Public License, v\&. 2\&.0\&. If a copy of the MPL was not distributed with this file, You can obtain one at http://mozilla\&.org/MPL/2\&.0/\&.
|
||||
.SH "NOTES"
|
||||
.IP " 1." 4
|
||||
Mozilla NSS bug 836477
|
||||
.RS 4
|
||||
\%https://bugzilla.mozilla.org/show_bug.cgi?id=836477
|
||||
.RE
|
||||
.IP " 2." 4
|
||||
PKI Wiki
|
||||
.RS 4
|
||||
\%http://pki.fedoraproject.org/wiki/
|
||||
.RE
|
||||
.IP " 3." 4
|
||||
Mozilla NSS site
|
||||
.RS 4
|
||||
\%http://www.mozilla.org/projects/security/pki/nss/
|
||||
.RE
|
||||
|
|
@ -1,681 +0,0 @@
|
|||
'\" t
|
||||
.\" Title: signtool
|
||||
.\" Author: [see the "Authors" section]
|
||||
.\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
|
||||
.\" Date: 19 May 2021
|
||||
.\" Manual: NSS Security Tools
|
||||
.\" Source: nss-tools
|
||||
.\" Language: English
|
||||
.\"
|
||||
.TH "SIGNTOOL" "1" "19 May 2021" "nss-tools" "NSS Security Tools"
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * Define some portability stuff
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
.\" http://bugs.debian.org/507673
|
||||
.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html
|
||||
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
.ie \n(.g .ds Aq \(aq
|
||||
.el .ds Aq '
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * set default formatting
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" disable hyphenation
|
||||
.nh
|
||||
.\" disable justification (adjust text to left margin only)
|
||||
.ad l
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * MAIN CONTENT STARTS HERE *
|
||||
.\" -----------------------------------------------------------------
|
||||
.SH "NAME"
|
||||
signtool \- Digitally sign objects and files\&.
|
||||
.SH "SYNOPSIS"
|
||||
.HP \w'\fBsigntool\fR\ 'u
|
||||
\fBsigntool\fR [[\-b\ basename]] [[\-c\ Compression\ Level]] [[\-d\ cert\-dir]] [[\-e\ extension]] [[\-f\ filename]] [[\-i\ installer\ script]] [[\-h]] [[\-H]] [[\-v]] [[\-w]] [[\-G\ nickname]] [[\-J]] [[\-j\ directory]] [\-k\ keyName] [[\-\-keysize\ |\ \-s\ size]] [[\-l]] [[\-L]] [[\-M]] [[\-m\ metafile]] [[\-\-norecurse]] [[\-O]] [[\-o]] [[\-\-outfile]] [[\-p\ password]] [[\-t|\-\-token\ tokenname]] [[\-z]] [[\-X]] [[\-x\ name]] [[\-\-verbose\ value]] [[\-\-leavearc]] [[\-Z\ jarfile]] [directory\-tree] [archive]
|
||||
.SH "STATUS"
|
||||
.PP
|
||||
This documentation is still work in progress\&. Please contribute to the initial review in
|
||||
\m[blue]\fBMozilla NSS bug 836477\fR\m[]\&\s-2\u[1]\d\s+2
|
||||
.SH "DESCRIPTION"
|
||||
.PP
|
||||
The Signing Tool,
|
||||
\fBsigntool\fR, creates digital signatures and uses a Java Archive (JAR) file to associate the signatures with files in a directory\&. Electronic software distribution over any network involves potential security problems\&. To help address some of these problems, you can associate digital signatures with the files in a JAR archive\&. Digital signatures allow SSL\-enabled clients to perform two important operations:
|
||||
.PP
|
||||
* Confirm the identity of the individual, company, or other entity whose digital signature is associated with the files
|
||||
.PP
|
||||
* Check whether the files have been tampered with since being signed
|
||||
.PP
|
||||
If you have a signing certificate, you can use Netscape Signing Tool to digitally sign files and package them as a JAR file\&. An object\-signing certificate is a special kind of certificate that allows you to associate your digital signature with one or more files\&.
|
||||
.PP
|
||||
An individual file can potentially be signed with multiple digital signatures\&. For example, a commercial software developer might sign the files that constitute a software product to prove that the files are indeed from a particular company\&. A network administrator manager might sign the same files with an additional digital signature based on a company\-generated certificate to indicate that the product is approved for use within the company\&.
|
||||
.PP
|
||||
The significance of a digital signature is comparable to the significance of a handwritten signature\&. Once you have signed a file, it is difficult to claim later that you didn\*(Aqt sign it\&. In some situations, a digital signature may be considered as legally binding as a handwritten signature\&. Therefore, you should take great care to ensure that you can stand behind any file you sign and distribute\&.
|
||||
.PP
|
||||
For example, if you are a software developer, you should test your code to make sure it is virus\-free before signing it\&. Similarly, if you are a network administrator, you should make sure, before signing any code, that it comes from a reliable source and will run correctly with the software installed on the machines to which you are distributing it\&.
|
||||
.PP
|
||||
Before you can use Netscape Signing Tool to sign files, you must have an object\-signing certificate, which is a special certificate whose associated private key is used to create digital signatures\&. For testing purposes only, you can create an object\-signing certificate with Netscape Signing Tool 1\&.3\&. When testing is finished and you are ready to disitribute your software, you should obtain an object\-signing certificate from one of two kinds of sources:
|
||||
.PP
|
||||
* An independent certificate authority (CA) that authenticates your identity and charges you a fee\&. You typically get a certificate from an independent CA if you want to sign software that will be distributed over the Internet\&.
|
||||
.PP
|
||||
* CA server software running on your corporate intranet or extranet\&. Netscape Certificate Management System provides a complete management solution for creating, deploying, and managing certificates, including CAs that issue object\-signing certificates\&.
|
||||
.PP
|
||||
You must also have a certificate for the CA that issues your signing certificate before you can sign files\&. If the certificate authority\*(Aqs certificate isn\*(Aqt already installed in your copy of Communicator, you typically install it by clicking the appropriate link on the certificate authority\*(Aqs web site, for example on the page from which you initiated enrollment for your signing certificate\&. This is the case for some test certificates, as well as certificates issued by Netscape Certificate Management System: you must download the the CA certificate in addition to obtaining your own signing certificate\&. CA certificates for several certificate authorities are preinstalled in the Communicator certificate database\&.
|
||||
.PP
|
||||
When you receive an object\-signing certificate for your own use, it is automatically installed in your copy of the Communicator client software\&. Communicator supports the public\-key cryptography standard known as PKCS #12, which governs key portability\&. You can, for example, move an object\-signing certificate and its associated private key from one computer to another on a credit\-card\-sized device called a smart card\&.
|
||||
.SH "OPTIONS"
|
||||
.PP
|
||||
\-b basename
|
||||
.RS 4
|
||||
Specifies the base filename for the \&.rsa and \&.sf files in the META\-INF directory to conform with the JAR format\&. For example,
|
||||
\fI\-b signatures\fR
|
||||
causes the files to be named signatures\&.rsa and signatures\&.sf\&. The default is signtool\&.
|
||||
.RE
|
||||
.PP
|
||||
\-c#
|
||||
.RS 4
|
||||
Specifies the compression level for the \-J or \-Z option\&. The symbol # represents a number from 0 to 9, where 0 means no compression and 9 means maximum compression\&. The higher the level of compression, the smaller the output but the longer the operation takes\&. If the \-c# option is not used with either the \-J or the \-Z option, the default compression value used by both the \-J and \-Z options is 6\&.
|
||||
.RE
|
||||
.PP
|
||||
\-d certdir
|
||||
.RS 4
|
||||
Specifies your certificate database directory; that is, the directory in which you placed your key3\&.db and cert7\&.db files\&. To specify the current directory, use "\-d\&." (including the period)\&. The Unix version of signtool assumes ~/\&.netscape unless told otherwise\&. The NT version of signtool always requires the use of the \-d option to specify where the database files are located\&.
|
||||
.RE
|
||||
.PP
|
||||
\-e extension
|
||||
.RS 4
|
||||
Tells signtool to sign only files with the given extension; for example, use \-e"\&.class" to sign only Java class files\&. Note that with Netscape Signing Tool version 1\&.1 and later this option can appear multiple times on one command line, making it possible to specify multiple file types or classes to include\&.
|
||||
.RE
|
||||
.PP
|
||||
\-f commandfile
|
||||
.RS 4
|
||||
Specifies a text file containing Netscape Signing Tool options and arguments in keyword=value format\&. All options and arguments can be expressed through this file\&. For more information about the syntax used with this file, see "Tips and Techniques"\&.
|
||||
.RE
|
||||
.PP
|
||||
\-G nickname
|
||||
.RS 4
|
||||
Generates a new private\-public key pair and corresponding object\-signing certificate with the given nickname\&. The newly generated keys and certificate are installed into the key and certificate databases in the directory specified by the \-d option\&. With the NT version of Netscape Signing Tool, you must use the \-d option with the \-G option\&. With the Unix version of Netscape Signing Tool, omitting the \-d option causes the tool to install the keys and certificate in the Communicator key and certificate databases\&. If you are installing the keys and certificate in the Communicator databases, you must exit Communicator before using this option; otherwise, you risk corrupting the databases\&. In all cases, the certificate is also output to a file named x509\&.cacert, which has the MIME\-type application/x\-x509\-ca\-cert\&. Unlike certificates normally used to sign finished code to be distributed over a network, a test certificate created with \-G is not signed by a recognized certificate authority\&. Instead, it is self\-signed\&. In addition, a single test signing certificate functions as both an object\-signing certificate and a CA\&. When you are using it to sign objects, it behaves like an object\-signing certificate\&. When it is imported into browser software such as Communicator, it behaves like an object\-signing CA and cannot be used to sign objects\&. The \-G option is available in Netscape Signing Tool 1\&.0 and later versions only\&. By default, it produces only RSA certificates with 1024\-byte keys in the internal token\&. However, you can use the \-s option specify the required key size and the \-t option to specify the token\&.
|
||||
.RE
|
||||
.PP
|
||||
\-i scriptname
|
||||
.RS 4
|
||||
Specifies the name of an installer script for SmartUpdate\&. This script installs files from the JAR archive in the local system after SmartUpdate has validated the digital signature\&. For more details, see the description of \-m that follows\&. The \-i option provides a straightforward way to provide this information if you don\*(Aqt need to specify any metadata other than an installer script\&.
|
||||
.RE
|
||||
.PP
|
||||
\-J
|
||||
.RS 4
|
||||
Signs a directory of HTML files containing JavaScript and creates as many archive files as are specified in the HTML tags\&. Even if signtool creates more than one archive file, you need to supply the key database password only once\&. The \-J option is available only in Netscape Signing Tool 1\&.0 and later versions\&. The \-J option cannot be used at the same time as the \-Z option\&. If the \-c# option is not used with the \-J option, the default compression value is 6\&. Note that versions 1\&.1 and later of Netscape Signing Tool correctly recognizes the CODEBASE attribute, allows paths to be expressed for the CLASS and SRC attributes instead of filenames only, processes LINK tags and parses HTML correctly, and offers clearer error messages\&.
|
||||
.RE
|
||||
.PP
|
||||
\-j directory
|
||||
.RS 4
|
||||
Specifies a special JavaScript directory\&. This option causes the specified directory to be signed and tags its entries as inline JavaScript\&. This special type of entry does not have to appear in the JAR file itself\&. Instead, it is located in the HTML page containing the inline scripts\&. When you use signtool \-v, these entries are displayed with the string NOT PRESENT\&.
|
||||
.RE
|
||||
.PP
|
||||
\-k key \&.\&.\&. directory
|
||||
.RS 4
|
||||
Specifies the nickname (key) of the certificate you want to sign with and signs the files in the specified directory\&. The directory to sign is always specified as the last command\-line argument\&. Thus, it is possible to write signtool \-k MyCert \-d \&. signdir You may have trouble if the nickname contains a single quotation mark\&. To avoid problems, escape the quotation mark using the escape conventions for your platform\&. It\*(Aqs also possible to use the \-k option without signing any files or specifying a directory\&. For example, you can use it with the \-l option to get detailed information about a particular signing certificate\&.
|
||||
.RE
|
||||
.PP
|
||||
\-l
|
||||
.RS 4
|
||||
Lists signing certificates, including issuing CAs\&. If any of your certificates are expired or invalid, the list will so specify\&. This option can be used with the \-k option to list detailed information about a particular signing certificate\&. The \-l option is available in Netscape Signing Tool 1\&.0 and later versions only\&.
|
||||
.RE
|
||||
.PP
|
||||
\-L
|
||||
.RS 4
|
||||
Lists the certificates in your database\&. An asterisk appears to the left of the nickname for any certificate that can be used to sign objects with signtool\&.
|
||||
.RE
|
||||
.PP
|
||||
\-\-leavearc
|
||||
.RS 4
|
||||
Retains the temporary \&.arc (archive) directories that the \-J option creates\&. These directories are automatically erased by default\&. Retaining the temporary directories can be an aid to debugging\&.
|
||||
.RE
|
||||
.PP
|
||||
\-m metafile
|
||||
.RS 4
|
||||
Specifies the name of a metadata control file\&. Metadata is signed information attached either to the JAR archive itself or to files within the archive\&. This metadata can be any ASCII string, but is used mainly for specifying an installer script\&. The metadata file contains one entry per line, each with three fields: field #1: file specification, or + if you want to specify global metadata (that is, metadata about the JAR archive itself or all entries in the archive) field #2: the name of the data you are specifying; for example: Install\-Script field #3: data corresponding to the name in field #2 For example, the \-i option uses the equivalent of this line: + Install\-Script: script\&.js This example associates a MIME type with a file: movie\&.qt MIME\-Type: video/quicktime For information about the way installer script information appears in the manifest file for a JAR archive, see The JAR Format on Netscape DevEdge\&.
|
||||
.RE
|
||||
.PP
|
||||
\-M
|
||||
.RS 4
|
||||
Lists the PKCS #11 modules available to signtool, including smart cards\&. The \-M option is available in Netscape Signing Tool 1\&.0 and later versions only\&. For information on using Netscape Signing Tool with smart cards, see "Using Netscape Signing Tool with Smart Cards"\&. For information on using the \-M option to verify FIPS\-140\-1 validated mode, see "Netscape Signing Tool and FIPS\-140\-1"\&.
|
||||
.RE
|
||||
.PP
|
||||
\-\-norecurse
|
||||
.RS 4
|
||||
Blocks recursion into subdirectories when signing a directory\*(Aqs contents or when parsing HTML\&.
|
||||
.RE
|
||||
.PP
|
||||
\-o
|
||||
.RS 4
|
||||
Optimizes the archive for size\&. Use this only if you are signing very large archives containing hundreds of files\&. This option makes the manifest files (required by the JAR format) considerably smaller, but they contain slightly less information\&.
|
||||
.RE
|
||||
.PP
|
||||
\-\-outfile outputfile
|
||||
.RS 4
|
||||
Specifies a file to receive redirected output from Netscape Signing Tool\&.
|
||||
.RE
|
||||
.PP
|
||||
\-p password
|
||||
.RS 4
|
||||
Specifies a password for the private\-key database\&. Note that the password entered on the command line is displayed as plain text\&.
|
||||
.RE
|
||||
.PP
|
||||
\-s keysize
|
||||
.RS 4
|
||||
Specifies the size of the key for generated certificate\&. Use the \-M option to find out what tokens are available\&. The \-s option can be used with the \-G option only\&.
|
||||
.RE
|
||||
.PP
|
||||
\-t token
|
||||
.RS 4
|
||||
Specifies which available token should generate the key and receive the certificate\&. Use the \-M option to find out what tokens are available\&. The \-t option can be used with the \-G option only\&.
|
||||
.RE
|
||||
.PP
|
||||
\-v archive
|
||||
.RS 4
|
||||
Displays the contents of an archive and verifies the cryptographic integrity of the digital signatures it contains and the files with which they are associated\&. This includes checking that the certificate for the issuer of the object\-signing certificate is listed in the certificate database, that the CA\*(Aqs digital signature on the object\-signing certificate is valid, that the relevant certificates have not expired, and so on\&.
|
||||
.RE
|
||||
.PP
|
||||
\-\-verbosity value
|
||||
.RS 4
|
||||
Sets the quantity of information Netscape Signing Tool generates in operation\&. A value of 0 (zero) is the default and gives full information\&. A value of \-1 suppresses most messages, but not error messages\&.
|
||||
.RE
|
||||
.PP
|
||||
\-w archive
|
||||
.RS 4
|
||||
Displays the names of signers of any files in the archive\&.
|
||||
.RE
|
||||
.PP
|
||||
\-x directory
|
||||
.RS 4
|
||||
Excludes the specified directory from signing\&. Note that with Netscape Signing Tool version 1\&.1 and later this option can appear multiple times on one command line, making it possible to specify several particular directories to exclude\&.
|
||||
.RE
|
||||
.PP
|
||||
\-z
|
||||
.RS 4
|
||||
Tells signtool not to store the signing time in the digital signature\&. This option is useful if you want the expiration date of the signature checked against the current date and time rather than the time the files were signed\&.
|
||||
.RE
|
||||
.PP
|
||||
\-Z jarfile
|
||||
.RS 4
|
||||
Creates a JAR file with the specified name\&. You must specify this option if you want signtool to create the JAR file; it does not do so automatically\&. If you don\*(Aqt specify \-Z, you must use an external ZIP tool to create the JAR file\&. The \-Z option cannot be used at the same time as the \-J option\&. If the \-c# option is not used with the \-Z option, the default compression value is 6\&.
|
||||
.RE
|
||||
.SH "THE COMMAND FILE FORMAT"
|
||||
.PP
|
||||
Entries in a Netscape Signing Tool command file have this general format: keyword=value Everything before the = sign on a single line is a keyword, and everything from the = sign to the end of line is a value\&. The value may include = signs; only the first = sign on a line is interpreted\&. Blank lines are ignored, but white space on a line with keywords and values is assumed to be part of the keyword (if it comes before the equal sign) or part of the value (if it comes after the first equal sign)\&. Keywords are case insensitive, values are generally case sensitive\&. Since the = sign and newline delimit the value, it should not be quoted\&.
|
||||
.PP
|
||||
\fBSubsection\fR
|
||||
.PP
|
||||
basename
|
||||
.RS 4
|
||||
Same as \-b option\&.
|
||||
.RE
|
||||
.PP
|
||||
compression
|
||||
.RS 4
|
||||
Same as \-c option\&.
|
||||
.RE
|
||||
.PP
|
||||
certdir
|
||||
.RS 4
|
||||
Same as \-d option\&.
|
||||
.RE
|
||||
.PP
|
||||
extension
|
||||
.RS 4
|
||||
Same as \-e option\&.
|
||||
.RE
|
||||
.PP
|
||||
generate
|
||||
.RS 4
|
||||
Same as \-G option\&.
|
||||
.RE
|
||||
.PP
|
||||
installscript
|
||||
.RS 4
|
||||
Same as \-i option\&.
|
||||
.RE
|
||||
.PP
|
||||
javascriptdir
|
||||
.RS 4
|
||||
Same as \-j option\&.
|
||||
.RE
|
||||
.PP
|
||||
htmldir
|
||||
.RS 4
|
||||
Same as \-J option\&.
|
||||
.RE
|
||||
.PP
|
||||
certname
|
||||
.RS 4
|
||||
Nickname of certificate, as with \-k and \-l \-k options\&.
|
||||
.RE
|
||||
.PP
|
||||
signdir
|
||||
.RS 4
|
||||
The directory to be signed, as with \-k option\&.
|
||||
.RE
|
||||
.PP
|
||||
list
|
||||
.RS 4
|
||||
Same as \-l option\&. Value is ignored, but = sign must be present\&.
|
||||
.RE
|
||||
.PP
|
||||
listall
|
||||
.RS 4
|
||||
Same as \-L option\&. Value is ignored, but = sign must be present\&.
|
||||
.RE
|
||||
.PP
|
||||
metafile
|
||||
.RS 4
|
||||
Same as \-m option\&.
|
||||
.RE
|
||||
.PP
|
||||
modules
|
||||
.RS 4
|
||||
Same as \-M option\&. Value is ignored, but = sign must be present\&.
|
||||
.RE
|
||||
.PP
|
||||
optimize
|
||||
.RS 4
|
||||
Same as \-o option\&. Value is ignored, but = sign must be present\&.
|
||||
.RE
|
||||
.PP
|
||||
password
|
||||
.RS 4
|
||||
Same as \-p option\&.
|
||||
.RE
|
||||
.PP
|
||||
keysize
|
||||
.RS 4
|
||||
Same as \-s option\&.
|
||||
.RE
|
||||
.PP
|
||||
token
|
||||
.RS 4
|
||||
Same as \-t option\&.
|
||||
.RE
|
||||
.PP
|
||||
verify
|
||||
.RS 4
|
||||
Same as \-v option\&.
|
||||
.RE
|
||||
.PP
|
||||
who
|
||||
.RS 4
|
||||
Same as \-w option\&.
|
||||
.RE
|
||||
.PP
|
||||
exclude
|
||||
.RS 4
|
||||
Same as \-x option\&.
|
||||
.RE
|
||||
.PP
|
||||
notime
|
||||
.RS 4
|
||||
Same as \-z option\&. value is ignored, but = sign must be present\&.
|
||||
.RE
|
||||
.PP
|
||||
jarfile
|
||||
.RS 4
|
||||
Same as \-Z option\&.
|
||||
.RE
|
||||
.PP
|
||||
outfile
|
||||
.RS 4
|
||||
Name of a file to which output and error messages will be redirected\&. This option has no command\-line equivalent\&.
|
||||
.RE
|
||||
.SH "EXTENDED EXAMPLES"
|
||||
.PP
|
||||
The following example will do this and that
|
||||
.PP
|
||||
\fBListing Available Signing Certificates\fR
|
||||
.PP
|
||||
You use the \-L option to list the nicknames for all available certificates and check which ones are signing certificates\&.
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
signtool \-L
|
||||
|
||||
using certificate directory: /u/jsmith/\&.netscape
|
||||
S Certificates
|
||||
\- \-\-\-\-\-\-\-\-\-\-\-\-
|
||||
BBN Certificate Services CA Root 1
|
||||
IBM World Registry CA
|
||||
VeriSign Class 1 CA \- Individual Subscriber \- VeriSign, Inc\&.
|
||||
GTE CyberTrust Root CA
|
||||
Uptime Group Plc\&. Class 4 CA
|
||||
* Verisign Object Signing Cert
|
||||
Integrion CA
|
||||
GTE CyberTrust Secure Server CA
|
||||
AT&T Directory Services
|
||||
* test object signing cert
|
||||
Uptime Group Plc\&. Class 1 CA
|
||||
VeriSign Class 1 Primary CA
|
||||
\- \-\-\-\-\-\-\-\-\-\-\-\-
|
||||
|
||||
Certificates that can be used to sign objects have *\*(Aqs to their left\&.
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.PP
|
||||
Two signing certificates are displayed: Verisign Object Signing Cert and test object signing cert\&.
|
||||
.PP
|
||||
You use the \-l option to get a list of signing certificates only, including the signing CA for each\&.
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
signtool \-l
|
||||
|
||||
using certificate directory: /u/jsmith/\&.netscape
|
||||
Object signing certificates
|
||||
\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-
|
||||
|
||||
Verisign Object Signing Cert
|
||||
Issued by: VeriSign, Inc\&. \- Verisign, Inc\&.
|
||||
Expires: Tue May 19, 1998
|
||||
test object signing cert
|
||||
Issued by: test object signing cert (Signtool 1\&.0 Testing
|
||||
Certificate (960187691))
|
||||
Expires: Sun May 17, 1998
|
||||
\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.PP
|
||||
For a list including CAs, use the
|
||||
\fB\-L\fR
|
||||
option\&.
|
||||
.PP
|
||||
\fBSigning a File\fR
|
||||
.PP
|
||||
1\&. Create an empty directory\&.
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
mkdir signdir
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.PP
|
||||
2\&. Put some file into it\&.
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
echo boo > signdir/test\&.f
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.PP
|
||||
3\&. Specify the name of your object\-signing certificate and sign the directory\&.
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
signtool \-k MySignCert \-Z testjar\&.jar signdir
|
||||
|
||||
using key "MySignCert"
|
||||
using certificate directory: /u/jsmith/\&.netscape
|
||||
Generating signdir/META\-INF/manifest\&.mf file\&.\&.
|
||||
\-\-> test\&.f
|
||||
adding signdir/test\&.f to testjar\&.jar
|
||||
Generating signtool\&.sf file\&.\&.
|
||||
Enter Password or Pin for "Communicator Certificate DB":
|
||||
|
||||
adding signdir/META\-INF/manifest\&.mf to testjar\&.jar
|
||||
adding signdir/META\-INF/signtool\&.sf to testjar\&.jar
|
||||
adding signdir/META\-INF/signtool\&.rsa to testjar\&.jar
|
||||
|
||||
tree "signdir" signed successfully
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.PP
|
||||
4\&. Test the archive you just created\&.
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
signtool \-v testjar\&.jar
|
||||
|
||||
using certificate directory: /u/jsmith/\&.netscape
|
||||
archive "testjar\&.jar" has passed crypto verification\&.
|
||||
status path
|
||||
\-\-\-\-\-\-\-\-\-\-\-\- \-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-
|
||||
verified test\&.f
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.PP
|
||||
\fBUsing Netscape Signing Tool with a ZIP Utility\fR
|
||||
.PP
|
||||
To use Netscape Signing Tool with a ZIP utility, you must have the utility in your path environment variable\&. You should use the zip\&.exe utility rather than pkzip\&.exe, which cannot handle long filenames\&. You can use a ZIP utility instead of the \-Z option to package a signed archive into a JAR file after you have signed it:
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
cd signdir
|
||||
|
||||
zip \-r \&.\&./myjar\&.jar *
|
||||
adding: META\-INF/ (stored 0%)
|
||||
adding: META\-INF/manifest\&.mf (deflated 15%)
|
||||
adding: META\-INF/signtool\&.sf (deflated 28%)
|
||||
adding: META\-INF/signtool\&.rsa (stored 0%)
|
||||
adding: text\&.txt (stored 0%)
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.PP
|
||||
\fBGenerating the Keys and Certificate\fR
|
||||
.PP
|
||||
The signtool option \-G generates a new public\-private key pair and certificate\&. It takes the nickname of the new certificate as an argument\&. The newly generated keys and certificate are installed into the key and certificate databases in the directory specified by the \-d option\&. With the NT version of Netscape Signing Tool, you must use the \-d option with the \-G option\&. With the Unix version of Netscape Signing Tool, omitting the \-d option causes the tool to install the keys and certificate in the Communicator key and certificate databases\&. In all cases, the certificate is also output to a file named x509\&.cacert, which has the MIME\-type application/x\-x509\-ca\-cert\&.
|
||||
.PP
|
||||
Certificates contain standard information about the entity they identify, such as the common name and organization name\&. Netscape Signing Tool prompts you for this information when you run the command with the \-G option\&. However, all of the requested fields are optional for test certificates\&. If you do not enter a common name, the tool provides a default name\&. In the following example, the user input is in boldface:
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
signtool \-G MyTestCert
|
||||
|
||||
using certificate directory: /u/someuser/\&.netscape
|
||||
Enter certificate information\&. All fields are optional\&. Acceptable
|
||||
characters are numbers, letters, spaces, and apostrophes\&.
|
||||
certificate common name: Test Object Signing Certificate
|
||||
organization: Netscape Communications Corp\&.
|
||||
organization unit: Server Products Division
|
||||
state or province: California
|
||||
country (must be exactly 2 characters): US
|
||||
username: someuser
|
||||
email address: someuser@netscape\&.com
|
||||
Enter Password or Pin for "Communicator Certificate DB": [Password will not echo]
|
||||
generated public/private key pair
|
||||
certificate request generated
|
||||
certificate has been signed
|
||||
certificate "MyTestCert" added to database
|
||||
Exported certificate to x509\&.raw and x509\&.cacert\&.
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.PP
|
||||
The certificate information is read from standard input\&. Therefore, the information can be read from a file using the redirection operator (<) in some operating systems\&. To create a file for this purpose, enter each of the seven input fields, in order, on a separate line\&. Make sure there is a newline character at the end of the last line\&. Then run signtool with standard input redirected from your file as follows:
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
signtool \-G MyTestCert inputfile
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.PP
|
||||
The prompts show up on the screen, but the responses will be automatically read from the file\&. The password will still be read from the console unless you use the \-p option to give the password on the command line\&.
|
||||
.PP
|
||||
\fBUsing the \-M Option to List Smart Cards\fR
|
||||
.PP
|
||||
You can use the \-M option to list the PKCS #11 modules, including smart cards, that are available to signtool:
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
signtool \-d "c:\enetscape\eusers\ejsmith" \-M
|
||||
|
||||
using certificate directory: c:\enetscape\eusers\eusername
|
||||
Listing of PKCS11 modules
|
||||
\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-
|
||||
1\&. Netscape Internal PKCS #11 Module
|
||||
(this module is internally loaded)
|
||||
slots: 2 slots attached
|
||||
status: loaded
|
||||
slot: Communicator Internal Cryptographic Services Version 4\&.0
|
||||
token: Communicator Generic Crypto Svcs
|
||||
slot: Communicator User Private Key and Certificate Services
|
||||
token: Communicator Certificate DB
|
||||
2\&. CryptOS
|
||||
(this is an external module)
|
||||
DLL name: core32
|
||||
slots: 1 slots attached
|
||||
status: loaded
|
||||
slot: Litronic 210
|
||||
token:
|
||||
\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.PP
|
||||
\fBUsing Netscape Signing Tool and a Smart Card to Sign Files\fR
|
||||
.PP
|
||||
The signtool command normally takes an argument of the \-k option to specify a signing certificate\&. To sign with a smart card, you supply only the fully qualified name of the certificate\&.
|
||||
.PP
|
||||
To see fully qualified certificate names when you run Communicator, click the Security button in Navigator, then click Yours under Certificates in the left frame\&. Fully qualified names are of the format smart card:certificate, for example "MyCard:My Signing Cert"\&. You use this name with the \-k argument as follows:
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
signtool \-k "MyCard:My Signing Cert" directory
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.PP
|
||||
\fBVerifying FIPS Mode\fR
|
||||
.PP
|
||||
Use the \-M option to verify that you are using the FIPS\-140\-1 module\&.
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
signtool \-d "c:\enetscape\eusers\ejsmith" \-M
|
||||
|
||||
using certificate directory: c:\enetscape\eusers\ejsmith
|
||||
Listing of PKCS11 modules
|
||||
\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-
|
||||
1\&. Netscape Internal PKCS #11 Module
|
||||
(this module is internally loaded)
|
||||
slots: 2 slots attached
|
||||
status: loaded
|
||||
slot: Communicator Internal Cryptographic Services Version 4\&.0
|
||||
token: Communicator Generic Crypto Svcs
|
||||
slot: Communicator User Private Key and Certificate Services
|
||||
token: Communicator Certificate DB
|
||||
\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.PP
|
||||
This Unix example shows that Netscape Signing Tool is using a FIPS\-140\-1 module:
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
signtool \-d "c:\enetscape\eusers\ejsmith" \-M
|
||||
using certificate directory: c:\enetscape\eusers\ejsmith
|
||||
Enter Password or Pin for "Communicator Certificate DB": [password will not echo]
|
||||
Listing of PKCS11 modules
|
||||
\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-
|
||||
1\&. Netscape Internal FIPS PKCS #11 Module
|
||||
(this module is internally loaded)
|
||||
slots: 1 slots attached
|
||||
status: loaded
|
||||
slot: Netscape Internal FIPS\-140\-1 Cryptographic Services
|
||||
token: Communicator Certificate DB
|
||||
\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.SH "SEE ALSO"
|
||||
.PP
|
||||
signver (1)
|
||||
.PP
|
||||
The NSS wiki has information on the new database design and how to configure applications to use it\&.
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
https://wiki\&.mozilla\&.org/NSS_Shared_DB_Howto
|
||||
.RE
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
https://wiki\&.mozilla\&.org/NSS_Shared_DB
|
||||
.RE
|
||||
.SH "ADDITIONAL RESOURCES"
|
||||
.PP
|
||||
For information about NSS and other tools related to NSS (like JSS), check out the NSS project wiki at
|
||||
\m[blue]\fBhttp://www\&.mozilla\&.org/projects/security/pki/nss/\fR\m[]\&. The NSS site relates directly to NSS code changes and releases\&.
|
||||
.PP
|
||||
Mailing lists: https://lists\&.mozilla\&.org/listinfo/dev\-tech\-crypto
|
||||
.PP
|
||||
IRC: Freenode at #dogtag\-pki
|
||||
.SH "AUTHORS"
|
||||
.PP
|
||||
The NSS tools were written and maintained by developers with Netscape, Red Hat, Sun, Oracle, Mozilla, and Google\&.
|
||||
.PP
|
||||
Authors: Elio Maldonado <emaldona@redhat\&.com>, Deon Lackey <dlackey@redhat\&.com>\&.
|
||||
.SH "LICENSE"
|
||||
.PP
|
||||
Licensed under the Mozilla Public License, v\&. 2\&.0\&. If a copy of the MPL was not distributed with this file, You can obtain one at http://mozilla\&.org/MPL/2\&.0/\&.
|
||||
.SH "NOTES"
|
||||
.IP " 1." 4
|
||||
Mozilla NSS bug 836477
|
||||
.RS 4
|
||||
\%https://bugzilla.mozilla.org/show_bug.cgi?id=836477
|
||||
.RE
|
||||
|
|
@ -1,318 +0,0 @@
|
|||
'\" t
|
||||
.\" Title: SIGNVER
|
||||
.\" Author: [see the "Authors" section]
|
||||
.\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
|
||||
.\" Date: 19 May 2021
|
||||
.\" Manual: NSS Security Tools
|
||||
.\" Source: nss-tools
|
||||
.\" Language: English
|
||||
.\"
|
||||
.TH "SIGNVER" "1" "19 May 2021" "nss-tools" "NSS Security Tools"
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * Define some portability stuff
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
.\" http://bugs.debian.org/507673
|
||||
.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html
|
||||
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
.ie \n(.g .ds Aq \(aq
|
||||
.el .ds Aq '
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * set default formatting
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" disable hyphenation
|
||||
.nh
|
||||
.\" disable justification (adjust text to left margin only)
|
||||
.ad l
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * MAIN CONTENT STARTS HERE *
|
||||
.\" -----------------------------------------------------------------
|
||||
.SH "NAME"
|
||||
signver \- Verify a detached PKCS#7 signature for a file\&.
|
||||
.SH "SYNOPSIS"
|
||||
.HP \w'\fBsigntool\fR\ 'u
|
||||
\fBsigntool\fR \-A | \-V \-d\ \fIdirectory\fR [\-a] [\-i\ \fIinput_file\fR] [\-o\ \fIoutput_file\fR] [\-s\ \fIsignature_file\fR] [\-v]
|
||||
.SH "STATUS"
|
||||
.PP
|
||||
This documentation is still work in progress\&. Please contribute to the initial review in
|
||||
\m[blue]\fBMozilla NSS bug 836477\fR\m[]\&\s-2\u[1]\d\s+2
|
||||
.SH "DESCRIPTION"
|
||||
.PP
|
||||
The Signature Verification Tool,
|
||||
\fBsignver\fR, is a simple command\-line utility that unpacks a base\-64\-encoded PKCS#7 signed object and verifies the digital signature using standard cryptographic techniques\&. The Signature Verification Tool can also display the contents of the signed object\&.
|
||||
.SH "OPTIONS"
|
||||
.PP
|
||||
\-A
|
||||
.RS 4
|
||||
Displays all of the information in the PKCS#7 signature\&.
|
||||
.RE
|
||||
.PP
|
||||
\-V
|
||||
.RS 4
|
||||
Verifies the digital signature\&.
|
||||
.RE
|
||||
.PP
|
||||
\-d \fIdirectory\fR
|
||||
.RS 4
|
||||
Specify the database directory which contains the certificates and keys\&.
|
||||
.sp
|
||||
\fBsignver\fR
|
||||
supports two types of databases: the legacy security databases (cert8\&.db,
|
||||
key3\&.db, and
|
||||
secmod\&.db) and new SQLite databases (cert9\&.db,
|
||||
key4\&.db, and
|
||||
pkcs11\&.txt)\&. If the prefix
|
||||
\fBdbm:\fR
|
||||
is not used, then the tool assumes that the given databases are in the SQLite format\&.
|
||||
.RE
|
||||
.PP
|
||||
\-a
|
||||
.RS 4
|
||||
Sets that the given signature file is in ASCII format\&.
|
||||
.RE
|
||||
.PP
|
||||
\-i \fIinput_file\fR
|
||||
.RS 4
|
||||
Gives the input file for the object with signed data\&.
|
||||
.RE
|
||||
.PP
|
||||
\-o \fIoutput_file\fR
|
||||
.RS 4
|
||||
Gives the output file to which to write the results\&.
|
||||
.RE
|
||||
.PP
|
||||
\-s \fIsignature_file\fR
|
||||
.RS 4
|
||||
Gives the input file for the digital signature\&.
|
||||
.RE
|
||||
.PP
|
||||
\-v
|
||||
.RS 4
|
||||
Enables verbose output\&.
|
||||
.RE
|
||||
.SH "EXTENDED EXAMPLES"
|
||||
.SS "Verifying a Signature"
|
||||
.PP
|
||||
The
|
||||
\fB\-V\fR
|
||||
option verifies that the signature in a given signature file is valid when used to sign the given object (from the input file)\&.
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
signver \-V \-s \fIsignature_file\fR \-i \fIsigned_file\fR \-d /home/my/sharednssdb
|
||||
|
||||
signatureValid=yes
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.SS "Printing Signature Data"
|
||||
.PP
|
||||
The
|
||||
\fB\-A\fR
|
||||
option prints all of the information contained in a signature file\&. Using the
|
||||
\fB\-o\fR
|
||||
option prints the signature file information to the given output file rather than stdout\&.
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
signver \-A \-s \fIsignature_file\fR \-o \fIoutput_file\fR
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.SH "NSS DATABASE TYPES"
|
||||
.PP
|
||||
NSS originally used BerkeleyDB databases to store security information\&. The last versions of these
|
||||
\fIlegacy\fR
|
||||
databases are:
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
cert8\&.db for certificates
|
||||
.RE
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
key3\&.db for keys
|
||||
.RE
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
secmod\&.db for PKCS #11 module information
|
||||
.RE
|
||||
.PP
|
||||
BerkeleyDB has performance limitations, though, which prevent it from being easily used by multiple applications simultaneously\&. NSS has some flexibility that allows applications to use their own, independent database engine while keeping a shared database and working around the access issues\&. Still, NSS requires more flexibility to provide a truly shared security database\&.
|
||||
.PP
|
||||
In 2009, NSS introduced a new set of databases that are SQLite databases rather than BerkleyDB\&. These new databases provide more accessibility and performance:
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
cert9\&.db for certificates
|
||||
.RE
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
key4\&.db for keys
|
||||
.RE
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
pkcs11\&.txt, which is listing of all of the PKCS #11 modules contained in a new subdirectory in the security databases directory
|
||||
.RE
|
||||
.PP
|
||||
Because the SQLite databases are designed to be shared, these are the
|
||||
\fIshared\fR
|
||||
database type\&. The shared database type is preferred; the legacy format is included for backward compatibility\&.
|
||||
.PP
|
||||
By default, the tools (\fBcertutil\fR,
|
||||
\fBpk12util\fR,
|
||||
\fBmodutil\fR) assume that the given security databases use the SQLite type Using the legacy databases must be manually specified by using the
|
||||
\fBdbm:\fR
|
||||
prefix with the given security directory\&. For example:
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
# signver \-A \-s \fIsignature\fR \-d dbm:/home/my/sharednssdb
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.PP
|
||||
To set the legacy database type as the default type for the tools, set the
|
||||
\fBNSS_DEFAULT_DB_TYPE\fR
|
||||
environment variable to
|
||||
\fBdbm\fR:
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
export NSS_DEFAULT_DB_TYPE="dbm"
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.PP
|
||||
This line can be added to the
|
||||
~/\&.bashrc
|
||||
file to make the change permanent for the user\&.
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
https://wiki\&.mozilla\&.org/NSS_Shared_DB_Howto
|
||||
.RE
|
||||
.PP
|
||||
For an engineering draft on the changes in the shared NSS databases, see the NSS project wiki:
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
https://wiki\&.mozilla\&.org/NSS_Shared_DB
|
||||
.RE
|
||||
.SH "SEE ALSO"
|
||||
.PP
|
||||
signtool (1)
|
||||
.PP
|
||||
The NSS wiki has information on the new database design and how to configure applications to use it\&.
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
Setting up the shared NSS database
|
||||
.sp
|
||||
https://wiki\&.mozilla\&.org/NSS_Shared_DB_Howto
|
||||
.RE
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
Engineering and technical information about the shared NSS database
|
||||
.sp
|
||||
https://wiki\&.mozilla\&.org/NSS_Shared_DB
|
||||
.RE
|
||||
.SH "ADDITIONAL RESOURCES"
|
||||
.PP
|
||||
For information about NSS and other tools related to NSS (like JSS), check out the NSS project wiki at
|
||||
\m[blue]\fBhttp://www\&.mozilla\&.org/projects/security/pki/nss/\fR\m[]\&. The NSS site relates directly to NSS code changes and releases\&.
|
||||
.PP
|
||||
Mailing lists: https://lists\&.mozilla\&.org/listinfo/dev\-tech\-crypto
|
||||
.PP
|
||||
IRC: Freenode at #dogtag\-pki
|
||||
.SH "AUTHORS"
|
||||
.PP
|
||||
The NSS tools were written and maintained by developers with Netscape, Red Hat, Sun, Oracle, Mozilla, and Google\&.
|
||||
.PP
|
||||
Authors: Elio Maldonado <emaldona@redhat\&.com>, Deon Lackey <dlackey@redhat\&.com>\&.
|
||||
.SH "LICENSE"
|
||||
.PP
|
||||
Licensed under the Mozilla Public License, v\&. 2\&.0\&. If a copy of the MPL was not distributed with this file, You can obtain one at http://mozilla\&.org/MPL/2\&.0/\&.
|
||||
.SH "NOTES"
|
||||
.IP " 1." 4
|
||||
Mozilla NSS bug 836477
|
||||
.RS 4
|
||||
\%https://bugzilla.mozilla.org/show_bug.cgi?id=836477
|
||||
.RE
|
||||
|
|
@ -1,609 +0,0 @@
|
|||
'\" t
|
||||
.\" Title: SSLTAP
|
||||
.\" Author: [see the "Authors" section]
|
||||
.\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
|
||||
.\" Date: 19 May 2021
|
||||
.\" Manual: NSS Security Tools
|
||||
.\" Source: nss-tools
|
||||
.\" Language: English
|
||||
.\"
|
||||
.TH "SSLTAP" "1" "19 May 2021" "nss-tools" "NSS Security Tools"
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * Define some portability stuff
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
.\" http://bugs.debian.org/507673
|
||||
.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html
|
||||
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
.ie \n(.g .ds Aq \(aq
|
||||
.el .ds Aq '
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * set default formatting
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" disable hyphenation
|
||||
.nh
|
||||
.\" disable justification (adjust text to left margin only)
|
||||
.ad l
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * MAIN CONTENT STARTS HERE *
|
||||
.\" -----------------------------------------------------------------
|
||||
.SH "NAME"
|
||||
ssltap \- Tap into SSL connections and display the data going by
|
||||
.SH "SYNOPSIS"
|
||||
.HP \w'\fBssltap\fR\ 'u
|
||||
\fBssltap\fR [\-fhlsvx] [\-p\ port] [hostname:port]
|
||||
.SH "STATUS"
|
||||
.PP
|
||||
This documentation is still work in progress\&. Please contribute to the initial review in
|
||||
\m[blue]\fBMozilla NSS bug 836477\fR\m[]\&\s-2\u[1]\d\s+2
|
||||
.SH "DESCRIPTION"
|
||||
.PP
|
||||
The SSL Debugging Tool
|
||||
\fBssltap\fR
|
||||
is an SSL\-aware command\-line proxy\&. It watches TCP connections and displays the data going by\&. If a connection is SSL, the data display includes interpreted SSL records and handshaking
|
||||
.SH "OPTIONS"
|
||||
.PP
|
||||
\-f
|
||||
.RS 4
|
||||
Turn on fancy printing\&. Output is printed in colored HTML\&. Data sent from the client to the server is in blue; the server\*(Aqs reply is in red\&. When used with looping mode, the different connections are separated with horizontal lines\&. You can use this option to upload the output into a browser\&.
|
||||
.RE
|
||||
.PP
|
||||
\-h
|
||||
.RS 4
|
||||
Turn on hex/ASCII printing\&. Instead of outputting raw data, the command interprets each record as a numbered line of hex values, followed by the same data as ASCII characters\&. The two parts are separated by a vertical bar\&. Nonprinting characters are replaced by dots\&.
|
||||
.RE
|
||||
.PP
|
||||
\-l prefix
|
||||
.RS 4
|
||||
Turn on looping; that is, continue to accept connections rather than stopping after the first connection is complete\&.
|
||||
.RE
|
||||
.PP
|
||||
\-p port
|
||||
.RS 4
|
||||
Change the default rendezvous port (1924) to another port\&.
|
||||
.sp
|
||||
The following are well\-known port numbers:
|
||||
.sp
|
||||
* HTTP 80
|
||||
.sp
|
||||
* HTTPS 443
|
||||
.sp
|
||||
* SMTP 25
|
||||
.sp
|
||||
* FTP 21
|
||||
.sp
|
||||
* IMAP 143
|
||||
.sp
|
||||
* IMAPS 993 (IMAP over SSL)
|
||||
.sp
|
||||
* NNTP 119
|
||||
.sp
|
||||
* NNTPS 563 (NNTP over SSL)
|
||||
.RE
|
||||
.PP
|
||||
\-s
|
||||
.RS 4
|
||||
Turn on SSL parsing and decoding\&. The tool does not automatically detect SSL sessions\&. If you are intercepting an SSL connection, use this option so that the tool can detect and decode SSL structures\&.
|
||||
.sp
|
||||
If the tool detects a certificate chain, it saves the DER\-encoded certificates into files in the current directory\&. The files are named cert\&.0x, where x is the sequence number of the certificate\&.
|
||||
.sp
|
||||
If the \-s option is used with \-h, two separate parts are printed for each record: the plain hex/ASCII output, and the parsed SSL output\&.
|
||||
.RE
|
||||
.PP
|
||||
\-v
|
||||
.RS 4
|
||||
Print a version string for the tool\&.
|
||||
.RE
|
||||
.PP
|
||||
\-x
|
||||
.RS 4
|
||||
Turn on extra SSL hex dumps\&.
|
||||
.RE
|
||||
.SH "USAGE AND EXAMPLES"
|
||||
.PP
|
||||
You can use the SSL Debugging Tool to intercept any connection information\&. Although you can run the tool at its most basic by issuing the ssltap command with no options other than hostname:port, the information you get in this way is not very useful\&. For example, assume your development machine is called intercept\&. The simplest way to use the debugging tool is to execute the following command from a command shell:
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
$ ssltap www\&.netscape\&.com
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.PP
|
||||
The program waits for an incoming connection on the default port 1924\&. In your browser window, enter the URL http://intercept:1924\&. The browser retrieves the requested page from the server at www\&.netscape\&.com, but the page is intercepted and passed on to the browser by the debugging tool on intercept\&. On its way to the browser, the data is printed to the command shell from which you issued the command\&. Data sent from the client to the server is surrounded by the following symbols: \-\-> [ data ] Data sent from the server to the client is surrounded by the following symbols: "left arrow"\-\- [ data ] The raw data stream is sent to standard output and is not interpreted in any way\&. This can result in peculiar effects, such as sounds, flashes, and even crashes of the command shell window\&. To output a basic, printable interpretation of the data, use the \-h option, or, if you are looking at an SSL connection, the \-s option\&. You will notice that the page you retrieved looks incomplete in the browser\&. This is because, by default, the tool closes down after the first connection is complete, so the browser is not able to load images\&. To make the tool continue to accept connections, switch on looping mode with the \-l option\&. The following examples show the output from commonly used combinations of options\&.
|
||||
.PP
|
||||
Example 1
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
$ ssltap\&.exe \-sx \-p 444 interzone\&.mcom\&.com:443 > sx\&.txt
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.PP
|
||||
Output
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
Connected to interzone\&.mcom\&.com:443
|
||||
\-\->; [
|
||||
alloclen = 66 bytes
|
||||
[ssl2] ClientHelloV2 {
|
||||
version = {0x03, 0x00}
|
||||
cipher\-specs\-length = 39 (0x27)
|
||||
sid\-length = 0 (0x00)
|
||||
challenge\-length = 16 (0x10)
|
||||
cipher\-suites = {
|
||||
|
||||
(0x010080) SSL2/RSA/RC4\-128/MD5
|
||||
(0x020080) SSL2/RSA/RC4\-40/MD5
|
||||
(0x030080) SSL2/RSA/RC2CBC128/MD5
|
||||
(0x040080) SSL2/RSA/RC2CBC40/MD5
|
||||
(0x060040) SSL2/RSA/DES64CBC/MD5
|
||||
(0x0700c0) SSL2/RSA/3DES192EDE\-CBC/MD5
|
||||
(0x000004) SSL3/RSA/RC4\-128/MD5
|
||||
(0x00ffe0) SSL3/RSA\-FIPS/3DES192EDE\-CBC/SHA
|
||||
(0x00000a) SSL3/RSA/3DES192EDE\-CBC/SHA
|
||||
(0x00ffe1) SSL3/RSA\-FIPS/DES64CBC/SHA
|
||||
(0x000009) SSL3/RSA/DES64CBC/SHA
|
||||
(0x000003) SSL3/RSA/RC4\-40/MD5
|
||||
(0x000006) SSL3/RSA/RC2CBC40/MD5
|
||||
}
|
||||
session\-id = { }
|
||||
challenge = { 0xec5d 0x8edb 0x37c9 0xb5c9 0x7b70 0x8fe9 0xd1d3
|
||||
|
||||
0x2592 }
|
||||
}
|
||||
]
|
||||
<\-\- [
|
||||
SSLRecord {
|
||||
0: 16 03 00 03 e5 |\&.\&.\&.\&.\&.
|
||||
type = 22 (handshake)
|
||||
version = { 3,0 }
|
||||
length = 997 (0x3e5)
|
||||
handshake {
|
||||
0: 02 00 00 46 |\&.\&.\&.F
|
||||
type = 2 (server_hello)
|
||||
length = 70 (0x000046)
|
||||
ServerHello {
|
||||
server_version = {3, 0}
|
||||
random = {\&.\&.\&.}
|
||||
0: 77 8c 6e 26 6c 0c ec c0 d9 58 4f 47 d3 2d 01 45 |
|
||||
wn&l\&.\(`i\&.\&.XOG\&.\-\&.E
|
||||
10: 5c 17 75 43 a7 4c 88 c7 88 64 3c 50 41 48 4f 7f |
|
||||
|
||||
\e\&.uC\(scL\&.\(,C\&.d<PAHO\&.
|
||||
session ID = {
|
||||
length = 32
|
||||
|
||||
contents = {\&.\&.}
|
||||
0: 14 11 07 a8 2a 31 91 29 11 94 40 37 57 10 a7 32 | \&.\&.\&.\(ad*1\&.)\&.\&.@7W\&.\(sc2
|
||||
10: 56 6f 52 62 fe 3d b3 65 b1 e4 13 0f 52 a3 c8 f6 | VoRb\(Tp=\(S3e\(+-\&.\&.\&.R\(Po\(`E\&.
|
||||
}
|
||||
cipher_suite = (0x0003) SSL3/RSA/RC4\-40/MD5
|
||||
}
|
||||
0: 0b 00 02 c5 |\&.\&.\&.\(oA
|
||||
type = 11 (certificate)
|
||||
length = 709 (0x0002c5)
|
||||
CertificateChain {
|
||||
chainlength = 706 (0x02c2)
|
||||
Certificate {
|
||||
size = 703 (0x02bf)
|
||||
data = { saved in file \*(Aqcert\&.001\*(Aq }
|
||||
}
|
||||
}
|
||||
0: 0c 00 00 ca |\&.\&.\&.\&.
|
||||
type = 12 (server_key_exchange)
|
||||
length = 202 (0x0000ca)
|
||||
0: 0e 00 00 00 |\&.\&.\&.\&.
|
||||
type = 14 (server_hello_done)
|
||||
length = 0 (0x000000)
|
||||
}
|
||||
}
|
||||
]
|
||||
\-\-> [
|
||||
SSLRecord {
|
||||
0: 16 03 00 00 44 |\&.\&.\&.\&.D
|
||||
type = 22 (handshake)
|
||||
version = { 3,0 }
|
||||
length = 68 (0x44)
|
||||
handshake {
|
||||
0: 10 00 00 40 |\&.\&.\&.@
|
||||
type = 16 (client_key_exchange)
|
||||
length = 64 (0x000040)
|
||||
ClientKeyExchange {
|
||||
message = {\&.\&.\&.}
|
||||
}
|
||||
}
|
||||
}
|
||||
]
|
||||
\-\-> [
|
||||
SSLRecord {
|
||||
0: 14 03 00 00 01 |\&.\&.\&.\&.\&.
|
||||
type = 20 (change_cipher_spec)
|
||||
version = { 3,0 }
|
||||
length = 1 (0x1)
|
||||
0: 01 |\&.
|
||||
}
|
||||
SSLRecord {
|
||||
0: 16 03 00 00 38 |\&.\&.\&.\&.8
|
||||
type = 22 (handshake)
|
||||
version = { 3,0 }
|
||||
length = 56 (0x38)
|
||||
< encrypted >
|
||||
|
||||
}
|
||||
]
|
||||
<\-\- [
|
||||
SSLRecord {
|
||||
0: 14 03 00 00 01 |\&.\&.\&.\&.\&.
|
||||
type = 20 (change_cipher_spec)
|
||||
version = { 3,0 }
|
||||
length = 1 (0x1)
|
||||
0: 01 |\&.
|
||||
}
|
||||
]
|
||||
<\-\- [
|
||||
SSLRecord {
|
||||
0: 16 03 00 00 38 |\&.\&.\&.\&.8
|
||||
type = 22 (handshake)
|
||||
version = { 3,0 }
|
||||
length = 56 (0x38)
|
||||
< encrypted >
|
||||
|
||||
}
|
||||
]
|
||||
\-\-> [
|
||||
SSLRecord {
|
||||
0: 17 03 00 01 1f |\&.\&.\&.\&.\&.
|
||||
type = 23 (application_data)
|
||||
version = { 3,0 }
|
||||
length = 287 (0x11f)
|
||||
< encrypted >
|
||||
}
|
||||
]
|
||||
<\-\- [
|
||||
SSLRecord {
|
||||
0: 17 03 00 00 a0 |\&.\&.\&.\&.
|
||||
type = 23 (application_data)
|
||||
version = { 3,0 }
|
||||
length = 160 (0xa0)
|
||||
< encrypted >
|
||||
|
||||
}
|
||||
]
|
||||
<\-\- [
|
||||
SSLRecord {
|
||||
0: 17 03 00 00 df |\&.\&.\&.\&.\(ss
|
||||
type = 23 (application_data)
|
||||
version = { 3,0 }
|
||||
length = 223 (0xdf)
|
||||
< encrypted >
|
||||
|
||||
}
|
||||
SSLRecord {
|
||||
0: 15 03 00 00 12 |\&.\&.\&.\&.\&.
|
||||
type = 21 (alert)
|
||||
version = { 3,0 }
|
||||
length = 18 (0x12)
|
||||
< encrypted >
|
||||
}
|
||||
]
|
||||
Server socket closed\&.
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.PP
|
||||
Example 2
|
||||
.PP
|
||||
The \-s option turns on SSL parsing\&. Because the \-x option is not used in this example, undecoded values are output as raw data\&. The output is routed to a text file\&.
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
$ ssltap \-s \-p 444 interzone\&.mcom\&.com:443 > s\&.txt
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.PP
|
||||
Output
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
Connected to interzone\&.mcom\&.com:443
|
||||
\-\-> [
|
||||
alloclen = 63 bytes
|
||||
[ssl2] ClientHelloV2 {
|
||||
version = {0x03, 0x00}
|
||||
cipher\-specs\-length = 36 (0x24)
|
||||
sid\-length = 0 (0x00)
|
||||
challenge\-length = 16 (0x10)
|
||||
cipher\-suites = {
|
||||
(0x010080) SSL2/RSA/RC4\-128/MD5
|
||||
(0x020080) SSL2/RSA/RC4\-40/MD5
|
||||
(0x030080) SSL2/RSA/RC2CBC128/MD5
|
||||
(0x060040) SSL2/RSA/DES64CBC/MD5
|
||||
(0x0700c0) SSL2/RSA/3DES192EDE\-CBC/MD5
|
||||
(0x000004) SSL3/RSA/RC4\-128/MD5
|
||||
(0x00ffe0) SSL3/RSA\-FIPS/3DES192EDE\-CBC/SHA
|
||||
(0x00000a) SSL3/RSA/3DES192EDE\-CBC/SHA
|
||||
(0x00ffe1) SSL3/RSA\-FIPS/DES64CBC/SHA
|
||||
(0x000009) SSL3/RSA/DES64CBC/SHA
|
||||
(0x000003) SSL3/RSA/RC4\-40/MD5
|
||||
}
|
||||
session\-id = { }
|
||||
challenge = { 0x713c 0x9338 0x30e1 0xf8d6 0xb934 0x7351 0x200c
|
||||
0x3fd0 }
|
||||
]
|
||||
>\-\- [
|
||||
SSLRecord {
|
||||
type = 22 (handshake)
|
||||
version = { 3,0 }
|
||||
length = 997 (0x3e5)
|
||||
handshake {
|
||||
type = 2 (server_hello)
|
||||
length = 70 (0x000046)
|
||||
ServerHello {
|
||||
server_version = {3, 0}
|
||||
random = {\&.\&.\&.}
|
||||
session ID = {
|
||||
length = 32
|
||||
contents = {\&.\&.}
|
||||
}
|
||||
cipher_suite = (0x0003) SSL3/RSA/RC4\-40/MD5
|
||||
}
|
||||
type = 11 (certificate)
|
||||
length = 709 (0x0002c5)
|
||||
CertificateChain {
|
||||
chainlength = 706 (0x02c2)
|
||||
Certificate {
|
||||
size = 703 (0x02bf)
|
||||
data = { saved in file \*(Aqcert\&.001\*(Aq }
|
||||
}
|
||||
}
|
||||
type = 12 (server_key_exchange)
|
||||
length = 202 (0x0000ca)
|
||||
type = 14 (server_hello_done)
|
||||
length = 0 (0x000000)
|
||||
}
|
||||
}
|
||||
]
|
||||
\-\-> [
|
||||
SSLRecord {
|
||||
type = 22 (handshake)
|
||||
version = { 3,0 }
|
||||
length = 68 (0x44)
|
||||
handshake {
|
||||
type = 16 (client_key_exchange)
|
||||
length = 64 (0x000040)
|
||||
ClientKeyExchange {
|
||||
message = {\&.\&.\&.}
|
||||
}
|
||||
}
|
||||
}
|
||||
]
|
||||
\-\-> [
|
||||
SSLRecord {
|
||||
type = 20 (change_cipher_spec)
|
||||
version = { 3,0 }
|
||||
length = 1 (0x1)
|
||||
}
|
||||
SSLRecord {
|
||||
type = 22 (handshake)
|
||||
version = { 3,0 }
|
||||
length = 56 (0x38)
|
||||
> encrypted >
|
||||
}
|
||||
]
|
||||
>\-\- [
|
||||
SSLRecord {
|
||||
type = 20 (change_cipher_spec)
|
||||
version = { 3,0 }
|
||||
length = 1 (0x1)
|
||||
}
|
||||
]
|
||||
>\-\- [
|
||||
SSLRecord {
|
||||
type = 22 (handshake)
|
||||
version = { 3,0 }
|
||||
length = 56 (0x38)
|
||||
> encrypted >
|
||||
}
|
||||
]
|
||||
\-\-> [
|
||||
SSLRecord {
|
||||
type = 23 (application_data)
|
||||
version = { 3,0 }
|
||||
length = 287 (0x11f)
|
||||
> encrypted >
|
||||
}
|
||||
]
|
||||
[
|
||||
SSLRecord {
|
||||
type = 23 (application_data)
|
||||
version = { 3,0 }
|
||||
length = 160 (0xa0)
|
||||
> encrypted >
|
||||
}
|
||||
]
|
||||
>\-\- [
|
||||
SSLRecord {
|
||||
type = 23 (application_data)
|
||||
version = { 3,0 }
|
||||
length = 223 (0xdf)
|
||||
> encrypted >
|
||||
}
|
||||
SSLRecord {
|
||||
type = 21 (alert)
|
||||
version = { 3,0 }
|
||||
length = 18 (0x12)
|
||||
> encrypted >
|
||||
}
|
||||
]
|
||||
Server socket closed\&.
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.PP
|
||||
Example 3
|
||||
.PP
|
||||
In this example, the \-h option turns hex/ASCII format\&. There is no SSL parsing or decoding\&. The output is routed to a text file\&.
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
$ ssltap \-h \-p 444 interzone\&.mcom\&.com:443 > h\&.txt
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.PP
|
||||
Output
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
Connected to interzone\&.mcom\&.com:443
|
||||
\-\-> [
|
||||
0: 80 40 01 03 00 00 27 00 00 00 10 01 00 80 02 00 | \&.@\&.\&.\&.\&.\*(Aq\&.\&.\&.\&.\&.\&.\&.\&.\&.
|
||||
10: 80 03 00 80 04 00 80 06 00 40 07 00 c0 00 00 04 | \&.\&.\&.\&.\&.\&.\&.\&.\&.@\&.\&.\&.\&.\&.\&.
|
||||
20: 00 ff e0 00 00 0a 00 ff e1 00 00 09 00 00 03 00 | \&.\&.\&.\&.\&.\&.\&.\&.\('a\&.\&.\&.\&.\&.\&.\&.
|
||||
30: 00 06 9b fe 5b 56 96 49 1f 9f ca dd d5 ba b9 52 | \&.\&.\(Tp[V\&.I\&.\exd9 \&.\&.\&.\(Om\(S1R
|
||||
40: 6f 2d |o\-
|
||||
]
|
||||
<\-\- [
|
||||
0: 16 03 00 03 e5 02 00 00 46 03 00 7f e5 0d 1b 1d | \&.\&.\&.\&.\&.\&.\&.\&.F\&.\&.\&.\&.\&.\&.\&.
|
||||
10: 68 7f 3a 79 60 d5 17 3c 1d 9c 96 b3 88 d2 69 3b | h\&.:y`\&.\&.<\&.\&.\(S3\&.\(`Oi;
|
||||
20: 78 e2 4b 8b a6 52 12 4b 46 e8 c2 20 14 11 89 05 | x\&.K\&.\(bbR\&.KF\(`e\&. \&.\&.\&.
|
||||
30: 4d 52 91 fd 93 e0 51 48 91 90 08 96 c1 b6 76 77 | MR\&.\('y\&.\&.QH\&.\&.\&.\&.\&.\(psvw
|
||||
40: 2a f4 00 08 a1 06 61 a2 64 1f 2e 9b 00 03 00 0b | *\(^o\&.\&.\(r!\&.a\(ctd\&.\&.\&.\&.\&.\&.
|
||||
50: 00 02 c5 00 02 c2 00 02 bf 30 82 02 bb 30 82 02 | \&.\&.\(oA\&.\&.\&.\&.\&.\&.0\&.\&.\&.0\&.\&.
|
||||
60: 24 a0 03 02 01 02 02 02 01 36 30 0d 06 09 2a 86 | $ \&.\&.\&.\&.\&.\&.\&.60\&.\&.\&.*\&.
|
||||
70: 48 86 f7 0d 01 01 04 05 00 30 77 31 0b 30 09 06 | H\&.\(di\&.\&.\&.\&.\&.\&.0w1\&.0\&.\&.
|
||||
80: 03 55 04 06 13 02 55 53 31 2c 30 2a 06 03 55 04 | \&.U\&.\&.\&.\&.US1,0*\&.\&.U\&.
|
||||
90: 0a 13 23 4e 65 74 73 63 61 70 65 20 43 6f 6d 6d | \&.\&.#Netscape Comm
|
||||
a0: 75 6e 69 63 61 74 69 6f 6e 73 20 43 6f 72 70 6f | unications Corpo
|
||||
b0: 72 61 74 69 6f 6e 31 11 30 0f 06 03 55 04 0b 13 | ration1\&.0\&.\&.\&.U\&.\&.\&.
|
||||
c0: 08 48 61 72 64 63 6f 72 65 31 27 30 25 06 03 55 | \&.Hardcore1\*(Aq0%\&.\&.U
|
||||
d0: 04 03 13 1e 48 61 72 64 63 6f 72 65 20 43 65 72 | \&.\&.\&.\&.Hardcore Cer
|
||||
e0: 74 69 66 69 63 61 74 65 20 53 65 72 76 65 72 20 | tificate Server
|
||||
f0: 49 49 30 1e 17 0d 39 38 30 35 31 36 30 31 30 33 | II0\&.\&.\&.9805160103
|
||||
<additional data lines>
|
||||
]
|
||||
<additional records in same format>
|
||||
Server socket closed\&.
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.PP
|
||||
Example 4
|
||||
.PP
|
||||
In this example, the \-s option turns on SSL parsing, and the \-h option turns on hex/ASCII format\&. Both formats are shown for each record\&. The output is routed to a text file\&.
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
$ ssltap \-hs \-p 444 interzone\&.mcom\&.com:443 > hs\&.txt
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.PP
|
||||
Output
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
Connected to interzone\&.mcom\&.com:443
|
||||
\-\-> [
|
||||
0: 80 3d 01 03 00 00 24 00 00 00 10 01 00 80 02 00 | \&.=\&.\&.\&.\&.$\&.\&.\&.\&.\&.\&.\&.\&.\&.
|
||||
10: 80 03 00 80 04 00 80 06 00 40 07 00 c0 00 00 04 | \&.\&.\&.\&.\&.\&.\&.\&.\&.@\&.\&.\&.\&.\&.\&.
|
||||
20: 00 ff e0 00 00 0a 00 ff e1 00 00 09 00 00 03 03 | \&.\&.\&.\&.\&.\&.\&.\&.\('a\&.\&.\&.\&.\&.\&.\&.
|
||||
30: 55 e6 e4 99 79 c7 d7 2c 86 78 96 5d b5 cf e9 |U\&.\&.y\(,C\exb0 ,\&.x\&.]\(mc\(:I\('e
|
||||
alloclen = 63 bytes
|
||||
[ssl2] ClientHelloV2 {
|
||||
version = {0x03, 0x00}
|
||||
cipher\-specs\-length = 36 (0x24)
|
||||
sid\-length = 0 (0x00)
|
||||
challenge\-length = 16 (0x10)
|
||||
cipher\-suites = {
|
||||
(0x010080) SSL2/RSA/RC4\-128/MD5
|
||||
(0x020080) SSL2/RSA/RC4\-40/MD5
|
||||
(0x030080) SSL2/RSA/RC2CBC128/MD5
|
||||
(0x040080) SSL2/RSA/RC2CBC40/MD5
|
||||
(0x060040) SSL2/RSA/DES64CBC/MD5
|
||||
(0x0700c0) SSL2/RSA/3DES192EDE\-CBC/MD5
|
||||
(0x000004) SSL3/RSA/RC4\-128/MD5
|
||||
(0x00ffe0) SSL3/RSA\-FIPS/3DES192EDE\-CBC/SHA
|
||||
(0x00000a) SSL3/RSA/3DES192EDE\-CBC/SHA
|
||||
(0x00ffe1) SSL3/RSA\-FIPS/DES64CBC/SHA
|
||||
(0x000009) SSL3/RSA/DES64CBC/SHA
|
||||
(0x000003) SSL3/RSA/RC4\-40/MD5
|
||||
}
|
||||
session\-id = { }
|
||||
challenge = { 0x0355 0xe6e4 0x9979 0xc7d7 0x2c86 0x7896 0x5db
|
||||
|
||||
0xcfe9 }
|
||||
}
|
||||
]
|
||||
<additional records in same formats>
|
||||
Server socket closed\&.
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.SH "USAGE TIPS"
|
||||
.PP
|
||||
When SSL restarts a previous session, it makes use of cached information to do a partial handshake\&. If you wish to capture a full SSL handshake, restart the browser to clear the session id cache\&.
|
||||
.PP
|
||||
If you run the tool on a machine other than the SSL server to which you are trying to connect, the browser will complain that the host name you are trying to connect to is different from the certificate\&. If you are using the default BadCert callback, you can still connect through a dialog\&. If you are not using the default BadCert callback, the one you supply must allow for this possibility\&.
|
||||
.SH "SEE ALSO"
|
||||
.PP
|
||||
The NSS Security Tools are also documented at
|
||||
\m[blue]\fBhttp://www\&.mozilla\&.org/projects/security/pki/nss/\fR\m[]\&\s-2\u[2]\d\s+2\&.
|
||||
.SH "ADDITIONAL RESOURCES"
|
||||
.PP
|
||||
For information about NSS and other tools related to NSS (like JSS), check out the NSS project wiki at
|
||||
\m[blue]\fBhttp://www\&.mozilla\&.org/projects/security/pki/nss/\fR\m[]\&. The NSS site relates directly to NSS code changes and releases\&.
|
||||
.PP
|
||||
Mailing lists: https://lists\&.mozilla\&.org/listinfo/dev\-tech\-crypto
|
||||
.PP
|
||||
IRC: Freenode at #dogtag\-pki
|
||||
.SH "AUTHORS"
|
||||
.PP
|
||||
The NSS tools were written and maintained by developers with Netscape, Red Hat, Sun, Oracle, Mozilla, and Google\&.
|
||||
.PP
|
||||
Authors: Elio Maldonado <emaldona@redhat\&.com>, Deon Lackey <dlackey@redhat\&.com>\&.
|
||||
.SH "LICENSE"
|
||||
.PP
|
||||
Licensed under the Mozilla Public License, v\&. 2\&.0\&. If a copy of the MPL was not distributed with this file, You can obtain one at http://mozilla\&.org/MPL/2\&.0/\&.
|
||||
.SH "NOTES"
|
||||
.IP " 1." 4
|
||||
Mozilla NSS bug 836477
|
||||
.RS 4
|
||||
\%https://bugzilla.mozilla.org/show_bug.cgi?id=836477
|
||||
.RE
|
||||
.IP " 2." 4
|
||||
http://www.mozilla.org/projects/security/pki/nss/
|
||||
.RS 4
|
||||
\%http://www.mozilla.org/projects/security/pki/nss/tools
|
||||
.RE
|
||||
|
|
@ -1,169 +0,0 @@
|
|||
'\" t
|
||||
.\" Title: VFYCHAIN
|
||||
.\" Author: [see the "Authors" section]
|
||||
.\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
|
||||
.\" Date: 19 May 2021
|
||||
.\" Manual: NSS Security Tools
|
||||
.\" Source: nss-tools
|
||||
.\" Language: English
|
||||
.\"
|
||||
.TH "VFYCHAIN" "1" "19 May 2021" "nss-tools" "NSS Security Tools"
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * Define some portability stuff
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
.\" http://bugs.debian.org/507673
|
||||
.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html
|
||||
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
.ie \n(.g .ds Aq \(aq
|
||||
.el .ds Aq '
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * set default formatting
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" disable hyphenation
|
||||
.nh
|
||||
.\" disable justification (adjust text to left margin only)
|
||||
.ad l
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * MAIN CONTENT STARTS HERE *
|
||||
.\" -----------------------------------------------------------------
|
||||
.SH "NAME"
|
||||
vfychain_ \- vfychain [options] [revocation options] certfile [[options] certfile] \&.\&.\&.
|
||||
.SH "SYNOPSIS"
|
||||
.HP \w'\fBvfychain\fR\ 'u
|
||||
\fBvfychain\fR
|
||||
.SH "STATUS"
|
||||
.PP
|
||||
This documentation is still work in progress\&. Please contribute to the initial review in
|
||||
\m[blue]\fBMozilla NSS bug 836477\fR\m[]\&\s-2\u[1]\d\s+2
|
||||
.SH "DESCRIPTION"
|
||||
.PP
|
||||
The verification Tool,
|
||||
\fBvfychain\fR, verifies certificate chains\&.
|
||||
\fBmodutil\fR
|
||||
can add and delete PKCS #11 modules, change passwords on security databases, set defaults, list module contents, enable or disable slots, enable or disable FIPS 140\-2 compliance, and assign default providers for cryptographic operations\&. This tool can also create certificate, key, and module security database files\&.
|
||||
.PP
|
||||
The tasks associated with security module database management are part of a process that typically also involves managing key databases and certificate databases\&.
|
||||
.SH "OPTIONS"
|
||||
.PP
|
||||
\fB\-a\fR
|
||||
.RS 4
|
||||
the following certfile is base64 encoded
|
||||
.RE
|
||||
.PP
|
||||
\fB\-b \fR \fIYYMMDDHHMMZ\fR
|
||||
.RS 4
|
||||
Validate date (default: now)
|
||||
.RE
|
||||
.PP
|
||||
\fB\-d \fR \fIdirectory\fR
|
||||
.RS 4
|
||||
database directory
|
||||
.RE
|
||||
.PP
|
||||
\fB\-f \fR
|
||||
.RS 4
|
||||
Enable cert fetching from AIA URL
|
||||
.RE
|
||||
.PP
|
||||
\fB\-o \fR \fIoid\fR
|
||||
.RS 4
|
||||
Set policy OID for cert validation(Format OID\&.1\&.2\&.3)
|
||||
.RE
|
||||
.PP
|
||||
\fB\-p \fR
|
||||
.RS 4
|
||||
Use PKIX Library to validate certificate by calling:
|
||||
.sp
|
||||
* CERT_VerifyCertificate if specified once,
|
||||
.sp
|
||||
* CERT_PKIXVerifyCert if specified twice and more\&.
|
||||
.RE
|
||||
.PP
|
||||
\fB\-r \fR
|
||||
.RS 4
|
||||
Following certfile is raw binary DER (default)
|
||||
.RE
|
||||
.PP
|
||||
\fB\-t\fR
|
||||
.RS 4
|
||||
Following cert is explicitly trusted (overrides db trust)
|
||||
.RE
|
||||
.PP
|
||||
\fB\-u \fR \fIusage\fR
|
||||
.RS 4
|
||||
0=SSL client, 1=SSL server, 2=SSL StepUp, 3=SSL CA, 4=Email signer, 5=Email recipient, 6=Object signer, 9=ProtectedObjectSigner, 10=OCSP responder, 11=Any CA
|
||||
.RE
|
||||
.PP
|
||||
\fB\-T \fR
|
||||
.RS 4
|
||||
Trust both explicit trust anchors (\-t) and the database\&. (Without this option, the default is to only trust certificates marked \-t, if there are any, or to trust the database if there are certificates marked \-t\&.)
|
||||
.RE
|
||||
.PP
|
||||
\fB\-v \fR
|
||||
.RS 4
|
||||
Verbose mode\&. Prints root cert subject(double the argument for whole root cert info)
|
||||
.RE
|
||||
.PP
|
||||
\fB\-w \fR \fIpassword\fR
|
||||
.RS 4
|
||||
Database password
|
||||
.RE
|
||||
.PP
|
||||
\fB\-W \fR \fIpwfile\fR
|
||||
.RS 4
|
||||
Password file
|
||||
.RE
|
||||
.PP
|
||||
.RS 4
|
||||
Revocation options for PKIX API (invoked with \-pp options) is a collection of the following flags: [\-g type [\-h flags] [\-m type [\-s flags]] \&.\&.\&.] \&.\&.\&.
|
||||
.sp
|
||||
Where:
|
||||
.RE
|
||||
.PP
|
||||
\fB\-g \fR \fItest\-type\fR
|
||||
.RS 4
|
||||
Sets status checking test type\&. Possible values are "leaf" or "chain"
|
||||
.RE
|
||||
.PP
|
||||
\fB\-g \fR \fItest type\fR
|
||||
.RS 4
|
||||
Sets status checking test type\&. Possible values are "leaf" or "chain"\&.
|
||||
.RE
|
||||
.PP
|
||||
\fB\-h \fR \fItest flags\fR
|
||||
.RS 4
|
||||
Sets revocation flags for the test type it follows\&. Possible flags: "testLocalInfoFirst" and "requireFreshInfo"\&.
|
||||
.RE
|
||||
.PP
|
||||
\fB\-m \fR \fImethod type\fR
|
||||
.RS 4
|
||||
Sets method type for the test type it follows\&. Possible types are "crl" and "ocsp"\&.
|
||||
.RE
|
||||
.PP
|
||||
\fB\-s \fR \fImethod flags\fR
|
||||
.RS 4
|
||||
Sets revocation flags for the method it follows\&. Possible types are "doNotUse", "forbidFetching", "ignoreDefaultSrc", "requireInfo" and "failIfNoInfo"\&.
|
||||
.RE
|
||||
.SH "ADDITIONAL RESOURCES"
|
||||
.PP
|
||||
For information about NSS and other tools related to NSS (like JSS), check out the NSS project wiki at
|
||||
\m[blue]\fBhttp://www\&.mozilla\&.org/projects/security/pki/nss/\fR\m[]\&. The NSS site relates directly to NSS code changes and releases\&.
|
||||
.PP
|
||||
Mailing lists: https://lists\&.mozilla\&.org/listinfo/dev\-tech\-crypto
|
||||
.PP
|
||||
IRC: Freenode at #dogtag\-pki
|
||||
.SH "AUTHORS"
|
||||
.PP
|
||||
The NSS tools were written and maintained by developers with Netscape, Red Hat, Sun, Oracle, Mozilla, and Google\&.
|
||||
.PP
|
||||
Authors: Elio Maldonado <emaldona@redhat\&.com>, Deon Lackey <dlackey@redhat\&.com>\&.
|
||||
.SH "LICENSE"
|
||||
.PP
|
||||
Licensed under the Mozilla Public License, v\&. 2\&.0\&. If a copy of the MPL was not distributed with this file, You can obtain one at http://mozilla\&.org/MPL/2\&.0/\&.
|
||||
.SH "NOTES"
|
||||
.IP " 1." 4
|
||||
Mozilla NSS bug 836477
|
||||
.RS 4
|
||||
\%https://bugzilla.mozilla.org/show_bug.cgi?id=836477
|
||||
.RE
|
||||
|
|
@ -1,70 +0,0 @@
|
|||
'\" t
|
||||
.\" Title: VFYSERV
|
||||
.\" Author: [see the "Authors" section]
|
||||
.\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
|
||||
.\" Date: 19 May 2021
|
||||
.\" Manual: NSS Security Tools
|
||||
.\" Source: nss-tools
|
||||
.\" Language: English
|
||||
.\"
|
||||
.TH "VFYSERV" "1" "19 May 2021" "nss-tools" "NSS Security Tools"
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * Define some portability stuff
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
.\" http://bugs.debian.org/507673
|
||||
.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html
|
||||
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
.ie \n(.g .ds Aq \(aq
|
||||
.el .ds Aq '
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * set default formatting
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" disable hyphenation
|
||||
.nh
|
||||
.\" disable justification (adjust text to left margin only)
|
||||
.ad l
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * MAIN CONTENT STARTS HERE *
|
||||
.\" -----------------------------------------------------------------
|
||||
.SH "NAME"
|
||||
vfyserv_ \- TBD
|
||||
.SH "SYNOPSIS"
|
||||
.HP \w'\fBvfyserv\fR\ 'u
|
||||
\fBvfyserv\fR
|
||||
.SH "STATUS"
|
||||
.PP
|
||||
This documentation is still work in progress\&. Please contribute to the initial review in
|
||||
\m[blue]\fBMozilla NSS bug 836477\fR\m[]\&\s-2\u[1]\d\s+2
|
||||
.SH "DESCRIPTION"
|
||||
.PP
|
||||
The
|
||||
\fBvfyserv \fR
|
||||
tool verifies a certificate chain
|
||||
.SH "OPTIONS"
|
||||
.PP
|
||||
.RS 4
|
||||
.sp
|
||||
.RE
|
||||
.SH "ADDITIONAL RESOURCES"
|
||||
.PP
|
||||
For information about NSS and other tools related to NSS (like JSS), check out the NSS project wiki at
|
||||
\m[blue]\fBhttp://www\&.mozilla\&.org/projects/security/pki/nss/\fR\m[]\&. The NSS site relates directly to NSS code changes and releases\&.
|
||||
.PP
|
||||
Mailing lists: https://lists\&.mozilla\&.org/listinfo/dev\-tech\-crypto
|
||||
.PP
|
||||
IRC: Freenode at #dogtag\-pki
|
||||
.SH "AUTHORS"
|
||||
.PP
|
||||
The NSS tools were written and maintained by developers with Netscape, Red Hat, Sun, Oracle, Mozilla, and Google\&.
|
||||
.PP
|
||||
Authors: Elio Maldonado <emaldona@redhat\&.com>, Deon Lackey <dlackey@redhat\&.com>\&.
|
||||
.SH "LICENSE"
|
||||
.PP
|
||||
Licensed under the Mozilla Public License, v\&. 2\&.0\&. If a copy of the MPL was not distributed with this file, You can obtain one at http://mozilla\&.org/MPL/2\&.0/\&.
|
||||
.SH "NOTES"
|
||||
.IP " 1." 4
|
||||
Mozilla NSS bug 836477
|
||||
.RS 4
|
||||
\%https://bugzilla.mozilla.org/show_bug.cgi?id=836477
|
||||
.RE
|
||||
|
|
@ -1,174 +0,0 @@
|
|||
.. _mozilla_projects_nss_nss_3_11_10_release_notes_html:
|
||||
|
||||
NSS_3.11.10_release_notes.html
|
||||
==============================
|
||||
|
||||
.. _nss_3.11.10_release_notes:
|
||||
|
||||
`NSS 3.11.10 Release Notes <#nss_3.11.10_release_notes>`__
|
||||
----------------------------------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
.. _2008-12-10:
|
||||
|
||||
`2008-12-10 <#2008-12-10>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
Newsgroup: <ahref="news: mozilla.dev.tech.crypto"=""
|
||||
news.mozilla.org="">mozilla.dev.tech.crypto</ahref="news:>
|
||||
|
||||
`Contents <#contents>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
- `Introduction <#introduction>`__
|
||||
- `Distribution Information <#distribution>`__
|
||||
- `Bugs Fixed <#bugsfixed>`__
|
||||
- `Documentation <#docs>`__
|
||||
- `Compatibility <#compatibility>`__
|
||||
- `Feedback <#feedback>`__
|
||||
|
||||
--------------
|
||||
|
||||
`Introduction <#introduction>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
Network Security Services (NSS) 3.11.10 is a patch release for NSS 3.11. The bug fixes in NSS
|
||||
3.11.10 are described in the "`Bugs Fixed <#bugsfixed>`__" section below.
|
||||
|
||||
--------------
|
||||
|
||||
.. _distribution_information:
|
||||
|
||||
`Distribution Information <#distribution_information>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
The CVS tag for the NSS 3.11.10 release is NSS_3_11_10_RTM. NSS 3.11.10 requires `NSPR
|
||||
4.7.1 <https://www.mozilla.org/projects/nspr/release-notes/nspr471.html>`__.
|
||||
See the `Documentation <#docs>`__ section for the build instructions.
|
||||
NSS 3.11.10 source and binary distributions are also available on ftp.mozilla.org for secure
|
||||
HTTPS download:
|
||||
|
||||
- Source tarballs:
|
||||
https://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_11_10_RTM/src/.
|
||||
- Binary distributions:
|
||||
https://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_11_10_RTM/. Both debug and
|
||||
optimized builds are provided. Go to the subdirectory for your platform, DBG (debug) or OPT
|
||||
(optimized), to get the tar.gz or zip file. The tar.gz or zip file expands to an nss-3.11.10
|
||||
directory containing three subdirectories:
|
||||
|
||||
- include - NSS header files
|
||||
- lib - NSS shared libraries
|
||||
- bin - `NSS Tools <https://www.mozilla.org/projects/security/pki/nss/tools/>`__ and test
|
||||
programs
|
||||
|
||||
You also need to download the NSPR 4.7.1 binary distributions to get the NSPR 4.7.1 header files
|
||||
and shared libraries, which NSS 3.11.10 requires. NSPR 4.7.1 binary distributions are in
|
||||
https://ftp.mozilla.org/pub/mozilla.org/nspr/releases/v4.7.1/.
|
||||
|
||||
--------------
|
||||
|
||||
.. _bugs_fixed:
|
||||
|
||||
`Bugs Fixed <#bugs_fixed>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
The following bugs have been fixed in NSS 3.11.10.
|
||||
|
||||
- `Bug 291384 <https://bugzilla.mozilla.org/show_bug.cgi?id=291384>`__: certutil -K behavior
|
||||
doesn't match usage
|
||||
- `Bug 374247 <https://bugzilla.mozilla.org/show_bug.cgi?id=374247>`__: modutil -disable command
|
||||
not disabling modules' slots
|
||||
- `Bug 384459 <https://bugzilla.mozilla.org/show_bug.cgi?id=384459>`__: Certification path
|
||||
validation fails when Authority Key Identifier extension contains key identifier
|
||||
- `Bug 385946 <https://bugzilla.mozilla.org/show_bug.cgi?id=385946>`__: Can't import certificate
|
||||
into cert database in FIPS mode (certutil).
|
||||
- `Bug 387892 <https://bugzilla.mozilla.org/show_bug.cgi?id=387892>`__: Add Entrust root CA
|
||||
certificate(s) to NSS
|
||||
- `Bug 396999 <https://bugzilla.mozilla.org/show_bug.cgi?id=396999>`__: PK11_Authenticate
|
||||
- `Bug 397478 <https://bugzilla.mozilla.org/show_bug.cgi?id=397478>`__: Lock from
|
||||
ssl_InitSymWrapKeysLock not freed on selfserv shutdown.
|
||||
- `Bug 397486 <https://bugzilla.mozilla.org/show_bug.cgi?id=397486>`__: Session cache locks not
|
||||
freed on strsclnt shutdown.
|
||||
- `Bug 398680 <https://bugzilla.mozilla.org/show_bug.cgi?id=398680>`__: assertion botch in
|
||||
ssl3_RegisterServerHelloExtensionSender doing second handshake with SSL_ForceHandshake
|
||||
- `Bug 403240 <https://bugzilla.mozilla.org/show_bug.cgi?id=403240>`__: threads hanging in
|
||||
nss_InitLock
|
||||
- `Bug 403888 <https://bugzilla.mozilla.org/show_bug.cgi?id=403888>`__: memory leak in
|
||||
trustdomain.c
|
||||
- `Bug 416067 <https://bugzilla.mozilla.org/show_bug.cgi?id=416067>`__: certutil -L -h token
|
||||
doesn't report token authentication failure
|
||||
- `Bug 417637 <https://bugzilla.mozilla.org/show_bug.cgi?id=417637>`__: tstclnt crashes if -p
|
||||
option is not specified
|
||||
- `Bug 421634 <https://bugzilla.mozilla.org/show_bug.cgi?id=421634>`__: Don't send an SNI Client
|
||||
Hello extension bearing an IPv6 address
|
||||
- `Bug 422918 <https://bugzilla.mozilla.org/show_bug.cgi?id=422918>`__: Add VeriSign Class 3
|
||||
Public Primary CA - G5 to NSS
|
||||
- `Bug 424152 <https://bugzilla.mozilla.org/show_bug.cgi?id=424152>`__: Add thawte Primary Root
|
||||
CA to NSS
|
||||
- `Bug 424169 <https://bugzilla.mozilla.org/show_bug.cgi?id=424169>`__: Add GeoTrust Primary
|
||||
Certification Authority root to NSS
|
||||
- `Bug 425469 <https://bugzilla.mozilla.org/show_bug.cgi?id=425469>`__: Add multiple new roots:
|
||||
Geotrust
|
||||
- `Bug 426568 <https://bugzilla.mozilla.org/show_bug.cgi?id=426568>`__: Add COMODO Certification
|
||||
Authority certificate to NSS
|
||||
- `Bug 431381 <https://bugzilla.mozilla.org/show_bug.cgi?id=431381>`__: Add Network Solutions
|
||||
Certificate Authority root to NSS
|
||||
- `Bug 431621 <https://bugzilla.mozilla.org/show_bug.cgi?id=431621>`__: Add DigiNotar Root CA
|
||||
root to NSS
|
||||
- `Bug 431772 <https://bugzilla.mozilla.org/show_bug.cgi?id=431772>`__: add network solutions
|
||||
and diginotar root certs to NSS
|
||||
- `Bug 442912 <https://bugzilla.mozilla.org/show_bug.cgi?id=442912>`__: fix nssckbi version
|
||||
number on 3.11 branch
|
||||
- `Bug 443045 <https://bugzilla.mozilla.org/show_bug.cgi?id=443045>`__: Fix PK11_GenerateKeyPair
|
||||
for ECC keys on the 3.11 branch
|
||||
- `Bug 444850 <https://bugzilla.mozilla.org/show_bug.cgi?id=444850>`__: NSS misbehaves badly in
|
||||
the presence of a disabled PKCS#11 slot
|
||||
- `Bug 462948 <https://bugzilla.mozilla.org/show_bug.cgi?id=462948>`__: lint warnings for source
|
||||
files that include keythi.h
|
||||
|
||||
--------------
|
||||
|
||||
`Documentation <#documentation>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
For a list of the primary NSS documentation pages on mozilla.org, see `NSS
|
||||
Documentation <../index.html#Documentation>`__. New and revised documents available since the
|
||||
release of NSS 3.9 include the following:
|
||||
|
||||
- `Build Instructions for NSS 3.11.4 and above <../nss-3.11.4/nss-3.11.4-build.html>`__
|
||||
|
||||
--------------
|
||||
|
||||
`Compatibility <#compatibility>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
NSS 3.11.10 shared libraries are backward compatible with all older NSS 3.x shared libraries. A
|
||||
program linked with older NSS 3.x shared libraries will work with NSS 3.11.10 shared libraries
|
||||
without recompiling or relinking. Furthermore, applications that restrict their use of NSS APIs
|
||||
to the functions listed in `NSS Public Functions <../ref/nssfunctions.html>`__ will remain
|
||||
compatible with future versions of the NSS shared libraries.
|
||||
|
||||
--------------
|
||||
|
||||
`Feedback <#feedback>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
Bugs discovered should be reported by filing a bug report with `mozilla.org
|
||||
Bugzilla <https://bugzilla.mozilla.org/>`__ (product NSS).
|
||||
|
|
@ -1,255 +0,0 @@
|
|||
.. _mozilla_projects_nss_nss_3_12_1_release_notes_html:
|
||||
|
||||
NSS_3.12.1_release_notes.html
|
||||
=============================
|
||||
|
||||
.. _nss_3.12.1_release_notes:
|
||||
|
||||
`NSS 3.12.1 Release Notes <#nss_3.12.1_release_notes>`__
|
||||
--------------------------------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
.. _2008-09-05:
|
||||
|
||||
`2008-09-05 <#2008-09-05>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
Newsgroup: `mozilla.dev.tech.crypto <news://news.mozilla.org/mozilla.dev.tech.crypto>`__
|
||||
|
||||
`Contents <#contents>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
- `Introduction <#introduction>`__
|
||||
- `Distribution Information <#distribution_information>`__
|
||||
- `New in NSS 3.12.1 <#new_in_nss_3.12.1>`__
|
||||
- `Bugs Fixed <#bugs_fixed>`__
|
||||
- `Documentation <#documentation>`__
|
||||
- `Compatibility <#compatibility>`__
|
||||
- `Feedback <#feedback>`__
|
||||
|
||||
--------------
|
||||
|
||||
`Introduction <#introduction>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
Network Security Services (NSS) 3.12.1 is a patch release for NSS 3.12. The bug fixes in NSS
|
||||
3.12.1 are described in the "`Bugs Fixed <#bugsfixed>`__" section below.
|
||||
NSS 3.12.1 is tri-licensed under the MPL 1.1/GPL 2.0/LGPL 2.1.
|
||||
|
||||
--------------
|
||||
|
||||
.. _distribution_information:
|
||||
|
||||
`Distribution Information <#distribution_information>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
The CVS tag for the NSS 3.12.1 release is NSS_3_12_1_RTM. NSS 3.12.1 requires `NSPR
|
||||
4.7.1 <https://www.mozilla.org/projects/nspr/release-notes/nspr471.html>`__.
|
||||
See the `Documentation <#docs>`__ section for the build instructions.
|
||||
NSS 3.12.1 source and binary distributions are also available on ftp.mozilla.org for secure HTTPS
|
||||
download:
|
||||
|
||||
- Source tarballs:
|
||||
https://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_12_1_RTM/src/.
|
||||
- Binary distributions:
|
||||
https://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_12_1_RTM/. Both debug and
|
||||
optimized builds are provided. Go to the subdirectory for your platform, DBG (debug) or OPT
|
||||
(optimized), to get the tar.gz or zip file. The tar.gz or zip file expands to an nss-3.12.1
|
||||
directory containing three subdirectories:
|
||||
|
||||
- include - NSS header files
|
||||
- lib - NSS shared libraries
|
||||
- bin - `NSS Tools <https://www.mozilla.org/projects/security/pki/nss/tools/>`__ and test
|
||||
programs
|
||||
|
||||
You also need to download the NSPR 4.7.1 binary distributions to get the NSPR 4.7.1 header files
|
||||
and shared libraries, which NSS 3.12.1 requires. NSPR 4.7.1 binary distributions are in
|
||||
https://ftp.mozilla.org/pub/mozilla.org/nspr/releases/v4.7.1/.
|
||||
|
||||
--------------
|
||||
|
||||
.. _new_in_nss_3.12.1:
|
||||
|
||||
`New in NSS 3.12.1 <#new_in_nss_3.12.1>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
- New functions in the nss shared library:
|
||||
|
||||
CERT_NameToAsciiInvertible (see cert.h)
|
||||
Convert an CERTName into its RFC1485 encoded equivalent.
|
||||
Returns a string that must be freed with PORT_Free().
|
||||
Caller chooses encoding rules.
|
||||
CERT_EncodeSubjectKeyID (see cert.h)
|
||||
Encode Certificate SKID (Subject Key ID) extension.
|
||||
PK11_GetAllSlotsForCert (see pk11pub.h)
|
||||
PK11_GetAllSlotsForCert returns all the slots that a given certificate
|
||||
exists on, since it's possible for a cert to exist on more than one
|
||||
PKCS#11 token.
|
||||
|
||||
- Levels of standards conformance strictness for CERT_NameToAsciiInvertible (see certt.h)
|
||||
|
||||
CERT_N2A_READABLE
|
||||
(maximum human readability)
|
||||
CERT_N2A_STRICT
|
||||
(strict RFC compliance)
|
||||
CERT_N2A_INVERTIBLE
|
||||
(maximum invertibility)
|
||||
|
||||
--------------
|
||||
|
||||
.. _bugs_fixed:
|
||||
|
||||
`Bugs Fixed <#bugs_fixed>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
The following bugs have been fixed in NSS 3.12.1.
|
||||
|
||||
- `Bug 67890 <https://bugzilla.mozilla.org/show_bug.cgi?id=67890>`__: create self-signed cert
|
||||
with existing key that signed CSR
|
||||
- `Bug 129303 <https://bugzilla.mozilla.org/show_bug.cgi?id=129303>`__: NSS needs to expose
|
||||
interfaces to deal with multiple token sources of certs.
|
||||
- `Bug 311432 <https://bugzilla.mozilla.org/show_bug.cgi?id=311432>`__: ECC's ECL_USE_FP code
|
||||
(for Linux x86) fails pairwise consistency test
|
||||
- `Bug 330622 <https://bugzilla.mozilla.org/show_bug.cgi?id=330622>`__: certutil's usage
|
||||
messages incorrectly document certain options
|
||||
- `Bug 330628 <https://bugzilla.mozilla.org/show_bug.cgi?id=330628>`__: coreconf/Linux.mk should
|
||||
\_not\_ default to x86 but result in an error if host is not recognized
|
||||
- `Bug 359302 <https://bugzilla.mozilla.org/show_bug.cgi?id=359302>`__: Remove the sslsample
|
||||
code from NSS source tree
|
||||
- `Bug 372241 <https://bugzilla.mozilla.org/show_bug.cgi?id=372241>`__: Need more versatile form
|
||||
of CERT_NameToAscii
|
||||
- `Bug 390296 <https://bugzilla.mozilla.org/show_bug.cgi?id=390296>`__: NSS ignores subject CN
|
||||
even when SAN contains no dNSName
|
||||
- `Bug 401928 <https://bugzilla.mozilla.org/show_bug.cgi?id=401928>`__: Support generalized
|
||||
PKCS#5 v2 PBEs
|
||||
- `Bug 403543 <https://bugzilla.mozilla.org/show_bug.cgi?id=403543>`__: pkix: need a way to
|
||||
enable/disable AIA cert fetching
|
||||
- `Bug 408847 <https://bugzilla.mozilla.org/show_bug.cgi?id=408847>`__: pkix_OcspChecker_Check
|
||||
does not support specified responder (and given signercert)
|
||||
- `Bug 414003 <https://bugzilla.mozilla.org/show_bug.cgi?id=414003>`__: Crash [[@
|
||||
CERT_DecodeCertPackage] sometimes with this testcase
|
||||
- `Bug 415167 <https://bugzilla.mozilla.org/show_bug.cgi?id=415167>`__: Memory leak in certutil
|
||||
- `Bug 417399 <https://bugzilla.mozilla.org/show_bug.cgi?id=417399>`__: Arena Allocation results
|
||||
are not checked in pkix_pl_InfoAccess_ParseLocation
|
||||
- `Bug 420644 <https://bugzilla.mozilla.org/show_bug.cgi?id=420644>`__: Improve SSL tracing of
|
||||
key derivation
|
||||
- `Bug 426886 <https://bugzilla.mozilla.org/show_bug.cgi?id=426886>`__: Use const char\* in
|
||||
PK11_ImportCertForKey
|
||||
- `Bug 428103 <https://bugzilla.mozilla.org/show_bug.cgi?id=428103>`__: CERT_EncodeSubjectKeyID
|
||||
is not defined in any public header file
|
||||
- `Bug 429716 <https://bugzilla.mozilla.org/show_bug.cgi?id=429716>`__: debug builds of libPKIX
|
||||
unconditionally dump socket traffic to stdout
|
||||
- `Bug 430368 <https://bugzilla.mozilla.org/show_bug.cgi?id=430368>`__: vfychain -t option is
|
||||
undocumented
|
||||
- `Bug 430369 <https://bugzilla.mozilla.org/show_bug.cgi?id=430369>`__: vfychain -o succeeds
|
||||
even if -pp is not specified
|
||||
- `Bug 430399 <https://bugzilla.mozilla.org/show_bug.cgi?id=430399>`__: vfychain -pp crashes
|
||||
- `Bug 430405 <https://bugzilla.mozilla.org/show_bug.cgi?id=430405>`__: Error log is not
|
||||
produced by CERT_PKIXVerifyCert
|
||||
- `Bug 430743 <https://bugzilla.mozilla.org/show_bug.cgi?id=430743>`__: Update ssltap to
|
||||
understand the TLS session ticket extension
|
||||
- `Bug 430859 <https://bugzilla.mozilla.org/show_bug.cgi?id=430859>`__: PKIX: Policy mapping
|
||||
fails verification with error invalid arguments
|
||||
- `Bug 430875 <https://bugzilla.mozilla.org/show_bug.cgi?id=430875>`__: Document the policy for
|
||||
the order of cipher suites in SSL_ImplementedCiphers.
|
||||
- `Bug 430916 <https://bugzilla.mozilla.org/show_bug.cgi?id=430916>`__: add sustaining asserts
|
||||
- `Bug 431805 <https://bugzilla.mozilla.org/show_bug.cgi?id=431805>`__: leak in
|
||||
NSSArena_Destroy()
|
||||
- `Bug 431929 <https://bugzilla.mozilla.org/show_bug.cgi?id=431929>`__: Memory leaks on error
|
||||
paths in devutil.c
|
||||
- `Bug 432303 <https://bugzilla.mozilla.org/show_bug.cgi?id=432303>`__: Replace PKIX_PL_Memcpy
|
||||
with memcpy
|
||||
- `Bug 433177 <https://bugzilla.mozilla.org/show_bug.cgi?id=433177>`__: Fix the GCC compiler
|
||||
warnings in lib/util and lib/freebl
|
||||
- `Bug 433437 <https://bugzilla.mozilla.org/show_bug.cgi?id=433437>`__: vfychain ignores the -a
|
||||
option
|
||||
- `Bug 433594 <https://bugzilla.mozilla.org/show_bug.cgi?id=433594>`__: Crash destroying OCSP
|
||||
Cert ID [[@ CERT_DestroyOCSPCertID ]
|
||||
- `Bug 434099 <https://bugzilla.mozilla.org/show_bug.cgi?id=434099>`__: NSS relies on unchecked
|
||||
PKCS#11 object attribute values
|
||||
- `Bug 434187 <https://bugzilla.mozilla.org/show_bug.cgi?id=434187>`__: Fix the GCC compiler
|
||||
warnings in nss/lib
|
||||
- `Bug 434398 <https://bugzilla.mozilla.org/show_bug.cgi?id=434398>`__: libPKIX cannot find
|
||||
issuer cert immediately after checking it with OCSP
|
||||
- `Bug 434808 <https://bugzilla.mozilla.org/show_bug.cgi?id=434808>`__: certutil -B deadlock
|
||||
when importing two or more roots
|
||||
- `Bug 434860 <https://bugzilla.mozilla.org/show_bug.cgi?id=434860>`__: Coverity 1150 - dead
|
||||
code in ocsp_CreateCertID
|
||||
- `Bug 436428 <https://bugzilla.mozilla.org/show_bug.cgi?id=436428>`__: remove unneeded assert
|
||||
from sec_PKCS7EncryptLength
|
||||
- `Bug 436430 <https://bugzilla.mozilla.org/show_bug.cgi?id=436430>`__: Make NSS public headers
|
||||
compilable with NO_NSPR_10_SUPPORT defined
|
||||
- `Bug 436577 <https://bugzilla.mozilla.org/show_bug.cgi?id=436577>`__: uninitialized variable
|
||||
in sec_pkcs5CreateAlgorithmID
|
||||
- `Bug 438685 <https://bugzilla.mozilla.org/show_bug.cgi?id=438685>`__: libpkix doesn't try all
|
||||
the issuers in a bridge with multiple certs
|
||||
- `Bug 438876 <https://bugzilla.mozilla.org/show_bug.cgi?id=438876>`__: signtool is still using
|
||||
static libraries.
|
||||
- `Bug 439123 <https://bugzilla.mozilla.org/show_bug.cgi?id=439123>`__: Assertion failure in
|
||||
libpkix at shutdown
|
||||
- `Bug 440062 <https://bugzilla.mozilla.org/show_bug.cgi?id=440062>`__: incorrect list element
|
||||
count in PKIX_List_AppendItem function
|
||||
- `Bug 442618 <https://bugzilla.mozilla.org/show_bug.cgi?id=442618>`__: Eliminate dead function
|
||||
CERT_CertPackageType
|
||||
- `Bug 443755 <https://bugzilla.mozilla.org/show_bug.cgi?id=443755>`__: Extra semicolon in
|
||||
PKM_TLSKeyAndMacDerive makes conditional code unconditional
|
||||
- `Bug 443760 <https://bugzilla.mozilla.org/show_bug.cgi?id=443760>`__: Extra semicolon in
|
||||
SeqDatabase makes static analysis tool suspicious
|
||||
- `Bug 448323 <https://bugzilla.mozilla.org/show_bug.cgi?id=448323>`__: certutil -K doesn't
|
||||
report the token and slot names for found keys
|
||||
- `Bug 448324 <https://bugzilla.mozilla.org/show_bug.cgi?id=448324>`__: ocsp checker returns
|
||||
incorrect error code on request with invalid signing cert
|
||||
- `Bug 449146 <https://bugzilla.mozilla.org/show_bug.cgi?id=449146>`__: Remove dead libsec
|
||||
function declarations
|
||||
- `Bug 453227 <https://bugzilla.mozilla.org/show_bug.cgi?id=453227>`__: installation of
|
||||
PEM-encoded certificate without trailing newline fails
|
||||
|
||||
--------------
|
||||
|
||||
`Documentation <#documentation>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
For a list of the primary NSS documentation pages on mozilla.org, see `NSS
|
||||
Documentation <../index.html#Documentation>`__. New and revised documents available since the
|
||||
release of NSS 3.11 include the following:
|
||||
|
||||
- `Build Instructions for NSS 3.11.4 and above <../nss-3.11.4/nss-3.11.4-build.html>`__
|
||||
- `NSS Shared DB <http://wiki.mozilla.org/NSS_Shared_DB>`__
|
||||
|
||||
--------------
|
||||
|
||||
`Compatibility <#compatibility>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
NSS 3.12.1 shared libraries are backward compatible with all older NSS 3.x shared libraries. A
|
||||
program linked with older NSS 3.x shared libraries will work with NSS 3.12.1 shared libraries
|
||||
without recompiling or relinking. Furthermore, applications that restrict their use of NSS APIs
|
||||
to the functions listed in `NSS Public Functions <../ref/nssfunctions.html>`__ will remain
|
||||
compatible with future versions of the NSS shared libraries.
|
||||
|
||||
--------------
|
||||
|
||||
`Feedback <#feedback>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
Bugs discovered should be reported by filing a bug report with `mozilla.org
|
||||
Bugzilla <https://bugzilla.mozilla.org/>`__ (product NSS).
|
||||
|
|
@ -1,217 +0,0 @@
|
|||
.. _mozilla_projects_nss_nss_3_12_2_release_notes_html:
|
||||
|
||||
NSS_3.12.2_release_notes.html
|
||||
=============================
|
||||
|
||||
.. _nss_3.12.2_release_notes:
|
||||
|
||||
`NSS 3.12.2 Release Notes <#nss_3.12.2_release_notes>`__
|
||||
--------------------------------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
.. _2008-10-20:
|
||||
|
||||
`2008-10-20 <#2008-10-20>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
Newsgroup: `mozilla.dev.tech.crypto <news://news.mozilla.org/mozilla.dev.tech.crypto>`__
|
||||
|
||||
`Contents <#contents>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
- `Introduction <#introduction>`__
|
||||
- `Distribution Information <#distribution_information>`__
|
||||
- `New in NSS 3.12.2 <#new_in_nss_3.12.2>`__
|
||||
- `Bugs Fixed <#bugs_fixed>`__
|
||||
- `Documentation <#documentation>`__
|
||||
- `Compatibility <#compatibility>`__
|
||||
- `Feedback <#feedback>`__
|
||||
|
||||
--------------
|
||||
|
||||
`Introduction <#introduction>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
Network Security Services (NSS) 3.12.2 is a patch release for NSS 3.12. The bug fixes in NSS
|
||||
3.12.2 are described in the "`Bugs Fixed <#bugs_fixed>`__" section below.
|
||||
NSS 3.12.2 is tri-licensed under the MPL 1.1/GPL 2.0/LGPL 2.1.
|
||||
|
||||
--------------
|
||||
|
||||
.. _distribution_information:
|
||||
|
||||
`Distribution Information <#distribution_information>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
The CVS tag for the NSS 3.12.2 release is NSS_3_12_2_RTM. NSS 3.12.2 requires `NSPR
|
||||
4.7.1 <https://www.mozilla.org/projects/nspr/release-notes/nspr471.html>`__.
|
||||
See the `Documentation <#documentation>`__ section for the build instructions.
|
||||
NSS 3.12.2 source and binary distributions are also available on ftp.mozilla.org for secure HTTPS
|
||||
download:
|
||||
|
||||
- Source tarballs:
|
||||
https://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_12_2_RTM/src/.
|
||||
- Binary distributions:
|
||||
https://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_12_2_RTM/. Both debug and
|
||||
optimized builds are provided. Go to the subdirectory for your platform, DBG (debug) or OPT
|
||||
(optimized), to get the tar.gz or zip file. The tar.gz or zip file expands to an nss-3.12.2
|
||||
directory containing three subdirectories:
|
||||
|
||||
- include - NSS header files
|
||||
- lib - NSS shared libraries
|
||||
- bin< - `NSS Tools <https://www.mozilla.org/projects/security/pki/nss/tools/>`__ and test
|
||||
programs
|
||||
|
||||
You also need to download the NSPR 4.7.1 binary distributions to get the NSPR 4.7.1 header files
|
||||
and shared libraries, which NSS 3.12.2 requires. NSPR 4.7.1 binary distributions are in
|
||||
https://ftp.mozilla.org/pub/mozilla.org/nspr/releases/v4.7.1/.
|
||||
|
||||
--------------
|
||||
|
||||
.. _new_in_nss_3.12.2:
|
||||
|
||||
`New in NSS 3.12.2 <#new_in_nss_3.12.2>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
- New functions in the nss shared library:
|
||||
|
||||
- SEC_PKCS12AddCertOrChainAndKey (see p12.h)
|
||||
|
||||
- New PKCS11 errors (see secerr.h)
|
||||
|
||||
- SEC_ERROR_PKCS11_GENERAL_ERROR
|
||||
- SEC_ERROR_PKCS11_FUNCTION_FAILED
|
||||
- SEC_ERROR_PKCS11_DEVICE_ERROR
|
||||
|
||||
--------------
|
||||
|
||||
.. _bugs_fixed:
|
||||
|
||||
`Bugs Fixed <#bugs_fixed>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
The following bugs have been fixed in NSS 3.12.2.
|
||||
|
||||
- `Bug 200704 <https://bugzilla.mozilla.org/show_bug.cgi?id=200704>`__: PKCS11: invalid session
|
||||
handle 0
|
||||
- `Bug 205434 <https://bugzilla.mozilla.org/show_bug.cgi?id=205434>`__: Fully implement new
|
||||
libPKIX cert verification API from bug 294531
|
||||
- `Bug 302670 <https://bugzilla.mozilla.org/show_bug.cgi?id=302670>`__: Use the installed
|
||||
libz.so where available
|
||||
- `Bug 305693 <https://bugzilla.mozilla.org/show_bug.cgi?id=305693>`__: shlibsign generates PQG
|
||||
for every run
|
||||
- `Bug 311483 <https://bugzilla.mozilla.org/show_bug.cgi?id=311483>`__: exposing
|
||||
includeCertChain as a parameter to SEC_PKCS12AddCertAndKey
|
||||
- `Bug 390527 <https://bugzilla.mozilla.org/show_bug.cgi?id=390527>`__: get rid of pkixErrorMsg
|
||||
variable in PKIX_Error
|
||||
- `Bug 391560 <https://bugzilla.mozilla.org/show_bug.cgi?id=391560>`__: libpkix does not
|
||||
consistently return PKIX_ValidateNode tree that truly represent failure reasons
|
||||
- `Bug 408260 <https://bugzilla.mozilla.org/show_bug.cgi?id=408260>`__: certutil usage doesn't
|
||||
give enough information about trust arguments
|
||||
- `Bug 412311 <https://bugzilla.mozilla.org/show_bug.cgi?id=412311>`__: Replace
|
||||
PR_INTERVAL_NO_WAIT with PR_INTERVAL_NO_TIMEOUT in client initialization calls
|
||||
- `Bug 423839 <https://bugzilla.mozilla.org/show_bug.cgi?id=423839>`__: Add multiple PKCS#11
|
||||
token password command line option to NSS tools.
|
||||
- `Bug 432260 <https://bugzilla.mozilla.org/show_bug.cgi?id=432260>`__: [[@
|
||||
pkix_pl_HttpDefaultClient_HdrCheckComplete - PKIX_PL_Memcpy] crashes when there is no
|
||||
content-length header in the http response
|
||||
- `Bug 436599 <https://bugzilla.mozilla.org/show_bug.cgi?id=436599>`__: PKIX: AIA extension is
|
||||
not used in some Bridge CA / known certs configuration
|
||||
- `Bug 437804 <https://bugzilla.mozilla.org/show_bug.cgi?id=437804>`__: certutil -R for cert
|
||||
renewal should derive the subject from the cert if none is specified.
|
||||
- `Bug 444974 <https://bugzilla.mozilla.org/show_bug.cgi?id=444974>`__: Crash upon reinsertion
|
||||
of E-Identity smartcard
|
||||
- `Bug 447563 <https://bugzilla.mozilla.org/show_bug.cgi?id=447563>`__: modutil -add prints no
|
||||
error explanation on failure
|
||||
- `Bug 448431 <https://bugzilla.mozilla.org/show_bug.cgi?id=448431>`__: PK11_CreateMergeLog()
|
||||
declaration causes gcc warning when compiling with -Wstrict-prototypes
|
||||
- `Bug 449334 <https://bugzilla.mozilla.org/show_bug.cgi?id=449334>`__: pk12util has duplicate
|
||||
options letters
|
||||
- `Bug 449725 <https://bugzilla.mozilla.org/show_bug.cgi?id=449725>`__: signver is still using
|
||||
static libraries.
|
||||
- `Bug 450427 <https://bugzilla.mozilla.org/show_bug.cgi?id=450427>`__: Add COMODO ECC
|
||||
Certification Authority certificate to NSS
|
||||
- `Bug 450536 <https://bugzilla.mozilla.org/show_bug.cgi?id=450536>`__: Remove obsolete XP_MAC
|
||||
code
|
||||
- `Bug 451024 <https://bugzilla.mozilla.org/show_bug.cgi?id=451024>`__: certutil.exe crashes
|
||||
with Segmentation fault inside PR_Cleanup
|
||||
- `Bug 451927 <https://bugzilla.mozilla.org/show_bug.cgi?id=451927>`__:
|
||||
security/coreconf/WINNT6.0.mk has invalid defines
|
||||
- `Bug 452751 <https://bugzilla.mozilla.org/show_bug.cgi?id=452751>`__: Slot leak in
|
||||
PK11_FindSlotsByNames
|
||||
- `Bug 452865 <https://bugzilla.mozilla.org/show_bug.cgi?id=452865>`__: Remove obsolete linker
|
||||
flags needed when libnss3 was linked with libsoftokn3
|
||||
- `Bug 454961 <https://bugzilla.mozilla.org/show_bug.cgi?id=454961>`__: Fix the implementation
|
||||
and use of pr_fgets in signtool
|
||||
- `Bug 455348 <https://bugzilla.mozilla.org/show_bug.cgi?id=455348>`__: Change hyphens to
|
||||
underscores in DEBUG_$(shell whoami).
|
||||
- `Bug 455424 <https://bugzilla.mozilla.org/show_bug.cgi?id=455424>`__: nssilckt.h defines the
|
||||
enumeration constant 'Lock'
|
||||
- `Bug 456036 <https://bugzilla.mozilla.org/show_bug.cgi?id=456036>`__: Stubs for deprecated
|
||||
functions in lib/certdb/stanpcertdb.c should set the PR_NOT_IMPLEMENTED_ERROR error.
|
||||
- `Bug 456854 <https://bugzilla.mozilla.org/show_bug.cgi?id=456854>`__: CERT_DecodeCertPackage
|
||||
does not set NSPR error code upon error
|
||||
- `Bug 457980 <https://bugzilla.mozilla.org/show_bug.cgi?id=457980>`__: hundreds of kilobytes of
|
||||
useless strings in libPKIX
|
||||
- `Bug 457984 <https://bugzilla.mozilla.org/show_bug.cgi?id=457984>`__: Enable PKCS11 module
|
||||
logging in optimized builds
|
||||
- `Bug 458905 <https://bugzilla.mozilla.org/show_bug.cgi?id=458905>`__: Memory leaks in PKIX
|
||||
bridge certificates.
|
||||
- `Bug 459231 <https://bugzilla.mozilla.org/show_bug.cgi?id=459231>`__: Memory leak in cert
|
||||
fetching - AIA extension.
|
||||
- `Bug 459248 <https://bugzilla.mozilla.org/show_bug.cgi?id=459248>`__: Support Intel AES
|
||||
extensions.
|
||||
- `Bug 459359 <https://bugzilla.mozilla.org/show_bug.cgi?id=459359>`__: ForwardBuilderState
|
||||
object is leaked when AIA path incorrect
|
||||
- `Bug 459481 <https://bugzilla.mozilla.org/show_bug.cgi?id=459481>`__: NSS build problem with
|
||||
GCC 3.4.6 on OS/2
|
||||
|
||||
--------------
|
||||
|
||||
`Documentation <#documentation>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
For a list of the primary NSS documentation pages on mozilla.org, see `NSS
|
||||
Documentation <../index.html#Documentation>`__. New and revised documents available since the
|
||||
release of NSS 3.11 include the following:
|
||||
|
||||
- `Build Instructions for NSS 3.11.4 and above <../nss-3.11.4/nss-3.11.4-build.html>`__
|
||||
- `NSS Shared DB <http://wiki.mozilla.org/NSS_Shared_DB>`__
|
||||
|
||||
--------------
|
||||
|
||||
`Compatibility <#compatibility>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
NSS 3.12.2 shared libraries are backward compatible with all older NSS 3.x shared libraries. A
|
||||
program linked with older NSS 3.x shared libraries will work with NSS 3.12.2 shared libraries
|
||||
without recompiling or relinking. Furthermore, applications that restrict their use of NSS APIs
|
||||
to the functions listed in `NSS Public Functions <../ref/nssfunctions.html>`__ will remain
|
||||
compatible with future versions of the NSS shared libraries.
|
||||
|
||||
--------------
|
||||
|
||||
`Feedback <#feedback>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
Bugs discovered should be reported by filing a bug report with `mozilla.org
|
||||
Bugzilla <https://bugzilla.mozilla.org/>`__ (product NSS).
|
||||
|
|
@ -1,919 +0,0 @@
|
|||
.. _mozilla_projects_nss_nss_3_12_release_notes_html:
|
||||
|
||||
NSS_3.12_release_notes.html
|
||||
===========================
|
||||
|
||||
.. _nss_3.12_release_notes:
|
||||
|
||||
`NSS 3.12 Release Notes <#nss_3.12_release_notes>`__
|
||||
----------------------------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
.. _17_june_2008:
|
||||
|
||||
`17 June 2008 <#17_june_2008>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
Newsgroup: `mozilla.dev.tech.crypto <news://news.mozilla.org/mozilla.dev.tech.crypto>`__
|
||||
|
||||
`Contents <#contents>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
- `Introduction <#introduction>`__
|
||||
- `Distribution Information <#distribution_information>`__
|
||||
- `New in NSS 3.12 <#new_in_nss_3.12>`__
|
||||
- `Bugs Fixed <#bugs_fixed>`__
|
||||
- `Documentation <#documentation>`__
|
||||
- `Compatibility <#compatibility>`__
|
||||
- `Feedback <#feedback>`__
|
||||
|
||||
--------------
|
||||
|
||||
`Introduction <#introduction>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
Network Security Services (NSS) 3.12 is a minor release with the following new features:
|
||||
|
||||
- SQLite-Based Shareable Certificate and Key Databases
|
||||
- libpkix: an RFC 3280 Compliant Certificate Path Validation Library
|
||||
- Camellia cipher support
|
||||
- TLS session ticket extension (RFC 5077)
|
||||
|
||||
NSS 3.12 is tri-licensed under the MPL 1.1/GPL 2.0/LGPL 2.1.
|
||||
Note: Firefox 3 uses NSS 3.12, but not the new SQLite-based shareable certificate and key
|
||||
databases. We missed the deadline to enable that feature in Firefox 3.
|
||||
|
||||
--------------
|
||||
|
||||
.. _distribution_information:
|
||||
|
||||
`Distribution Information <#distribution_information>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
The CVS tag for the NSS 3.12 release is NSS_3_12_RTM. NSS 3.12 requires `NSPR
|
||||
4.7.1 <https://www.mozilla.org/projects/nspr/release-notes/nspr471.html>`__.
|
||||
See the `Documentation <#docs>`__ section for the build instructions.
|
||||
NSS 3.12 source and binary distributions are also available on ftp.mozilla.org for secure HTTPS
|
||||
download:
|
||||
|
||||
- Source tarballs:
|
||||
https://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_12_RTM/src/.
|
||||
- Binary distributions:
|
||||
https://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_12_RTM/. Both debug and
|
||||
optimized builds are provided. Go to the subdirectory for your platform, DBG (debug) or OPT
|
||||
(optimized), to get the tar.gz or zip file. The tar.gz or zip file expands to an nss-3.12
|
||||
directory containing three subdirectories:
|
||||
|
||||
- include - NSS header files
|
||||
- lib - NSS shared libraries
|
||||
- bin - `NSS Tools <https://www.mozilla.org/projects/security/pki/nss/tools/>`__ and test
|
||||
programs
|
||||
|
||||
You also need to download the NSPR 4.7.1 binary distributions to get the NSPR 4.7.1 header files
|
||||
and shared libraries, which NSS 3.12 requires. NSPR 4.7.1 binary distributions are in
|
||||
https://ftp.mozilla.org/pub/mozilla.org/nspr/releases/v4.7.1/.
|
||||
NSS 3.12 libraries have the following versions:
|
||||
|
||||
- sqlite3: 3.3.17
|
||||
- nssckbi: 1.70
|
||||
- softokn3 and freebl3: 3.12.0.3
|
||||
- other NSS libraries: 3.12.0.3
|
||||
|
||||
--------------
|
||||
|
||||
.. _new_in_nss_3.12:
|
||||
|
||||
`New in NSS 3.12 <#new_in_nss_3.12>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
- 3 new shared library are shipped with NSS 3.12:
|
||||
|
||||
- nssutil
|
||||
- sqlite
|
||||
- nssdbm
|
||||
|
||||
- 1 new include file is shipped with NSS3.12:
|
||||
|
||||
- utilrename.h
|
||||
|
||||
- New functions in the nss shared library:
|
||||
|
||||
- CERT_CheckNameSpace (see cert.h)
|
||||
- CERT_EncodeCertPoliciesExtension (see cert.h)
|
||||
- CERT_EncodeInfoAccessExtension (see cert.h)
|
||||
- CERT_EncodeInhibitAnyExtension (see cert.h)
|
||||
- CERT_EncodeNoticeReference (see cert.h)
|
||||
- CERT_EncodePolicyConstraintsExtension (see cert.h)
|
||||
- CERT_EncodePolicyMappingExtension (see cert.h)
|
||||
- CERT_EncodeSubjectKeyID (see certdb/cert.h)
|
||||
- CERT_EncodeUserNotice (see cert.h)
|
||||
- CERT_FindCRLEntryReasonExten (see cert.h)
|
||||
- CERT_FindCRLNumberExten (see cert.h)
|
||||
- CERT_FindNameConstraintsExten (see cert.h)
|
||||
- CERT_GetClassicOCSPDisabledPolicy (see cert.h)
|
||||
- CERT_GetClassicOCSPEnabledHardFailurePolicy (see cert.h)
|
||||
- CERT_GetClassicOCSPEnabledSoftFailurePolicy (see cert.h)
|
||||
- CERT_GetPKIXVerifyNistRevocationPolicy (see cert.h)
|
||||
- CERT_GetUsePKIXForValidation (see cert.h)
|
||||
- CERT_GetValidDNSPatternsFromCert (see cert.h)
|
||||
- CERT_NewTempCertificate (see cert.h)
|
||||
- CERT_SetOCSPTimeout (see certhigh/ocsp.h)
|
||||
- CERT_SetUsePKIXForValidation (see cert.h)
|
||||
- CERT_PKIXVerifyCert (see cert.h)
|
||||
- HASH_GetType (see sechash.h)
|
||||
- NSS_InitWithMerge (see nss.h)
|
||||
- PK11_CreateMergeLog (see pk11pub.h)
|
||||
- PK11_CreateGenericObject (see pk11pub.h)
|
||||
- PK11_CreatePBEV2AlgorithmID (see pk11pub.h)
|
||||
- PK11_DestroyMergeLog (see pk11pub.h)
|
||||
- PK11_GenerateKeyPairWithOpFlags (see pk11pub.h)
|
||||
- PK11_GetPBECryptoMechanism (see pk11pub.h)
|
||||
- PK11_IsRemovable (see pk11pub.h)
|
||||
- PK11_MergeTokens (see pk11pub.h)
|
||||
- PK11_WriteRawAttribute (see pk11pub.h)
|
||||
- SECKEY_ECParamsToBasePointOrderLen (see keyhi.h)
|
||||
- SECKEY_ECParamsToKeySize (see keyhi.h)
|
||||
- SECMOD_DeleteModuleEx (see secmod.h)
|
||||
- SEC_GetRegisteredHttpClient (see ocsp.h)
|
||||
- SEC_PKCS5IsAlgorithmPBEAlgTag (see secpkcs5.h)
|
||||
- VFY_CreateContextDirect (see cryptohi.h)
|
||||
- VFY_CreateContextWithAlgorithmID (see cryptohi.h)
|
||||
- VFY_VerifyDataDirect (see cryptohi.h)
|
||||
- VFY_VerifyDataWithAlgorithmID (see cryptohi.h)
|
||||
- VFY_VerifyDigestDirect (see cryptohi.h)
|
||||
- VFY_VerifyDigestWithAlgorithmID (see cryptohi.h)
|
||||
|
||||
- New macros for Camellia support (see blapit.h):
|
||||
|
||||
- NSS_CAMELLIA
|
||||
- NSS_CAMELLIA_CBC
|
||||
- CAMELLIA_BLOCK_SIZE
|
||||
|
||||
- New macros for RSA (see blapit.h):
|
||||
|
||||
- RSA_MAX_MODULUS_BITS
|
||||
- RSA_MAX_EXPONENT_BITS
|
||||
|
||||
- New macros in certt.h:
|
||||
|
||||
- X.509 v3
|
||||
|
||||
- KU_ENCIPHER_ONLY
|
||||
- CERT_MAX_SERIAL_NUMBER_BYTES
|
||||
- CERT_MAX_DN_BYTES
|
||||
|
||||
- PKIX
|
||||
|
||||
- CERT_REV_M_DO_NOT_TEST_USING_THIS_METHOD
|
||||
- CERT_REV_M_TEST_USING_THIS_METHOD
|
||||
- CERT_REV_M_ALLOW_NETWORK_FETCHING
|
||||
- CERT_REV_M_FORBID_NETWORK_FETCHING
|
||||
- CERT_REV_M_ALLOW_IMPLICIT_DEFAULT_SOURCE
|
||||
- CERT_REV_M_IGNORE_IMPLICIT_DEFAULT_SOURCE
|
||||
- CERT_REV_M_SKIP_TEST_ON_MISSING_SOURCE
|
||||
- CERT_REV_M_REQUIRE_INFO_ON_MISSING_SOURCE
|
||||
- CERT_REV_M_IGNORE_MISSING_FRESH_INFO
|
||||
- CERT_REV_M_FAIL_ON_MISSING_FRESH_INFO
|
||||
- CERT_REV_M_STOP_TESTING_ON_FRESH_INFO
|
||||
- CERT_REV_M_CONTINUE_TESTING_ON_FRESH_INFO
|
||||
- CERT_REV_MI_TEST_EACH_METHOD_SEPARATELY
|
||||
- CERT_REV_MI_TEST_ALL_LOCAL_INFORMATION_FIRST
|
||||
- CERT_REV_MI_NO_OVERALL_INFO_REQUIREMENT
|
||||
- CERT_REV_MI_REQUIRE_SOME_FRESH_INFO_AVAILABLE
|
||||
- CERT_POLICY_FLAG_NO_MAPPING
|
||||
- CERT_POLICY_FLAG_EXPLICIT
|
||||
- CERT_POLICY_FLAG_NO_ANY
|
||||
- CERT_ENABLE_LDAP_FETCH
|
||||
- CERT_ENABLE_HTTP_FETCH
|
||||
|
||||
- New macro in utilrename.h:
|
||||
|
||||
- SMIME_AES_CBC_128
|
||||
|
||||
- The nssckbi PKCS #11 module's version changed to 1.70.
|
||||
- In pkcs11n.h, all the \_NETSCAPE\_ macros are renamed with \_NSS\_
|
||||
|
||||
- For example, CKO_NETSCAPE_CRL becomes CKO_NSS_CRL.
|
||||
|
||||
- New for PKCS #11 (see pkcs11t.h for details):
|
||||
|
||||
- CKK: Keys
|
||||
|
||||
- CKK_CAMELLIA
|
||||
|
||||
- CKM: Mechanisms
|
||||
|
||||
- CKM_SHA224_RSA_PKCS
|
||||
- CKM_SHA224_RSA_PKCS_PSS
|
||||
- CKM_SHA224
|
||||
- CKM_SHA224_HMAC
|
||||
- CKM_SHA224_HMAC_GENERAL
|
||||
- CKM_SHA224_KEY_DERIVATION
|
||||
- CKM_CAMELLIA_KEY_GEN
|
||||
- CKM_CAMELLIA_ECB
|
||||
- CKM_CAMELLIA_CBC
|
||||
- CKM_CAMELLIA_MAC
|
||||
- CKM_CAMELLIA_MAC_GENERAL
|
||||
- CKM_CAMELLIA_CBC_PAD
|
||||
- CKM_CAMELLIA_ECB_ENCRYPT_DATA
|
||||
- CKM_CAMELLIA_CBC_ENCRYPT_DATA
|
||||
|
||||
- CKG: MFGs
|
||||
|
||||
- CKG_MGF1_SHA224
|
||||
|
||||
- New error codes (see secerr.h):
|
||||
|
||||
- SEC_ERROR_NOT_INITIALIZED
|
||||
- SEC_ERROR_TOKEN_NOT_LOGGED_IN
|
||||
- SEC_ERROR_OCSP_RESPONDER_CERT_INVALID
|
||||
- SEC_ERROR_OCSP_BAD_SIGNATURE
|
||||
- SEC_ERROR_OUT_OF_SEARCH_LIMITS
|
||||
- SEC_ERROR_INVALID_POLICY_MAPPING
|
||||
- SEC_ERROR_POLICY_VALIDATION_FAILED
|
||||
- SEC_ERROR_UNKNOWN_AIA_LOCATION_TYPE
|
||||
- SEC_ERROR_BAD_HTTP_RESPONSE
|
||||
- SEC_ERROR_BAD_LDAP_RESPONSE
|
||||
- SEC_ERROR_FAILED_TO_ENCODE_DATA
|
||||
- SEC_ERROR_BAD_INFO_ACCESS_LOCATION
|
||||
- SEC_ERROR_LIBPKIX_INTERNAL
|
||||
|
||||
- New mechanism flags (see secmod.h)
|
||||
|
||||
- PUBLIC_MECH_AES_FLAG
|
||||
- PUBLIC_MECH_SHA256_FLAG
|
||||
- PUBLIC_MECH_SHA512_FLAG
|
||||
- PUBLIC_MECH_CAMELLIA_FLAG
|
||||
|
||||
- New OIDs (see secoidt.h)
|
||||
|
||||
- new EC Signature oids
|
||||
|
||||
- SEC_OID_ANSIX962_ECDSA_SIGNATURE_RECOMMENDED_DIGEST
|
||||
- SEC_OID_ANSIX962_ECDSA_SIGNATURE_SPECIFIED_DIGEST
|
||||
- SEC_OID_ANSIX962_ECDSA_SHA224_SIGNATURE
|
||||
- SEC_OID_ANSIX962_ECDSA_SHA256_SIGNATURE
|
||||
- SEC_OID_ANSIX962_ECDSA_SHA384_SIGNATURE
|
||||
- SEC_OID_ANSIX962_ECDSA_SHA512_SIGNATURE
|
||||
|
||||
- More id-ce and id-pe OIDs from RFC 3280
|
||||
|
||||
- SEC_OID_X509_HOLD_INSTRUCTION_CODE
|
||||
- SEC_OID_X509_DELTA_CRL_INDICATOR
|
||||
- SEC_OID_X509_ISSUING_DISTRIBUTION_POINT
|
||||
- SEC_OID_X509_CERT_ISSUER
|
||||
- SEC_OID_X509_FRESHEST_CRL
|
||||
- SEC_OID_X509_INHIBIT_ANY_POLICY
|
||||
- SEC_OID_X509_SUBJECT_INFO_ACCESS
|
||||
|
||||
- Camellia OIDs (RFC3657)
|
||||
|
||||
- SEC_OID_CAMELLIA_128_CBC
|
||||
- SEC_OID_CAMELLIA_192_CBC
|
||||
- SEC_OID_CAMELLIA_256_CBC
|
||||
|
||||
- PKCS 5 V2 OIDS
|
||||
|
||||
- SEC_OID_PKCS5_PBKDF2
|
||||
- SEC_OID_PKCS5_PBES2
|
||||
- SEC_OID_PKCS5_PBMAC1
|
||||
- SEC_OID_HMAC_SHA1
|
||||
- SEC_OID_HMAC_SHA224
|
||||
- SEC_OID_HMAC_SHA256
|
||||
- SEC_OID_HMAC_SHA384
|
||||
- SEC_OID_HMAC_SHA512
|
||||
- SEC_OID_PKIX_TIMESTAMPING
|
||||
- SEC_OID_PKIX_CA_REPOSITORY
|
||||
- SEC_OID_ISO_SHA1_WITH_RSA_SIGNATURE
|
||||
|
||||
- Changed OIDs (see secoidt.h)
|
||||
|
||||
- SEC_OID_PKCS12_KEY_USAGE changed to SEC_OID_BOGUS_KEY_USAGE
|
||||
- SEC_OID_ANSIX962_ECDSA_SIGNATURE_WITH_SHA1_DIGEST changed to
|
||||
SEC_OID_ANSIX962_ECDSA_SHA1_SIGNATURE
|
||||
- Note: SEC_OID_ANSIX962_ECDSA_SIGNATURE_WITH_SHA1_DIGEST is also kept for compatibility
|
||||
reasons.
|
||||
|
||||
- TLS Session ticket extension (off by default)
|
||||
|
||||
- See SSL_ENABLE_SESSION_TICKETS in ssl.h
|
||||
|
||||
- New SSL error codes (see sslerr.h)
|
||||
|
||||
- SSL_ERROR_UNSUPPORTED_EXTENSION_ALERT
|
||||
- SSL_ERROR_CERTIFICATE_UNOBTAINABLE_ALERT
|
||||
- SSL_ERROR_UNRECOGNIZED_NAME_ALERT
|
||||
- SSL_ERROR_BAD_CERT_STATUS_RESPONSE_ALERT
|
||||
- SSL_ERROR_BAD_CERT_HASH_VALUE_ALERT
|
||||
- SSL_ERROR_RX_UNEXPECTED_NEW_SESSION_TICKET
|
||||
- SSL_ERROR_RX_MALFORMED_NEW_SESSION_TICKET
|
||||
|
||||
- New TLS cipher suites (see sslproto.h):
|
||||
|
||||
- TLS_RSA_WITH_CAMELLIA_128_CBC_SHA
|
||||
- TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA
|
||||
- TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA
|
||||
- TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
|
||||
- TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA
|
||||
- TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA
|
||||
|
||||
- Note: the following TLS cipher suites are declared but are not yet implemented:
|
||||
|
||||
- TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA
|
||||
- TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA
|
||||
- TLS_DH_ANON_WITH_CAMELLIA_128_CBC_SHA
|
||||
- TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA
|
||||
- TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA
|
||||
- TLS_DH_ANON_WITH_CAMELLIA_256_CBC_SHA
|
||||
- TLS_ECDH_anon_WITH_NULL_SHA
|
||||
- TLS_ECDH_anon_WITH_RC4_128_SHA
|
||||
- TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA
|
||||
- TLS_ECDH_anon_WITH_AES_128_CBC_SHA
|
||||
- TLS_ECDH_anon_WITH_AES_256_CBC_SHA
|
||||
|
||||
--------------
|
||||
|
||||
.. _bugs_fixed:
|
||||
|
||||
`Bugs Fixed <#bugs_fixed>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
The following bugs have been fixed in NSS 3.12.
|
||||
|
||||
- `Bug 354403 <https://bugzilla.mozilla.org/show_bug.cgi?id=354403>`__: nssList_CreateIterator
|
||||
returns pointer to a freed memory if the function fails to allocate a lock
|
||||
- `Bug 399236 <https://bugzilla.mozilla.org/show_bug.cgi?id=399236>`__: pkix wrapper must print
|
||||
debug output into stderr
|
||||
- `Bug 399300 <https://bugzilla.mozilla.org/show_bug.cgi?id=399300>`__: PKIX error results not
|
||||
freed after use.
|
||||
- `Bug 414985 <https://bugzilla.mozilla.org/show_bug.cgi?id=414985>`__: Crash in
|
||||
pkix_pl_OcspRequest_Destroy
|
||||
- `Bug 421870 <https://bugzilla.mozilla.org/show_bug.cgi?id=421870>`__: Strsclnt crashed in PKIX
|
||||
tests.
|
||||
- `Bug 429388 <https://bugzilla.mozilla.org/show_bug.cgi?id=429388>`__: vfychain.main leaks
|
||||
memory
|
||||
- `Bug 396044 <https://bugzilla.mozilla.org/show_bug.cgi?id=396044>`__: Warning: usage of
|
||||
uninitialized variable in ckfw/object.c(174)
|
||||
- `Bug 396045 <https://bugzilla.mozilla.org/show_bug.cgi?id=396045>`__: Warning: usage of
|
||||
uninitialized variable in ckfw/mechanism.c(719)
|
||||
- `Bug 401986 <https://bugzilla.mozilla.org/show_bug.cgi?id=401986>`__: Mac OS X leopard build
|
||||
failure in legacydb
|
||||
- `Bug 325805 <https://bugzilla.mozilla.org/show_bug.cgi?id=325805>`__: diff considers
|
||||
mozilla/security/nss/cmd/pk11util/scripts/pkey a binary file
|
||||
- `Bug 385151 <https://bugzilla.mozilla.org/show_bug.cgi?id=385151>`__: Remove the link time
|
||||
dependency from NSS to Softoken
|
||||
- `Bug 387892 <https://bugzilla.mozilla.org/show_bug.cgi?id=387892>`__: Add Entrust root CA
|
||||
certificate(s) to NSS
|
||||
- `Bug 433386 <https://bugzilla.mozilla.org/show_bug.cgi?id=433386>`__: when system clock is off
|
||||
by more than two days, OSCP check fails, can result in crash if user tries to view certificate
|
||||
[[@ SECITEM_CompareItem_Util] [[@ memcmp]
|
||||
- `Bug 396256 <https://bugzilla.mozilla.org/show_bug.cgi?id=396256>`__: certutil and pp do not
|
||||
print all the GeneralNames in a CRLDP extension
|
||||
- `Bug 398019 <https://bugzilla.mozilla.org/show_bug.cgi?id=398019>`__: correct confusing and
|
||||
erroneous comments in DER_AsciiToTime
|
||||
- `Bug 422866 <https://bugzilla.mozilla.org/show_bug.cgi?id=422866>`__: vfychain -pp command
|
||||
crashes in NSS_shutdown
|
||||
- `Bug 345779 <https://bugzilla.mozilla.org/show_bug.cgi?id=345779>`__: Useless assignment
|
||||
statements in ec_GF2m_pt_mul_mont
|
||||
- `Bug 349011 <https://bugzilla.mozilla.org/show_bug.cgi?id=349011>`__: please stop exporting
|
||||
these crmf\_ symbols
|
||||
- `Bug 397178 <https://bugzilla.mozilla.org/show_bug.cgi?id=397178>`__: Crash when entering
|
||||
chrome://pippki/content/resetpassword.xul in URL bar
|
||||
- `Bug 403822 <https://bugzilla.mozilla.org/show_bug.cgi?id=403822>`__:
|
||||
pkix_pl_OcspRequest_Create can leave some members uninitialized
|
||||
- `Bug 403910 <https://bugzilla.mozilla.org/show_bug.cgi?id=403910>`__:
|
||||
CERT_FindUserCertByUsage() returns wrong certificate if multiple certs with same subject
|
||||
available
|
||||
- `Bug 404919 <https://bugzilla.mozilla.org/show_bug.cgi?id=404919>`__: memory leak in
|
||||
sftkdb_ReadSecmodDB() (sftkmod.c)
|
||||
- `Bug 406120 <https://bugzilla.mozilla.org/show_bug.cgi?id=406120>`__: Allow application to
|
||||
specify OCSP timeout
|
||||
- `Bug 361025 <https://bugzilla.mozilla.org/show_bug.cgi?id=361025>`__: Support for Camellia
|
||||
Cipher Suites to TLS RFC4132
|
||||
- `Bug 376417 <https://bugzilla.mozilla.org/show_bug.cgi?id=376417>`__: PK11_GenerateKeyPair
|
||||
needs to get the key usage from the caller.
|
||||
- `Bug 391291 <https://bugzilla.mozilla.org/show_bug.cgi?id=391291>`__: Shared Database
|
||||
Integrity checks not yet implemented.
|
||||
- `Bug 391292 <https://bugzilla.mozilla.org/show_bug.cgi?id=391292>`__: Shared Database
|
||||
implementation slow
|
||||
- `Bug 391294 <https://bugzilla.mozilla.org/show_bug.cgi?id=391294>`__: Shared Database
|
||||
implementation really slow on network file systems
|
||||
- `Bug 392521 <https://bugzilla.mozilla.org/show_bug.cgi?id=392521>`__: Automatic shared db
|
||||
update fails if user opens database R/W but never supplies a password
|
||||
- `Bug 392522 <https://bugzilla.mozilla.org/show_bug.cgi?id=392522>`__: Integrity hashes must be
|
||||
updated when passwords are changed.
|
||||
- `Bug 401610 <https://bugzilla.mozilla.org/show_bug.cgi?id=401610>`__: Shared DB fails on IOPR
|
||||
tests
|
||||
- `Bug 388120 <https://bugzilla.mozilla.org/show_bug.cgi?id=388120>`__: build error due to
|
||||
SEC_BEGIN_PROTOS / SEC_END_PROTOS are undefined
|
||||
- `Bug 415264 <https://bugzilla.mozilla.org/show_bug.cgi?id=415264>`__: Make Security use of new
|
||||
NSPR rotate macros
|
||||
- `Bug 317052 <https://bugzilla.mozilla.org/show_bug.cgi?id=317052>`__: lib/base/whatnspr.c is
|
||||
obsolete
|
||||
- `Bug 317323 <https://bugzilla.mozilla.org/show_bug.cgi?id=317323>`__: Set NSPR31_LIB_PREFIX to
|
||||
empty explicitly for WIN95 and WINCE builds
|
||||
- `Bug 320336 <https://bugzilla.mozilla.org/show_bug.cgi?id=320336>`__: SECITEM_AllocItem
|
||||
returns a non-NULL pointer if the allocation of its 'data' buffer fails
|
||||
- `Bug 327529 <https://bugzilla.mozilla.org/show_bug.cgi?id=327529>`__: Can't pass 0 as an
|
||||
unnamed null pointer argument to CERT_CreateRDN
|
||||
- `Bug 334683 <https://bugzilla.mozilla.org/show_bug.cgi?id=334683>`__: Extraneous semicolons
|
||||
cause Empty declaration compiler warnings
|
||||
- `Bug 335275 <https://bugzilla.mozilla.org/show_bug.cgi?id=335275>`__: Compile with the GCC
|
||||
flag -Werror-implicit-function-declaration
|
||||
- `Bug 354565 <https://bugzilla.mozilla.org/show_bug.cgi?id=354565>`__: fipstest sha_test needs
|
||||
to detect SHA tests that are incorrectly configured for BIT oriented implementations
|
||||
- `Bug 356595 <https://bugzilla.mozilla.org/show_bug.cgi?id=356595>`__: On Windows,
|
||||
RNG_SystemInfoForRNG calls GetCurrentProcess, which returns the constant (HANDLE)-1.
|
||||
- `Bug 357015 <https://bugzilla.mozilla.org/show_bug.cgi?id=357015>`__: On Windows,
|
||||
ReadSystemFiles reads 21 files as opposed to 10 files in C:\WINDOWS\system32.
|
||||
- `Bug 361076 <https://bugzilla.mozilla.org/show_bug.cgi?id=361076>`__: Clean up the
|
||||
USE_PTHREADS related code in coreconf/SunOS5.mk.
|
||||
- `Bug 361077 <https://bugzilla.mozilla.org/show_bug.cgi?id=361077>`__: Clean up the
|
||||
USE_PTHREADS related code in coreconf/HP-UX*.mk.
|
||||
- `Bug 402114 <https://bugzilla.mozilla.org/show_bug.cgi?id=402114>`__: Fix the incorrect
|
||||
function prototypes of SSL handshake callbacks
|
||||
- `Bug 402308 <https://bugzilla.mozilla.org/show_bug.cgi?id=402308>`__: Fix miscellaneous
|
||||
compiler warnings in nss/cmd
|
||||
- `Bug 402777 <https://bugzilla.mozilla.org/show_bug.cgi?id=402777>`__: lib/util can't be built
|
||||
stand-alone.
|
||||
- `Bug 407866 <https://bugzilla.mozilla.org/show_bug.cgi?id=407866>`__: Contributed improvement
|
||||
to security/nss/lib/freebl/mpi/mp_comba.c
|
||||
- `Bug 410587 <https://bugzilla.mozilla.org/show_bug.cgi?id=410587>`__: SSL_GetChannelInfo
|
||||
returns SECSuccess on invalid arguments
|
||||
- `Bug 416508 <https://bugzilla.mozilla.org/show_bug.cgi?id=416508>`__: Fix a \_MSC_VER typo in
|
||||
sha512.c, and use SEC_BEGIN_PROTOS/SEC_END_PROTOS in secport.h
|
||||
- `Bug 419242 <https://bugzilla.mozilla.org/show_bug.cgi?id=419242>`__: 'all' is not the default
|
||||
makefile target in lib/softoken and lib/softoken/legacydb
|
||||
- `Bug 419523 <https://bugzilla.mozilla.org/show_bug.cgi?id=419523>`__: Export
|
||||
Cert_NewTempCertificate.
|
||||
- `Bug 287061 <https://bugzilla.mozilla.org/show_bug.cgi?id=287061>`__: CRL number should be a
|
||||
big integer, not ulong
|
||||
- `Bug 301213 <https://bugzilla.mozilla.org/show_bug.cgi?id=301213>`__: Combine internal libpkix
|
||||
function tests into a single statically linked program
|
||||
- `Bug 324740 <https://bugzilla.mozilla.org/show_bug.cgi?id=324740>`__: add generation of SIA
|
||||
and AIA extensions to certutil
|
||||
- `Bug 339737 <https://bugzilla.mozilla.org/show_bug.cgi?id=339737>`__: LIBPKIX OCSP checking
|
||||
calls CERT_VerifyCert
|
||||
- `Bug 358785 <https://bugzilla.mozilla.org/show_bug.cgi?id=358785>`__: Merge NSS_LIBPKIX_BRANCH
|
||||
back to trunk
|
||||
- `Bug 365966 <https://bugzilla.mozilla.org/show_bug.cgi?id=365966>`__: infinite recursive call
|
||||
in VFY_VerifyDigestDirect
|
||||
- `Bug 382078 <https://bugzilla.mozilla.org/show_bug.cgi?id=382078>`__: pkix default http client
|
||||
returns error when try to get an ocsp response.
|
||||
- `Bug 384926 <https://bugzilla.mozilla.org/show_bug.cgi?id=384926>`__: libpkix build problems
|
||||
- `Bug 389411 <https://bugzilla.mozilla.org/show_bug.cgi?id=389411>`__: Mingw build error -
|
||||
undefined reference to \`_imp__PKIX_ERRORNAMES'
|
||||
- `Bug 389904 <https://bugzilla.mozilla.org/show_bug.cgi?id=389904>`__: avoid multiple
|
||||
decoding/encoding while creating and using PKIX_PL_X500Name
|
||||
- `Bug 390209 <https://bugzilla.mozilla.org/show_bug.cgi?id=390209>`__: pkix AIA manager tries
|
||||
to get certs using AIA url with OCSP access method
|
||||
- `Bug 390233 <https://bugzilla.mozilla.org/show_bug.cgi?id=390233>`__: umbrella bug for libPKIX
|
||||
cert validation failures discovered from running vfyserv
|
||||
- `Bug 390499 <https://bugzilla.mozilla.org/show_bug.cgi?id=390499>`__: libpkix does not check
|
||||
cached cert chain for revocation
|
||||
- `Bug 390502 <https://bugzilla.mozilla.org/show_bug.cgi?id=390502>`__: libpkix fails cert
|
||||
validation when no valid CRL (NIST validation policy is always enforced)
|
||||
- `Bug 390530 <https://bugzilla.mozilla.org/show_bug.cgi?id=390530>`__: libpkix does not support
|
||||
time override
|
||||
- `Bug 390536 <https://bugzilla.mozilla.org/show_bug.cgi?id=390536>`__: Cert validation
|
||||
functions must validate leaf cert themselves
|
||||
- `Bug 390554 <https://bugzilla.mozilla.org/show_bug.cgi?id=390554>`__: all PKIX_NULLCHECK\_
|
||||
errors are reported as PKIX ALLOC ERROR
|
||||
- `Bug 390888 <https://bugzilla.mozilla.org/show_bug.cgi?id=390888>`__: CERT_Verify\* functions
|
||||
should be able to use libPKIX
|
||||
- `Bug 391457 <https://bugzilla.mozilla.org/show_bug.cgi?id=391457>`__: libpkix does not check
|
||||
for object ref leak at shutdown
|
||||
- `Bug 391774 <https://bugzilla.mozilla.org/show_bug.cgi?id=391774>`__: PKIX_Shutdown is not
|
||||
called by nssinit.c
|
||||
- `Bug 393174 <https://bugzilla.mozilla.org/show_bug.cgi?id=393174>`__: Memory leaks in
|
||||
ocspclnt/PKIX.
|
||||
- `Bug 395093 <https://bugzilla.mozilla.org/show_bug.cgi?id=395093>`__:
|
||||
pkix_pl_HttpCertStore_ProcessCertResponse is unable to process certs in DER format
|
||||
- `Bug 395224 <https://bugzilla.mozilla.org/show_bug.cgi?id=395224>`__: Don't reject certs with
|
||||
critical NetscapeCertType extensions in libPKIX
|
||||
- `Bug 395427 <https://bugzilla.mozilla.org/show_bug.cgi?id=395427>`__: PKIX_PL_Initialize must
|
||||
not call NSS_Init
|
||||
- `Bug 395850 <https://bugzilla.mozilla.org/show_bug.cgi?id=395850>`__: build of libpkix tests
|
||||
creates links to nonexistant shared libraries and breaks windows build
|
||||
- `Bug 398401 <https://bugzilla.mozilla.org/show_bug.cgi?id=398401>`__: Memory leak in PKIX
|
||||
init.
|
||||
- `Bug 399326 <https://bugzilla.mozilla.org/show_bug.cgi?id=399326>`__: libpkix is unable to
|
||||
validate cert for certUsageStatusResponder
|
||||
- `Bug 400947 <https://bugzilla.mozilla.org/show_bug.cgi?id=400947>`__: thread unsafe operation
|
||||
in PKIX_PL_HashTable_Add cause selfserv to crash.
|
||||
- `Bug 402773 <https://bugzilla.mozilla.org/show_bug.cgi?id=402773>`__: Verify the list of
|
||||
public header files in NSS 3.12
|
||||
- `Bug 403470 <https://bugzilla.mozilla.org/show_bug.cgi?id=403470>`__: Strsclnt + tstclnt
|
||||
crashes when PKIX enabled.
|
||||
- `Bug 403685 <https://bugzilla.mozilla.org/show_bug.cgi?id=403685>`__: Application crashes
|
||||
after having called CERT_PKIXVerifyCert
|
||||
- `Bug 408434 <https://bugzilla.mozilla.org/show_bug.cgi?id=408434>`__: Crash with PKIX based
|
||||
verify
|
||||
- `Bug 411614 <https://bugzilla.mozilla.org/show_bug.cgi?id=411614>`__: Explicit Policy does not
|
||||
seem to work.
|
||||
- `Bug 417024 <https://bugzilla.mozilla.org/show_bug.cgi?id=417024>`__: Convert libpkix error
|
||||
code into nss error code
|
||||
- `Bug 422859 <https://bugzilla.mozilla.org/show_bug.cgi?id=422859>`__: libPKIX builds &
|
||||
validates chain to root not in the caller-provided anchor list
|
||||
- `Bug 425516 <https://bugzilla.mozilla.org/show_bug.cgi?id=425516>`__: need to destroy data
|
||||
pointed by CERTValOutParam array in case of error
|
||||
- `Bug 426450 <https://bugzilla.mozilla.org/show_bug.cgi?id=426450>`__: PKIX_PL_HashTable_Remove
|
||||
leaks hashtable key object
|
||||
- `Bug 429230 <https://bugzilla.mozilla.org/show_bug.cgi?id=429230>`__: memory leak in
|
||||
pkix_CheckCert function
|
||||
- `Bug 392696 <https://bugzilla.mozilla.org/show_bug.cgi?id=392696>`__: Fix copyright
|
||||
boilerplate in all new PKIX code
|
||||
- `Bug 300928 <https://bugzilla.mozilla.org/show_bug.cgi?id=300928>`__: Integrate libpkix to NSS
|
||||
- `Bug 303457 <https://bugzilla.mozilla.org/show_bug.cgi?id=303457>`__: extensions newly
|
||||
supported in libpkix must be marked supported
|
||||
- `Bug 331096 <https://bugzilla.mozilla.org/show_bug.cgi?id=331096>`__: NSS Softoken must detect
|
||||
forks on all unix-ish platforms
|
||||
- `Bug 390710 <https://bugzilla.mozilla.org/show_bug.cgi?id=390710>`__:
|
||||
CERTNameConstraintsTemplate is incorrect
|
||||
- `Bug 416928 <https://bugzilla.mozilla.org/show_bug.cgi?id=416928>`__: DER decode error on this
|
||||
policy extension
|
||||
- `Bug 375019 <https://bugzilla.mozilla.org/show_bug.cgi?id=375019>`__: Cache-enable
|
||||
pkix_OcspChecker_Check
|
||||
- `Bug 391454 <https://bugzilla.mozilla.org/show_bug.cgi?id=391454>`__: libPKIX does not honor
|
||||
NSS's override trust flags
|
||||
- `Bug 403682 <https://bugzilla.mozilla.org/show_bug.cgi?id=403682>`__: CERT_PKIXVerifyCert
|
||||
never succeeds
|
||||
- `Bug 324744 <https://bugzilla.mozilla.org/show_bug.cgi?id=324744>`__: add generation of policy
|
||||
extensions to certutil
|
||||
- `Bug 390973 <https://bugzilla.mozilla.org/show_bug.cgi?id=390973>`__: Add long option names to
|
||||
SECU_ParseCommandLine
|
||||
- `Bug 161326 <https://bugzilla.mozilla.org/show_bug.cgi?id=161326>`__: need API to convert
|
||||
dotted OID format to/from octet representation
|
||||
- `Bug 376737 <https://bugzilla.mozilla.org/show_bug.cgi?id=376737>`__: CERT_ImportCerts
|
||||
routinely sets VALID_PEER or VALID_CA OVERRIDE trust flags
|
||||
- `Bug 390381 <https://bugzilla.mozilla.org/show_bug.cgi?id=390381>`__: libpkix rejects cert
|
||||
chain when root CA cert has no basic constraints
|
||||
- `Bug 391183 <https://bugzilla.mozilla.org/show_bug.cgi?id=391183>`__: rename libPKIX error
|
||||
string number type to pkix error number types
|
||||
- `Bug 397122 <https://bugzilla.mozilla.org/show_bug.cgi?id=397122>`__: NSS 3.12 alpha treats a
|
||||
key3.db with no global salt as having no password
|
||||
- `Bug 405966 <https://bugzilla.mozilla.org/show_bug.cgi?id=405966>`__: Unknown signature OID
|
||||
1.3.14.3.2.29 causes sec_error_bad_signature, 3.11 ignores it
|
||||
- `Bug 413010 <https://bugzilla.mozilla.org/show_bug.cgi?id=413010>`__: CERT_CompareRDN may
|
||||
return a false match
|
||||
- `Bug 417664 <https://bugzilla.mozilla.org/show_bug.cgi?id=417664>`__: false positive crl
|
||||
revocation test on ppc/ppc64 NSS_ENABLE_PKIX_VERIFY=1
|
||||
- `Bug 404526 <https://bugzilla.mozilla.org/show_bug.cgi?id=404526>`__: glibc detected free():
|
||||
invalid pointer
|
||||
- `Bug 300929 <https://bugzilla.mozilla.org/show_bug.cgi?id=300929>`__: Certificate Policy
|
||||
extensions not supported
|
||||
- `Bug 129303 <https://bugzilla.mozilla.org/show_bug.cgi?id=129303>`__: NSS needs to expose
|
||||
interfaces to deal with multiple token sources of certs.
|
||||
- `Bug 217538 <https://bugzilla.mozilla.org/show_bug.cgi?id=217538>`__: softoken databases
|
||||
cannot be shared between multiple processes
|
||||
- `Bug 294531 <https://bugzilla.mozilla.org/show_bug.cgi?id=294531>`__: Design new interfaces
|
||||
for certificate path building and verification for libPKIX
|
||||
- `Bug 326482 <https://bugzilla.mozilla.org/show_bug.cgi?id=326482>`__: NSS ECC performance
|
||||
problems (intel)
|
||||
- `Bug 391296 <https://bugzilla.mozilla.org/show_bug.cgi?id=391296>`__: Need an update helper
|
||||
for Shared Databases
|
||||
- `Bug 395090 <https://bugzilla.mozilla.org/show_bug.cgi?id=395090>`__: remove duplication of
|
||||
pkcs7 code from pkix_pl_httpcertstore.c
|
||||
- `Bug 401026 <https://bugzilla.mozilla.org/show_bug.cgi?id=401026>`__: Need to provide a way to
|
||||
modify and create new PKCS #11 objects.
|
||||
- `Bug 403680 <https://bugzilla.mozilla.org/show_bug.cgi?id=403680>`__: CERT_PKIXVerifyCert
|
||||
fails if CRLs are missing, implement cert_pi_revocationFlags
|
||||
- `Bug 427706 <https://bugzilla.mozilla.org/show_bug.cgi?id=427706>`__: NSS_3_12_RC1 crashes in
|
||||
passwordmgr tests
|
||||
- `Bug 426245 <https://bugzilla.mozilla.org/show_bug.cgi?id=426245>`__: Assertion failure went
|
||||
undetected by tinderbox
|
||||
- `Bug 158242 <https://bugzilla.mozilla.org/show_bug.cgi?id=158242>`__: PK11_PutCRL is very
|
||||
memory inefficient
|
||||
- `Bug 287563 <https://bugzilla.mozilla.org/show_bug.cgi?id=287563>`__: Please make
|
||||
cert_CompareNameWithConstraints a non-static function
|
||||
- `Bug 301496 <https://bugzilla.mozilla.org/show_bug.cgi?id=301496>`__: NSS_Shutdown failure in
|
||||
p7sign
|
||||
- `Bug 324878 <https://bugzilla.mozilla.org/show_bug.cgi?id=324878>`__: crlutil -L outputs false
|
||||
CRL names
|
||||
- `Bug 337010 <https://bugzilla.mozilla.org/show_bug.cgi?id=337010>`__: OOM crash [[@
|
||||
NSC_DigestKey] Dereferencing possibly NULL att
|
||||
- `Bug 343231 <https://bugzilla.mozilla.org/show_bug.cgi?id=343231>`__: certutil issues certs
|
||||
for invalid requests
|
||||
- `Bug 353371 <https://bugzilla.mozilla.org/show_bug.cgi?id=353371>`__: Klocwork 91117 - Null
|
||||
Pointer Dereference in CERT_CertChainFromCert
|
||||
- `Bug 353374 <https://bugzilla.mozilla.org/show_bug.cgi?id=353374>`__: Klocwork 76494 - Null
|
||||
ptr derefs in CERT_FormatName
|
||||
- `Bug 353375 <https://bugzilla.mozilla.org/show_bug.cgi?id=353375>`__: Klocwork 76513 - Null
|
||||
ptr deref in nssCertificateList_DoCallback
|
||||
- `Bug 353413 <https://bugzilla.mozilla.org/show_bug.cgi?id=353413>`__: Klocwork 76541 free
|
||||
uninitialized pointer in CERT_FindCertURLExtension
|
||||
- `Bug 353416 <https://bugzilla.mozilla.org/show_bug.cgi?id=353416>`__: Klocwork 76593 null ptr
|
||||
deref in nssCryptokiPrivateKey_SetCertificate
|
||||
- `Bug 353423 <https://bugzilla.mozilla.org/show_bug.cgi?id=353423>`__: Klocwork bugs in
|
||||
nss/lib/pk11wrap/dev3hack.c
|
||||
- `Bug 353739 <https://bugzilla.mozilla.org/show_bug.cgi?id=353739>`__: Klocwork Null ptr
|
||||
dereferences in instance.c
|
||||
- `Bug 353741 <https://bugzilla.mozilla.org/show_bug.cgi?id=353741>`__: klocwork cascading
|
||||
memory leak in mpp_make_prime
|
||||
- `Bug 353742 <https://bugzilla.mozilla.org/show_bug.cgi?id=353742>`__: klocwork null ptr
|
||||
dereference in ocsp_DecodeResponseBytes
|
||||
- `Bug 353748 <https://bugzilla.mozilla.org/show_bug.cgi?id=353748>`__: klocwork null ptr
|
||||
dereferences in pki3hack.c
|
||||
- `Bug 353760 <https://bugzilla.mozilla.org/show_bug.cgi?id=353760>`__: klocwork null pointer
|
||||
dereference in p7decode.c
|
||||
- `Bug 353763 <https://bugzilla.mozilla.org/show_bug.cgi?id=353763>`__: klocwork Null ptr
|
||||
dereferences in pk11cert.c
|
||||
- `Bug 353773 <https://bugzilla.mozilla.org/show_bug.cgi?id=353773>`__: klocwork Null ptr
|
||||
dereferences in pk11nobj.c
|
||||
- `Bug 353777 <https://bugzilla.mozilla.org/show_bug.cgi?id=353777>`__: Klocwork Null ptr
|
||||
dereferences in pk11obj.c
|
||||
- `Bug 353780 <https://bugzilla.mozilla.org/show_bug.cgi?id=353780>`__: Klocwork NULL ptr
|
||||
dereferences in pkcs11.c
|
||||
- `Bug 353865 <https://bugzilla.mozilla.org/show_bug.cgi?id=353865>`__: klocwork Null ptr deref
|
||||
in softoken/pk11db.c
|
||||
- `Bug 353888 <https://bugzilla.mozilla.org/show_bug.cgi?id=353888>`__: klockwork IDs for
|
||||
ssl3con.c
|
||||
- `Bug 353895 <https://bugzilla.mozilla.org/show_bug.cgi?id=353895>`__: klocwork Null ptr derefs
|
||||
in pki/pkibase.c
|
||||
- `Bug 353902 <https://bugzilla.mozilla.org/show_bug.cgi?id=353902>`__: klocwork bugs in
|
||||
stanpcertdb.c
|
||||
- `Bug 353903 <https://bugzilla.mozilla.org/show_bug.cgi?id=353903>`__: klocwork oom crash in
|
||||
softoken/keydb.c
|
||||
- `Bug 353908 <https://bugzilla.mozilla.org/show_bug.cgi?id=353908>`__: klocwork OOM crash in
|
||||
tdcache.c
|
||||
- `Bug 353909 <https://bugzilla.mozilla.org/show_bug.cgi?id=353909>`__: klocwork ptr dereference
|
||||
before NULL check in devutil.c
|
||||
- `Bug 353912 <https://bugzilla.mozilla.org/show_bug.cgi?id=353912>`__: Misc klocwork bugs in
|
||||
lib/ckfw
|
||||
- `Bug 354008 <https://bugzilla.mozilla.org/show_bug.cgi?id=354008>`__: klocwork bugs in freebl
|
||||
- `Bug 359331 <https://bugzilla.mozilla.org/show_bug.cgi?id=359331>`__: modutil -changepw strict
|
||||
shutdown failure
|
||||
- `Bug 373367 <https://bugzilla.mozilla.org/show_bug.cgi?id=373367>`__: verify OCSP response
|
||||
signature in libpkix without decoding and reencoding
|
||||
- `Bug 390542 <https://bugzilla.mozilla.org/show_bug.cgi?id=390542>`__: libpkix fails to
|
||||
validate a chain that consists only of one self issued, trusted cert
|
||||
- `Bug 390728 <https://bugzilla.mozilla.org/show_bug.cgi?id=390728>`__:
|
||||
pkix_pl_OcspRequest_Create throws an error if it was not able to get AIA location
|
||||
- `Bug 397825 <https://bugzilla.mozilla.org/show_bug.cgi?id=397825>`__: libpkix: ifdef code that
|
||||
uses user object types
|
||||
- `Bug 397832 <https://bugzilla.mozilla.org/show_bug.cgi?id=397832>`__: libpkix leaks memory if
|
||||
a macro calls a function that returns an error
|
||||
- `Bug 402727 <https://bugzilla.mozilla.org/show_bug.cgi?id=402727>`__: functions responsible
|
||||
for creating an object leak if subsequent function code produces an error
|
||||
- `Bug 402731 <https://bugzilla.mozilla.org/show_bug.cgi?id=402731>`__:
|
||||
pkix_pl_Pk11CertStore_CrlQuery will crash if fails to acquire DP cache.
|
||||
- `Bug 406647 <https://bugzilla.mozilla.org/show_bug.cgi?id=406647>`__: libpkix does not use
|
||||
user defined revocation checkers
|
||||
- `Bug 407064 <https://bugzilla.mozilla.org/show_bug.cgi?id=407064>`__:
|
||||
pkix_pl_LdapCertStore_BuildCrlList should not fail if a crl fails to be decoded
|
||||
- `Bug 421216 <https://bugzilla.mozilla.org/show_bug.cgi?id=421216>`__: libpkix test nss_thread
|
||||
leaks a test certificate
|
||||
- `Bug 301259 <https://bugzilla.mozilla.org/show_bug.cgi?id=301259>`__: signtool Usage message
|
||||
is unhelpful
|
||||
- `Bug 389781 <https://bugzilla.mozilla.org/show_bug.cgi?id=389781>`__: NSS should be built
|
||||
size-optimized in browser builds on Linux, Windows, and Mac
|
||||
- `Bug 90426 <https://bugzilla.mozilla.org/show_bug.cgi?id=90426>`__: use of obsolete typedefs
|
||||
in public NSS headers
|
||||
- `Bug 113323 <https://bugzilla.mozilla.org/show_bug.cgi?id=113323>`__: The first argument to
|
||||
PK11_FindCertFromNickname should be const.
|
||||
- `Bug 132485 <https://bugzilla.mozilla.org/show_bug.cgi?id=132485>`__: built-in root certs slot
|
||||
description is empty
|
||||
- `Bug 177184 <https://bugzilla.mozilla.org/show_bug.cgi?id=177184>`__: NSS_CMSDecoder_Cancel
|
||||
might have a leak
|
||||
- `Bug 232392 <https://bugzilla.mozilla.org/show_bug.cgi?id=232392>`__: Erroneous root CA tests
|
||||
in NSS Libraries
|
||||
- `Bug 286642 <https://bugzilla.mozilla.org/show_bug.cgi?id=286642>`__: util should be in a
|
||||
shared library
|
||||
- `Bug 287052 <https://bugzilla.mozilla.org/show_bug.cgi?id=287052>`__: Function to get CRL
|
||||
Entry reason code has incorrect prototype and implementation
|
||||
- `Bug 299308 <https://bugzilla.mozilla.org/show_bug.cgi?id=299308>`__: Need additional APIs in
|
||||
the CRL cache for libpkix
|
||||
- `Bug 335039 <https://bugzilla.mozilla.org/show_bug.cgi?id=335039>`__:
|
||||
nssCKFWCryptoOperation_UpdateCombo is not declared
|
||||
- `Bug 340917 <https://bugzilla.mozilla.org/show_bug.cgi?id=340917>`__: crlutil should init NSS
|
||||
read-only for some options
|
||||
- `Bug 350948 <https://bugzilla.mozilla.org/show_bug.cgi?id=350948>`__: freebl macro change can
|
||||
give 1% improvement in RSA performance on amd64
|
||||
- `Bug 352439 <https://bugzilla.mozilla.org/show_bug.cgi?id=352439>`__: Reference leaks in
|
||||
modutil
|
||||
- `Bug 369144 <https://bugzilla.mozilla.org/show_bug.cgi?id=369144>`__: certutil needs option to
|
||||
generate SubjectKeyID extension
|
||||
- `Bug 391771 <https://bugzilla.mozilla.org/show_bug.cgi?id=391771>`__: pk11_config_name and
|
||||
pk11_config_strings leaked on shutdown
|
||||
- `Bug 401194 <https://bugzilla.mozilla.org/show_bug.cgi?id=401194>`__: crash in lg_FindObjects
|
||||
on win64
|
||||
- `Bug 405652 <https://bugzilla.mozilla.org/show_bug.cgi?id=405652>`__: In the TLS ClientHello
|
||||
message the gmt_unix_time is incorrect
|
||||
- `Bug 424917 <https://bugzilla.mozilla.org/show_bug.cgi?id=424917>`__: Performance regression
|
||||
with studio 12 compiler
|
||||
- `Bug 391770 <https://bugzilla.mozilla.org/show_bug.cgi?id=391770>`__: OCSP_Global.monitor is
|
||||
leaked on shutdown
|
||||
- `Bug 403687 <https://bugzilla.mozilla.org/show_bug.cgi?id=403687>`__: move pkix functions to
|
||||
certvfypkix.c, turn off EV_TEST_HACK
|
||||
- `Bug 428105 <https://bugzilla.mozilla.org/show_bug.cgi?id=428105>`__: CERT_SetOCSPTimeout is
|
||||
not defined in any public header file
|
||||
- `Bug 213359 <https://bugzilla.mozilla.org/show_bug.cgi?id=213359>`__: enhance PK12util to
|
||||
extract certs from p12 file
|
||||
- `Bug 329067 <https://bugzilla.mozilla.org/show_bug.cgi?id=329067>`__: NSS encodes cert
|
||||
distinguished name attributes with wrong string type
|
||||
- `Bug 339906 <https://bugzilla.mozilla.org/show_bug.cgi?id=339906>`__: sec_pkcs12_install_bags
|
||||
passes uninitialized variables to functions
|
||||
- `Bug 396484 <https://bugzilla.mozilla.org/show_bug.cgi?id=396484>`__: certutil doesn't
|
||||
truncate existing temporary files when writing them
|
||||
- `Bug 251594 <https://bugzilla.mozilla.org/show_bug.cgi?id=251594>`__: Certificate from PKCS#12
|
||||
file with colon in friendlyName not selectable for signing/encryption
|
||||
- `Bug 321584 <https://bugzilla.mozilla.org/show_bug.cgi?id=321584>`__: NSS PKCS12 decoder fails
|
||||
to import bags without nicknames
|
||||
- `Bug 332633 <https://bugzilla.mozilla.org/show_bug.cgi?id=332633>`__: remove duplicate header
|
||||
files in nss/cmd/sslsample
|
||||
- `Bug 335019 <https://bugzilla.mozilla.org/show_bug.cgi?id=335019>`__: pk12util takes friendly
|
||||
name from key, not cert
|
||||
- `Bug 339173 <https://bugzilla.mozilla.org/show_bug.cgi?id=339173>`__: mem leak whenever
|
||||
SECMOD_HANDLE_STRING_ARG called in loop
|
||||
- `Bug 353904 <https://bugzilla.mozilla.org/show_bug.cgi?id=353904>`__: klocwork Null ptr deref
|
||||
in secasn1d.c
|
||||
- `Bug 366390 <https://bugzilla.mozilla.org/show_bug.cgi?id=366390>`__: correct misleading
|
||||
function names in fipstest
|
||||
- `Bug 370536 <https://bugzilla.mozilla.org/show_bug.cgi?id=370536>`__: Memory leaks in pointer
|
||||
tracker code in DEBUG builds only
|
||||
- `Bug 372242 <https://bugzilla.mozilla.org/show_bug.cgi?id=372242>`__: CERT_CompareRDN uses
|
||||
incorrect algorithm
|
||||
- `Bug 379753 <https://bugzilla.mozilla.org/show_bug.cgi?id=379753>`__: S/MIME should support
|
||||
AES
|
||||
- `Bug 381375 <https://bugzilla.mozilla.org/show_bug.cgi?id=381375>`__: ocspclnt doesn't work on
|
||||
Windows
|
||||
- `Bug 398693 <https://bugzilla.mozilla.org/show_bug.cgi?id=398693>`__: DER_AsciiToTime produces
|
||||
incorrect output for dates 1950-1970
|
||||
- `Bug 420212 <https://bugzilla.mozilla.org/show_bug.cgi?id=420212>`__: Empty cert DNs handled
|
||||
badly, display as !INVALID AVA!
|
||||
- `Bug 420979 <https://bugzilla.mozilla.org/show_bug.cgi?id=420979>`__: vfychain ignores -b TIME
|
||||
option when -p option is present
|
||||
- `Bug 403563 <https://bugzilla.mozilla.org/show_bug.cgi?id=403563>`__: Implement the TLS
|
||||
session ticket extension (STE)
|
||||
- `Bug 400917 <https://bugzilla.mozilla.org/show_bug.cgi?id=400917>`__: Want exported function
|
||||
that outputs all host names for DNS name matching
|
||||
- `Bug 315643 <https://bugzilla.mozilla.org/show_bug.cgi?id=315643>`__:
|
||||
test_buildchain_resourcelimits won't build
|
||||
- `Bug 353745 <https://bugzilla.mozilla.org/show_bug.cgi?id=353745>`__: klocwork null ptr
|
||||
dereference in PKCS12 decoder
|
||||
- `Bug 338367 <https://bugzilla.mozilla.org/show_bug.cgi?id=338367>`__: The GF2M_POPULATE and
|
||||
GFP_POPULATE should check the ecCurve_map array index bounds before use
|
||||
- `Bug 201139 <https://bugzilla.mozilla.org/show_bug.cgi?id=201139>`__: SSLTap should display
|
||||
plain text for NULL cipher suites
|
||||
- `Bug 233806 <https://bugzilla.mozilla.org/show_bug.cgi?id=233806>`__: Support NIST CRL policy
|
||||
- `Bug 279085 <https://bugzilla.mozilla.org/show_bug.cgi?id=279085>`__: NSS tools display public
|
||||
exponent as negative number
|
||||
- `Bug 363480 <https://bugzilla.mozilla.org/show_bug.cgi?id=363480>`__: ocspclnt needs option to
|
||||
take cert from specified file
|
||||
- `Bug 265715 <https://bugzilla.mozilla.org/show_bug.cgi?id=265715>`__: remove unused hsearch.c
|
||||
DBM code
|
||||
- `Bug 337361 <https://bugzilla.mozilla.org/show_bug.cgi?id=337361>`__: Leaks in jar_parse_any
|
||||
(security/nss/lib/jar/jarver.c)
|
||||
- `Bug 338453 <https://bugzilla.mozilla.org/show_bug.cgi?id=338453>`__: Leaks in
|
||||
security/nss/lib/jar/jarfile.c
|
||||
- `Bug 351408 <https://bugzilla.mozilla.org/show_bug.cgi?id=351408>`__: Leaks in
|
||||
JAR_JAR_sign_archive (security/nss/lib/jar/jarjart.c)
|
||||
- `Bug 351443 <https://bugzilla.mozilla.org/show_bug.cgi?id=351443>`__: Remove unused code from
|
||||
mozilla/security/nss/lib/jar
|
||||
- `Bug 351510 <https://bugzilla.mozilla.org/show_bug.cgi?id=351510>`__: Remove USE_MOZ_THREAD
|
||||
code from mozilla/security/lib/jar
|
||||
- `Bug 118830 <https://bugzilla.mozilla.org/show_bug.cgi?id=118830>`__: NSS public header files
|
||||
should be C++ safe
|
||||
- `Bug 123996 <https://bugzilla.mozilla.org/show_bug.cgi?id=123996>`__: certutil -H doesn't
|
||||
document certutil -C -a
|
||||
- `Bug 178894 <https://bugzilla.mozilla.org/show_bug.cgi?id=178894>`__: Quick decoder updates
|
||||
for lib/certdb and lib/certhigh
|
||||
- `Bug 220115 <https://bugzilla.mozilla.org/show_bug.cgi?id=220115>`__: CKM_INVALID_MECHANISM
|
||||
should be an unsigned long constant.
|
||||
- `Bug 330721 <https://bugzilla.mozilla.org/show_bug.cgi?id=330721>`__: Remove OS/2 VACPP
|
||||
compiler support from NSS
|
||||
- `Bug 408260 <https://bugzilla.mozilla.org/show_bug.cgi?id=408260>`__: certutil usage doesn't
|
||||
give enough information about trust arguments
|
||||
- `Bug 410226 <https://bugzilla.mozilla.org/show_bug.cgi?id=410226>`__: leak in
|
||||
create_objects_from_handles
|
||||
- `Bug 415007 <https://bugzilla.mozilla.org/show_bug.cgi?id=415007>`__:
|
||||
PK11_FindCertFromDERSubjectAndNickname is dead code
|
||||
- `Bug 416267 <https://bugzilla.mozilla.org/show_bug.cgi?id=416267>`__: compiler warnings on
|
||||
solaris due to extra semicolon in SEC_ASN1_MKSUB
|
||||
- `Bug 419763 <https://bugzilla.mozilla.org/show_bug.cgi?id=419763>`__: logger thread should be
|
||||
joined on exit
|
||||
- `Bug 424471 <https://bugzilla.mozilla.org/show_bug.cgi?id=424471>`__: counter overflow in
|
||||
bltest
|
||||
- `Bug 229335 <https://bugzilla.mozilla.org/show_bug.cgi?id=229335>`__: Remove certificates that
|
||||
expired in August 2004 from tree
|
||||
- `Bug 346551 <https://bugzilla.mozilla.org/show_bug.cgi?id=346551>`__: init SECItem derTemp in
|
||||
crmf_encode_popoprivkey
|
||||
- `Bug 395080 <https://bugzilla.mozilla.org/show_bug.cgi?id=395080>`__: Double backslash in
|
||||
sysDir filenames causes problems on OS/2
|
||||
- `Bug 341371 <https://bugzilla.mozilla.org/show_bug.cgi?id=341371>`__: certutil lacks a way to
|
||||
request a certificate with an existing key
|
||||
- `Bug 382292 <https://bugzilla.mozilla.org/show_bug.cgi?id=382292>`__: add support for Camellia
|
||||
to cmd/symkeyutil
|
||||
- `Bug 385642 <https://bugzilla.mozilla.org/show_bug.cgi?id=385642>`__: Add additional cert
|
||||
usage(s) for certutil's -V -u option
|
||||
- `Bug 175741 <https://bugzilla.mozilla.org/show_bug.cgi?id=175741>`__: strict aliasing bugs in
|
||||
mozilla/dbm
|
||||
- `Bug 210584 <https://bugzilla.mozilla.org/show_bug.cgi?id=210584>`__: CERT_AsciiToName doesn't
|
||||
accept all valid values
|
||||
- `Bug 298540 <https://bugzilla.mozilla.org/show_bug.cgi?id=298540>`__: vfychain usage option
|
||||
should be improved and documented
|
||||
- `Bug 323570 <https://bugzilla.mozilla.org/show_bug.cgi?id=323570>`__: Make dbck Debug mode
|
||||
work with Softoken
|
||||
- `Bug 371470 <https://bugzilla.mozilla.org/show_bug.cgi?id=371470>`__: vfychain needs option to
|
||||
verify for specific date
|
||||
- `Bug 387621 <https://bugzilla.mozilla.org/show_bug.cgi?id=387621>`__: certutil's random noise
|
||||
generator isn't very efficient
|
||||
- `Bug 390185 <https://bugzilla.mozilla.org/show_bug.cgi?id=390185>`__: signtool error message
|
||||
wrongly uses the term database
|
||||
- `Bug 391651 <https://bugzilla.mozilla.org/show_bug.cgi?id=391651>`__: Need config.mk file for
|
||||
Windows Vista
|
||||
- `Bug 396322 <https://bugzilla.mozilla.org/show_bug.cgi?id=396322>`__: Fix secutil's code and
|
||||
NSS tools that print public keys
|
||||
- `Bug 417641 <https://bugzilla.mozilla.org/show_bug.cgi?id=417641>`__: miscellaneous minor NSS
|
||||
bugs
|
||||
- `Bug 334914 <https://bugzilla.mozilla.org/show_bug.cgi?id=334914>`__: hopefully useless null
|
||||
check of out it in JAR_find_next
|
||||
- `Bug 95323 <https://bugzilla.mozilla.org/show_bug.cgi?id=95323>`__: ckfw should support cipher
|
||||
operations.
|
||||
- `Bug 337088 <https://bugzilla.mozilla.org/show_bug.cgi?id=337088>`__: Coverity 405,
|
||||
PK11_ParamToAlgid() in mozilla/security/nss/lib/pk11wrap/pk11mech.c
|
||||
- `Bug 339907 <https://bugzilla.mozilla.org/show_bug.cgi?id=339907>`__: oaep_xor_with_h1
|
||||
allocates and leaks sha1cx
|
||||
- `Bug 341122 <https://bugzilla.mozilla.org/show_bug.cgi?id=341122>`__: Coverity 633
|
||||
SFTK_DestroySlotData uses slot->slotLock then checks it for NULL
|
||||
- `Bug 351140 <https://bugzilla.mozilla.org/show_bug.cgi?id=351140>`__: Coverity 995, potential
|
||||
crash in ecgroup_fromNameAndHex
|
||||
- `Bug 362278 <https://bugzilla.mozilla.org/show_bug.cgi?id=362278>`__: lib/util includes header
|
||||
files from other NSS directories
|
||||
- `Bug 228190 <https://bugzilla.mozilla.org/show_bug.cgi?id=228190>`__: Remove unnecessary
|
||||
NSS_ENABLE_ECC defines from manifest.mn
|
||||
- `Bug 412906 <https://bugzilla.mozilla.org/show_bug.cgi?id=412906>`__: remove sha.c and sha.h
|
||||
from lib/freebl
|
||||
- `Bug 353543 <https://bugzilla.mozilla.org/show_bug.cgi?id=353543>`__: valgrind uninitialized
|
||||
memory read in nssPKIObjectCollection_AddInstances
|
||||
- `Bug 377548 <https://bugzilla.mozilla.org/show_bug.cgi?id=377548>`__: NSS QA test program
|
||||
certutil's default DSA prime is only 512 bits
|
||||
- `Bug 333405 <https://bugzilla.mozilla.org/show_bug.cgi?id=333405>`__: item cleanup is unused
|
||||
DEADCODE in SECITEM_AllocItem loser
|
||||
- `Bug 288730 <https://bugzilla.mozilla.org/show_bug.cgi?id=288730>`__: compiler warnings in
|
||||
certutil
|
||||
- `Bug 337251 <https://bugzilla.mozilla.org/show_bug.cgi?id=337251>`__: warning: /\* within
|
||||
comment
|
||||
- `Bug 362967 <https://bugzilla.mozilla.org/show_bug.cgi?id=362967>`__: export
|
||||
SECMOD_DeleteModuleEx
|
||||
- `Bug 389248 <https://bugzilla.mozilla.org/show_bug.cgi?id=389248>`__: NSS build failure when
|
||||
NSS_ENABLE_ECC is not defined
|
||||
- `Bug 390451 <https://bugzilla.mozilla.org/show_bug.cgi?id=390451>`__: Remembered passwords
|
||||
lost when changing Master Password
|
||||
- `Bug 418546 <https://bugzilla.mozilla.org/show_bug.cgi?id=418546>`__: reference leak in
|
||||
CERT_PKIXVerifyCert
|
||||
- `Bug 390074 <https://bugzilla.mozilla.org/show_bug.cgi?id=390074>`__: OS/2 sign.cmd doesn't
|
||||
find sqlite3.dll
|
||||
- `Bug 417392 <https://bugzilla.mozilla.org/show_bug.cgi?id=417392>`__: certutil -L -n reports
|
||||
bogus trust flags
|
||||
|
||||
--------------
|
||||
|
||||
`Documentation <#documentation>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
For a list of the primary NSS documentation pages on mozilla.org, see `NSS
|
||||
Documentation <../index.html#Documentation>`__. New and revised documents available since the
|
||||
release of NSS 3.11 include the following:
|
||||
|
||||
- :ref:`mozilla_projects_nss_reference_building_and_installing_nss_build_instructions`
|
||||
- `NSS Shared DB <http://wiki.mozilla.org/NSS_Shared_DB>`__
|
||||
- :ref:`mozilla_projects_nss_reference_nss_environment_variables`
|
||||
|
||||
--------------
|
||||
|
||||
`Compatibility <#compatibility>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
NSS 3.12 shared libraries are backward compatible with all older NSS 3.x shared libraries. A
|
||||
program linked with older NSS 3.x shared libraries will work with NSS 3.12 shared libraries
|
||||
without recompiling or relinking. Furthermore, applications that restrict their use of NSS APIs
|
||||
to the functions listed in `NSS Public Functions <../ref/nssfunctions.html>`__ will remain
|
||||
compatible with future versions of the NSS shared libraries.
|
||||
|
||||
--------------
|
||||
|
||||
`Feedback <#feedback>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
Bugs discovered should be reported by filing a bug report with `mozilla.org
|
||||
Bugzilla <https://bugzilla.mozilla.org/>`__\ (product NSS).
|
||||
|
|
@ -1,72 +0,0 @@
|
|||
.. _mozilla_projects_nss_nss_3_37_3release_notes:
|
||||
|
||||
NSS 3.37.3 release notes
|
||||
========================
|
||||
|
||||
`Introduction <#introduction>`__
|
||||
--------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
Network Security Services (NSS) 3.37.3 is a patch release for NSS 3.37.
|
||||
|
||||
.. _distribution_information:
|
||||
|
||||
`Distribution Information <#distribution_information>`__
|
||||
--------------------------------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
The HG tag is NSS_3_37_3_RTM. NSS 3.37.3 requires NSPR 4.19 or newer.
|
||||
|
||||
NSS 3.37.3 source distributions are available on ftp.mozilla.org for secure HTTPS download:
|
||||
|
||||
- Source tarballs:
|
||||
https://ftp.mozilla.org/pub/security/nss/releases/NSS_3_37_3_RTM/src/
|
||||
|
||||
.. _new_in_nss_3.37.3:
|
||||
|
||||
`New in NSS 3.37.3 <#new_in_nss_3.37.3>`__
|
||||
------------------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
.. _new_functionality:
|
||||
|
||||
`New Functionality <#new_functionality>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
No new functionality is introduced in this release. This is a patch release to fix regression
|
||||
bugs.
|
||||
|
||||
.. _bugs_fixed_in_nss_3.37.3:
|
||||
|
||||
`Bugs fixed in NSS 3.37.3 <#bugs_fixed_in_nss_3.37.3>`__
|
||||
--------------------------------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
- Bug 1459739 - Fix build on armv6/armv7 and other platforms.
|
||||
|
||||
- Bug 1461731 - Fix crash on macOS related to authentication tokens, e.g. PK11or WebAuthn.
|
||||
|
||||
`Compatibility <#compatibility>`__
|
||||
----------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
NSS 3.37.3 shared libraries are backward compatible with all older NSS 3.x shared libraries. A
|
||||
program linked with older NSS 3.x shared libraries will work with NSS 3.37.3 shared libraries
|
||||
without recompiling or relinking. Furthermore, applications that restrict their use of NSS APIs
|
||||
to the functions listed in NSS Public Functions will remain compatible with future versions of
|
||||
the NSS shared libraries.
|
||||
|
||||
`Feedback <#feedback>`__
|
||||
------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
Bugs discovered should be reported by filing a bug report with
|
||||
`bugzilla.mozilla.org <https://bugzilla.mozilla.org/enter_bug.cgi?product=NSS>`__ (product NSS).
|
||||
|
|
@ -1,882 +0,0 @@
|
|||
.. _mozilla_projects_nss_nss_api_guidelines:
|
||||
|
||||
NSS API Guidelines
|
||||
==================
|
||||
|
||||
.. container::
|
||||
|
||||
Newsgroup: `mozilla.dev.tech.crypto <news://news.mozilla.org/mozilla.dev.tech.crypto>`__
|
||||
|
||||
`Introduction <#introduction>`__
|
||||
--------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
This document describes how the NSS code is organized, the libraries that get built from the NSS
|
||||
sources, and guidelines for writing NSS code. These guidelines will familiarize you with some of
|
||||
the ways things can be done in the NSS code. This will help you understand existing NSS code. It
|
||||
should also help you understand how to write new code, and where to place it.
|
||||
|
||||
Some of the guidelines in this document, are more forward-looking than documentary. These rules
|
||||
are here to help us all immediately achieve more consistent and usable code, but some existing
|
||||
code won't follow all these rules.
|
||||
|
||||
.. _nss_api_structure:
|
||||
|
||||
`NSS API Structure <#nss_api_structure>`__
|
||||
------------------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
This section explains the structure and relationships of the NSS libraries. The
|
||||
`Layering <#layering>`__ section explains how the NSS code is layered, and how higher-level
|
||||
functions wrap low-level functions. The `Libraries <#libraries>`__ section describes the NSS
|
||||
libraries, the functionality each provides, and the layer in which the library (mostly) operates.
|
||||
|
||||
`Layering <#layering>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
Each separate component of the API should live in its own layer. The functions in these APIs
|
||||
should never call API layers above them. In addition, some low-level APIs may be completely
|
||||
opaque to higher level layers. That is, access to these functions should only be provided by the
|
||||
API directly above them. The NSS APIs are layered, as shown in this diagram:
|
||||
|
||||
.. image:: /en-US/docs/Mozilla/Projects/NSS/NSS_API_Guidelines/layer.gif
|
||||
:alt: A diagram of the different layers that collectively make up "NSS". Dependencies are only
|
||||
permitted between siblings and layers below them.
|
||||
:width: 427px
|
||||
:height: 507px
|
||||
|
||||
The boxes in the gray section, towards the center, are exported only through PKCS #11. PKCS #11
|
||||
is only exported through the Wrappers. The areas which need the most work (both here and
|
||||
throughout the code) is:
|
||||
|
||||
#. The relationship of the Certificate library with just about every other component (most
|
||||
noticeably PKCS #12, PKCS #7, and PKCS #11)
|
||||
#. Splitting Low Key and High Key components more clearly
|
||||
#. The Crypto wrappers (PKCS #11 Wrappers) and High Key
|
||||
#. PKCS #12 and PKCS #5
|
||||
|
||||
`Libraries <#libraries>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
NSS compiles into the libraries described below. The Layer indicates the main layer, seen in the
|
||||
previous diagram, in which the library operates. The Directory is the location of the library
|
||||
code in the NSS source tree. The Public Headers is a list of header files that contain types, and
|
||||
functions, that are publicly available to higer-level APIs.
|
||||
|
||||
+----------+---------------------+---------------------+---------------+---------------------+
|
||||
| Library | Description | Layer | Directory | Public Headers |
|
||||
+----------+---------------------+---------------------+---------------+---------------------+
|
||||
| certdb | Provides all | Low Cert | lib/certdb | cdbhdl.h, certdb.h, |
|
||||
| | certificate | | | cert.h, certt.h |
|
||||
| | handling functions | | | |
|
||||
| | and types. The | | | |
|
||||
| | certdb library | | | |
|
||||
| | manipulates the | | | |
|
||||
| | certificate | | | |
|
||||
| | database (add, | | | |
|
||||
| | create, delete | | | |
|
||||
| | certificates and | | | |
|
||||
| | CRLs). It also | | | |
|
||||
| | provides general | | | |
|
||||
| | c | | | |
|
||||
| | ertificate-handling | | | |
|
||||
| | routines (create a | | | |
|
||||
| | certificate, | | | |
|
||||
| | verify, add/check | | | |
|
||||
| | certificate | | | |
|
||||
| | extensions). | | | |
|
||||
+----------+---------------------+---------------------+---------------+---------------------+
|
||||
| certhi | Provides high-level | High Cert | lib/certhigh | ocsp.h, ocspt.h |
|
||||
| | certificate-related | | | |
|
||||
| | functions, that do | | | |
|
||||
| | not access the | | | |
|
||||
| | certificate | | | |
|
||||
| | database, nor | | | |
|
||||
| | individual | | | |
|
||||
| | certificate data | | | |
|
||||
| | directly. | | | |
|
||||
| | Currently, OCSP | | | |
|
||||
| | checking settings | | | |
|
||||
| | are exported | | | |
|
||||
| | through certhi. | | | |
|
||||
+----------+---------------------+---------------------+---------------+---------------------+
|
||||
| crmf | Provides functions, | Same Level as SSL | lib/crmf | cmmf.h, crmf.h, |
|
||||
| | and data types, to | | | crmft.h, cmmft.h, |
|
||||
| | handle Certificate | | | crmffut.h |
|
||||
| | Management Message | | | |
|
||||
| | Format (CMMF) and | | | |
|
||||
| | Certificate Request | | | |
|
||||
| | Message Format | | | |
|
||||
| | (CRMF, see `RFC | | | |
|
||||
| | 2511 <https://data | | | |
|
||||
| | tracker.ietf.org/do | | | |
|
||||
| | c/html/rfc2511>`__) | | | |
|
||||
| | data. CMMF no | | | |
|
||||
| | longer exists as a | | | |
|
||||
| | proposed standard; | | | |
|
||||
| | CMMF functions have | | | |
|
||||
| | been incorporated | | | |
|
||||
| | into the proposal | | | |
|
||||
| | for `Certificate | | | |
|
||||
| | Management | | | |
|
||||
| | Protocols | | | |
|
||||
| | (CMP) <https://data | | | |
|
||||
| | tracker.ietf.org/do | | | |
|
||||
| | c/html/rfc2510>`__. | | | |
|
||||
+----------+---------------------+---------------------+---------------+---------------------+
|
||||
| cryptohi | Provides high-level | Sign/Verify | lib/cryptohi | cryptohi.h, |
|
||||
| | cryptographic | | | cryptoht.h, |
|
||||
| | support operations: | | | hasht.h, keyhi.h, |
|
||||
| | such as signing, | | | keythi.h, key.h, |
|
||||
| | verifying | | | keyt.h, sechash.h |
|
||||
| | signatures, key | | | |
|
||||
| | generation, key | | | |
|
||||
| | manipulation, | | | |
|
||||
| | hashing; and data | | | |
|
||||
| | types. This code is | | | |
|
||||
| | above the PKCS #11 | | | |
|
||||
| | layer. | | | |
|
||||
+----------+---------------------+---------------------+---------------+---------------------+
|
||||
| fort | Provides a PKCS #11 | PKCS #11 | lib/fortcrypt | cryptint.h, |
|
||||
| | interface, to | | | fmutex.h, |
|
||||
| | Fortezza crypto | | | fortsock.h, |
|
||||
| | services. Fortezza | | | fpkcs11.h, |
|
||||
| | is a set of | | | fpkcs11f.h, |
|
||||
| | security | | | fpkcs11t.h, |
|
||||
| | algorithms, used by | | | fpkmem.h, |
|
||||
| | the U.S. | | | fpkstrs.h, genci.h, |
|
||||
| | government. There | | | maci.h |
|
||||
| | is also a SWFT | | | |
|
||||
| | library that | | | |
|
||||
| | provides a | | | |
|
||||
| | software-only | | | |
|
||||
| | implementation of a | | | |
|
||||
| | PKCS #11 Fortezza | | | |
|
||||
| | token. | | | |
|
||||
+----------+---------------------+---------------------+---------------+---------------------+
|
||||
| freebl | Provides the API to | Within PKCS #11, | lib/freebl | blapi.h, blapit.h |
|
||||
| | actual | wraps Crypto | | |
|
||||
| | cryptographic | | | |
|
||||
| | operations. The | | | |
|
||||
| | freebl is a wrapper | | | |
|
||||
| | API. You must | | | |
|
||||
| | supply a library | | | |
|
||||
| | that implements the | | | |
|
||||
| | cryptographic | | | |
|
||||
| | operations, such as | | | |
|
||||
| | BSAFE from RSA | | | |
|
||||
| | Security. This is | | | |
|
||||
| | also known as the | | | |
|
||||
| | "bottom layer" API, | | | |
|
||||
| | or BLAPI. | | | |
|
||||
+----------+---------------------+---------------------+---------------+---------------------+
|
||||
| jar | Provides support | Port | lib/jar | jar-ds.h, jar.h, |
|
||||
| | for reading and | | | jarfile.h |
|
||||
| | writing data in | | | |
|
||||
| | Java Archive (jar) | | | |
|
||||
| | format, including | | | |
|
||||
| | zlib compression. | | | |
|
||||
+----------+---------------------+---------------------+---------------+---------------------+
|
||||
| nss | Provides high-level | Above High Cert, | lib/nss | nss.h |
|
||||
| | initialiazation and | High Key | | |
|
||||
| | shutdown of | | | |
|
||||
| | security services. | | | |
|
||||
| | Specifically, this | | | |
|
||||
| | library provides | | | |
|
||||
| | NSS_Init() for | | | |
|
||||
| | establishing | | | |
|
||||
| | default | | | |
|
||||
| | certificate, key, | | | |
|
||||
| | module databases, | | | |
|
||||
| | and initializing a | | | |
|
||||
| | default random | | | |
|
||||
| | number generator. | | | |
|
||||
| | NSS_Shutdown() | | | |
|
||||
| | closes these | | | |
|
||||
| | databases, to | | | |
|
||||
| | prevent further | | | |
|
||||
| | access by an | | | |
|
||||
| | application. | | | |
|
||||
+----------+---------------------+---------------------+---------------+---------------------+
|
||||
| pk11wrap | Provides access to | Crypto Wrapper | lib/pk11wrap | pk11func.h, |
|
||||
| | PKCS #11 modules, | | | secmod.h, secmodt.h |
|
||||
| | through a unified | | | |
|
||||
| | interface. The | | | |
|
||||
| | pkcs11wrap library | | | |
|
||||
| | provides functions | | | |
|
||||
| | for | | | |
|
||||
| | selecting/finding | | | |
|
||||
| | PKCS #11 modules | | | |
|
||||
| | and slots. It also | | | |
|
||||
| | provides functions | | | |
|
||||
| | that invoke | | | |
|
||||
| | operations in | | | |
|
||||
| | selected modules | | | |
|
||||
| | and slots, such as | | | |
|
||||
| | key selection and | | | |
|
||||
| | generation, | | | |
|
||||
| | signing, encryption | | | |
|
||||
| | and decryption, | | | |
|
||||
| | etc. | | | |
|
||||
+----------+---------------------+---------------------+---------------+---------------------+
|
||||
| pkcs12 | Provides functions | PKCS #12 | lib/pkcs12 | pkcs12t.h, |
|
||||
| | and types for | | | pkcs12.h, |
|
||||
| | encoding and | | | p12plcy.h, p12.h, |
|
||||
| | decoding PKCS #12 | | | p12t.h |
|
||||
| | data. PKCS #12 can | | | |
|
||||
| | be used to encode | | | |
|
||||
| | keys, and | | | |
|
||||
| | certificates, for | | | |
|
||||
| | export or import | | | |
|
||||
| | into other | | | |
|
||||
| | applications. | | | |
|
||||
+----------+---------------------+---------------------+---------------+---------------------+
|
||||
| pkcs7 | Provides functions | PKCS #7 | lib/pkcs7 | secmime.h, |
|
||||
| | and types for | | | secpkcs7.h, |
|
||||
| | encoding and | | | pkcs7t.h |
|
||||
| | decoding encrypted | | | |
|
||||
| | data in PKCS #7 | | | |
|
||||
| | format. For | | | |
|
||||
| | example, PKCS #7 is | | | |
|
||||
| | used to encrypt | | | |
|
||||
| | certificate data to | | | |
|
||||
| | exchange between | | | |
|
||||
| | applications, or to | | | |
|
||||
| | encrypt S/MIME | | | |
|
||||
| | message data. | | | |
|
||||
+----------+---------------------+---------------------+---------------+---------------------+
|
||||
| softoken | Provides a software | PKCS #11: | lib/softoken | keydbt.h, keylow.h, |
|
||||
| | implementation of a | implementation | | keytboth.h, |
|
||||
| | PKCS #11 module. | | | keytlow.h, |
|
||||
| | | | | secpkcs5.h, |
|
||||
| | | | | pkcs11.h, |
|
||||
| | | | | pkcs11f.h, |
|
||||
| | | | | pkcs11p.h, |
|
||||
| | | | | pkcs11t.h, |
|
||||
| | | | | pkcs11u.h |
|
||||
+----------+---------------------+---------------------+---------------+---------------------+
|
||||
| ssl | Provides an | SSL | lib/ssl | ssl.h, sslerr.h, |
|
||||
| | implementation of | | | sslproto.h, |
|
||||
| | the SSL protocol | | | preenc.h |
|
||||
| | using NSS and NSPR. | | | |
|
||||
+----------+---------------------+---------------------+---------------+---------------------+
|
||||
| secutil | Provides utility | Utility for any | lib/util | base64.h, |
|
||||
| | functions and data | Layer | | ciferfam.h, |
|
||||
| | types used by other | | | nssb64.h, |
|
||||
| | libraries. The | | | nssb64t.h, |
|
||||
| | library supports | | | nsslocks.h, |
|
||||
| | base-64 | | | nssrwlk.h, |
|
||||
| | encoding/decoding, | | | nssrwlkt.h, |
|
||||
| | reader-writer | | | portreg.h, |
|
||||
| | locks, the SECItem | | | pqgutil.h, |
|
||||
| | data type, DER | | | secasn1.h, |
|
||||
| | encoding/decoding, | | | secasn1t.h, |
|
||||
| | error types and | | | seccomon.h, |
|
||||
| | numbers, OID | | | secder.h, |
|
||||
| | handling, and | | | secdert.h, |
|
||||
| | secure random | | | secdig.h, |
|
||||
| | number generation. | | | secdigt.h, |
|
||||
| | | | | secitem.h, |
|
||||
| | | | | secoid.h, |
|
||||
| | | | | secoidt.h, |
|
||||
| | | | | secport.h, |
|
||||
| | | | | secrng.h, |
|
||||
| | | | | secrngt.h, |
|
||||
| | | | | secerr.h, |
|
||||
| | | | | watcomfx.h |
|
||||
+----------+---------------------+---------------------+---------------+---------------------+
|
||||
|
||||
.. _naming_conventions:
|
||||
|
||||
`Naming Conventions <#naming_conventions>`__
|
||||
--------------------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
This section describes the rules that (ideally) should be followed for naming and identifying new
|
||||
files, functions, and data types.
|
||||
|
||||
.. _cvs_id:
|
||||
|
||||
`CVS ID <#cvs_id>`__
|
||||
~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
Each file should include a CVS ID string for identification. The preferred format is:
|
||||
|
||||
.. code::
|
||||
|
||||
"@(#) $RCSfile: nss-guidelines.html,
|
||||
v $ $Revision: 48936 $ $Date: 2009-08-11 07:45:57 -0700 (Tue, 11 Aug 2009) $ $Name$"
|
||||
|
||||
You can put the string in a comment or in a static char array. Use #ifdef DEBUG to include the
|
||||
array in debug builds only. The advantage of using an array is that you can use strings(1) to
|
||||
pull the ID tags out of a (debug) compiled library. You can even put them in header files; the
|
||||
header files are protected from double inclusion. The only catch is that you have to determine
|
||||
the name of the array.
|
||||
|
||||
Here is an example from lib/base/baset.h:
|
||||
|
||||
.. code::
|
||||
|
||||
#ifdef DEBUG
|
||||
static const char BASET_CVS_ID[] = "@(#) $RCSfile: nss-guidelines.html,
|
||||
v $ $Revision: 48936 $ $Date: 2009-08-11 07:45:57 -0700 (Tue, 11 Aug 2009) $ $Name$";
|
||||
#endif /* DEBUG */
|
||||
|
||||
The difference, between this and Id, is that Id has some useless information (*every* file is
|
||||
"experimental"), and doesn't have Name. Name is the tag (if any) from which this file was pulled.
|
||||
If you're good with tagging your releases, and then checking out (or exporting!) from the tag for
|
||||
your build, this saves you from messing around with specific files revision numbers.
|
||||
|
||||
.. _header_files:
|
||||
|
||||
`Header Files <#header_files>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
| We have a preferred naming system for include files. We had been moving towards one, for some
|
||||
time, but for the NSS 3.0 project we finally wrote it down.
|
||||
|
|
||||
|
||||
========================= =========== ===================
|
||||
\ Data Types Function Prototypes
|
||||
Public nss____t.h nss____.h
|
||||
Friend (only if required) nss____tf.h nss____f.h
|
||||
NSS-private \____t.h \____.h
|
||||
Module-private \____tm.h \____m.h
|
||||
========================= =========== ===================
|
||||
|
||||
The files on the right include the files to their left; the files in a row include the files
|
||||
directly above them. Header files always include what they need; the files are protected against
|
||||
double inclusion (and even double opening by the compiler).
|
||||
|
||||
.. note::
|
||||
|
||||
Note: It's not necessary all eight files exist. Further, this is a simple ideal, and often
|
||||
reality is more complex.
|
||||
|
||||
We would like to keep names to 8.3, even if we no longer support win16. This usually gives us
|
||||
four characters to identify a module of NSS.
|
||||
|
||||
In short:
|
||||
|
||||
#. Header files for consumption outside NSS start with "nss."
|
||||
#. Header files with types have a trailing "t", header files with prototypes don't.
|
||||
"extern" declarations of data also go in the prototypes files.
|
||||
#. "Friend" headers are for things that we really wish weren't used by non-NSS code, but which
|
||||
are. Those files have a trailing "f," and their use should be deprecated.
|
||||
#. "Module" headers are for things used only within a specific subset of NSS; things which would
|
||||
have been "static" if we had combined separate C source files together. These header files
|
||||
have a trailing "m."
|
||||
|
||||
.. _functions_and_types:
|
||||
|
||||
`Functions and Types <#functions_and_types>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
There are a number of ways of doing things in our API, as well as naming decisions for functions
|
||||
that can affect the usefulness of our library. If our library is self-consistent with how we
|
||||
accomplish these tasks, it makes it easier for the developer to learn how to use our functions.
|
||||
This section of the document should grow as we develop our API.
|
||||
|
||||
First some general rules. These rules are derived from existing coding practices inside the
|
||||
security library, since consistency is more important than debates about what might look nice.
|
||||
|
||||
#. **Public functions** should have the form LAYER_Body(), where LAYER is an all caps prefix for
|
||||
what layer the function lives in, and Body is concatenated English words, where the beginning
|
||||
letter of each word is capitalized (also known as
|
||||
`CamelCase <https://en.wikipedia.org/wiki/Camel_case>`__). For Example:
|
||||
LAYER_CapitalizedEnglishWords() or CERT_DestroyCertificate().
|
||||
#. **Data types** and typdefs should have the Form LAYERBody, with the same definitions for LAYER
|
||||
as public functions, and Body in camel case English words. For example:
|
||||
LAYERCapitalizedEnglishWords or SECKEYPrivateKey.
|
||||
#. **Structures** should have the same name as their typedefs, with the string Str added to the
|
||||
end. For example LAYERCapitalizedEnglishWordsStr or SECKEYPrivateKeyStr.
|
||||
#. **Private functions** should have the form layer_Body(), where layer is the all lower case
|
||||
prefix for what layer the function lives in, and Body is camel case English words. Private
|
||||
functions include functions that may be "public" in a C sense, but are not exported out of the
|
||||
layer. For example: layer_CapitalizedEnglishWords() or pk11_GenerateKeyID().
|
||||
#. **Public macros** should have the form LAYER_BODY(), where LAYER is an all caps prefix for
|
||||
what layer the macro lives in, and BODY is English words, all in upper case, separated by
|
||||
underscores. For example: LAYER_UPPER_CASE_ENGLISH_WORDS() or DER_CONVERT_BIT_STRING().
|
||||
#. **Structure members** for exposed data structures should have the form capitalizedEnglishWords
|
||||
(the first letter uncapitalized). For example: PK11RSAGenParamsStr.\ **keySizeInBits**
|
||||
#. For **members of enums**, our current API has no standard (typedefs for enums should follow
|
||||
the Data types standard). There seem to be three reasonable options:
|
||||
|
||||
#. Enum members have the same standard as exposed data structure members.
|
||||
#. Enum members have the same standard as data types.
|
||||
#. Enum members have the same standard as public macros (minus the '()' of course).
|
||||
|
||||
Options 2 and 3 are the more preferred options. Option 1, currently the most common used for
|
||||
enums, actually creates namespace pollution.
|
||||
#. **Callback functions**, and functions used in function tables, should have a typedef used to
|
||||
define the complete signature of the given function. Function typedefs should have the
|
||||
following format: LAYERBody(), with the same definitions for LAYER as public functions, and
|
||||
Body is camel case English words. For example: LAYERCapitalizedEnglishWords or
|
||||
SECKEYPrivateKey.
|
||||
|
||||
.. _opaque_data_structures:
|
||||
|
||||
`Opaque Data Structures <#opaque_data_structures>`__
|
||||
----------------------------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
There are many data structures in the security library whose definition is effectively private,
|
||||
to the portion of the security library that defines and operates on those data structures.
|
||||
External code does not have access to these definitions. The goal here is to increase the
|
||||
opaqueness of these structures. This will allow us to modify the size, definition, and format of
|
||||
these data structures in future releases, without interfering with the operation of existing
|
||||
applications that use the security library.
|
||||
|
||||
The first task is to ensure the data structure definition lives in a private header file, while
|
||||
its declaration lives in the public. The current standard in the security library is to typedef
|
||||
the data structure name, the easiest way to accomplish this would be to add the typedef to the
|
||||
public header file.
|
||||
|
||||
For example, for the structure SECMyOpaqueData you would add:
|
||||
|
||||
.. code::
|
||||
|
||||
typedef struct SECMyOpaqueDataStr SECMyOpaqueData;
|
||||
|
||||
and add the actual structure definition to the private header file. In this same example:
|
||||
|
||||
.. code::
|
||||
|
||||
struct SECMyOpaqueDataStr {
|
||||
unsigned long myPrivateData1;
|
||||
unsigned long myPrivateData2;
|
||||
char *myName;
|
||||
};
|
||||
|
||||
the second task is to determine if individual data fields, within the data structure, are part of
|
||||
the API. One example may be the peerCert field, in an SSL data structure. Accessor functions, for
|
||||
these data elements, should be added to the API.
|
||||
|
||||
There can be legitimate exceptions to this 'make everything opaque' rule. For example, in
|
||||
container structures, such as SECItem, or maybe linked list data structures. These data
|
||||
structures need to be examined on a case by case basis, to determine if
|
||||
|
||||
#. They are truly stable and will not change in future release
|
||||
#. It is necessary for the callers of the API to know the size of these structures, as they may
|
||||
allocate new ones and pass them down.
|
||||
|
||||
.. _memory_allocation_with_arenas:
|
||||
|
||||
`Memory Allocation with Arenas <#memory_allocation_with_arenas>`__
|
||||
------------------------------------------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
This section discusses memory allocation using arenas. NSS code uses arenas, and this section
|
||||
explains some of the improvements we are making.
|
||||
|
||||
NSS makes use of traditional memory allocation functions, wrapping NSPR's PR_Alloc in a util
|
||||
function called PORT_Alloc. Though NSS makes further use of an NSPR memory-allocation facility
|
||||
which uses 'Arenas' and 'ArenaPools'. This was added via javascript; a fast, lightweight,
|
||||
non-thread-safe (though 'free-threaded') implementation.
|
||||
|
||||
Experience shows that users of the security library expect arenas to be threadsafe, so we added
|
||||
locking, and other useful changes.
|
||||
|
||||
- There has always been confusion as to the difference between Arenas and ArenaPools. We will
|
||||
simplify down to one logical 'memory bucket' type. Consensus called this type NSSArena.
|
||||
- We have lots of code which takes an optional arena pointer, using the arena if there is one,
|
||||
or alternatively the heap if there isn't. Therefore, we wrap that logic into the allocators.
|
||||
Knowing what to then free does takes discipline not to leak memory, but it simplifies things a
|
||||
lot. Also, the implementation of free works (doesn't crash), no matter if from an arena, or
|
||||
the heap, as long as from our allocators. Combined with purify, this also helps us catch cases
|
||||
where things being allocated by one allocator are freed by another, which is a common Windows
|
||||
pitfall.
|
||||
- The security code often wants to be sure to zero memory, when it's being freed; we'll add it
|
||||
to the primitives to deal with.
|
||||
|
||||
The ARENA_THREADMARK preprocessor definition (default in debug builds), and code it encloses,
|
||||
will add some checking for the following situation:
|
||||
|
||||
#. Thread A marks the arena, and allocates some memory from it.
|
||||
#. Thread B allocates some memory from the arena.
|
||||
#. Thread A releases the arena back to the mark.
|
||||
#. Thread B now finds itself with a pointer to released data.
|
||||
#. Some thread -- doesn't matter which -- allocates some data from the arena; this may overlap
|
||||
the chunk thread B has.
|
||||
#. Boom!
|
||||
|
||||
Threadmark code notes the thread ID, whenever an arena is marked, and disallows any allocations
|
||||
or marks by any other thread. (Frees are allowed.)
|
||||
|
||||
The ARENA_DESTRUCTOR_LIST preprocessor definition, and the code it encloses, are an effort to
|
||||
make the following work together:
|
||||
|
||||
#. Arenas, letting you allocate stuff and then removing them all at once
|
||||
#. Lazy creation of pure-memory objects from ASN.1 blobs, for example use of NSSPKIXCertificate
|
||||
doesn't drag all the code in for all constituent objects, unless they're actually being used
|
||||
#. Our agressive pointer-tracking facility
|
||||
|
||||
All these are useful, but they don't combine well. Now some of the pointer-tracking pressure has
|
||||
eased off, we can drop its use when it becomes too difficult.
|
||||
|
||||
Many routines are defined to take an NSSArena \*arenaOpt argument. This means if an arena is
|
||||
specified (non-null), it is used, otherwise (null) the routine uses the heap. You can think of
|
||||
the heap as a default arena you can't destroy.
|
||||
|
||||
.. _error_handling:
|
||||
|
||||
`Error Handling <#error_handling>`__
|
||||
------------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
NSS 3.0 introduces the concept of an error stack. When something goes wrong, the call stack
|
||||
unwinds, with routines returning an error indication. Each level which flags a problem, adds its
|
||||
own error number to the stack. At the bottom of the stack is the fundamental error, for example:
|
||||
file not found, and on top is an error precisely relating to what you are doing.
|
||||
|
||||
.. note::
|
||||
|
||||
Note: Error stacks are vertical, and never horizontal. If multiple things go wrong
|
||||
simultaneously, and you want to report them all, use another mechanism.
|
||||
|
||||
Errors, though not integers, are done as external constants, instead of preprocessor definitions.
|
||||
This is so any additional error doesn't trigger the entire tree to rebuild. Likewise, the
|
||||
external references to errors are made in the prototypes files, with the functions which can
|
||||
return them. Error stacks are thread-private.
|
||||
|
||||
The usual semantic is that public routines clear the stack first, private routines don't.
|
||||
Usually, every public routine has a private counterpart, and the implementation of the public
|
||||
routine looks like this:
|
||||
|
||||
.. code::
|
||||
|
||||
NSSImplement rv *
|
||||
NSSType_Method
|
||||
(
|
||||
NSSType *t,
|
||||
NSSFoo *arg1,
|
||||
NSSBar *arg2
|
||||
)
|
||||
{
|
||||
nss_ClearErrorStack();
|
||||
|
||||
#ifdef DEBUG
|
||||
if( !nssFoo_verifyPointer(arg1) ) return (rv *)NULL;
|
||||
if( !nssBar_verifyPointer(arg2) ) return (rv *)NULL;
|
||||
#endif /* DEBUG */
|
||||
|
||||
return nssType_Method(t, arg1, arg2);
|
||||
}
|
||||
|
||||
Aside from error cases, all documented entry points should check pointers in a debug, wherever
|
||||
possible. Pointers to user-supplied buffers, and templates, should be checked against NULL.
|
||||
Pointers to context-style functions should be checked using special debug macros. These macros
|
||||
only define code when DEBUG is turned on, providing a way for systems to register, deregister,
|
||||
and check valid pointers.
|
||||
|
||||
SECPORT_DECL_PTR_CLASS(*classname*, *size*) - declare a class of pointers (labelled *classname*)
|
||||
this object file needs to check. This class is local only to this object file. *Size* is the
|
||||
expected number of pointers of type *classname*.
|
||||
|
||||
SECPORT_DECL_GLOBAL_PTR_CLASS(*classname*, *size*) - same as above except *classname* can be used
|
||||
in other object files.
|
||||
|
||||
SECPORT_ADD_POINTER(*classname*, *pointer*) - Add *pointer* as a valid pointer for
|
||||
class\ *classname*. This is usually called by a Create function.
|
||||
|
||||
SECPORT_VERIFY_POINTER(*classname*, *pointer*, *secError*, *returnValue*)- Check if a given
|
||||
*pointer* really belongs to the requested class. If it doesn't set the error *secError* and
|
||||
return the value *returnValue*.
|
||||
|
||||
SECPORT_REMOVE_POINTER(*classname*, *pointer*) - Remove a pointer from the valid list. Usually
|
||||
called by a destroy function.
|
||||
|
||||
Finally, error logging should be added an documented when debug is turned on. Interfaces for
|
||||
these are in NSPR.
|
||||
|
||||
.. _thread_safety:
|
||||
|
||||
`Thread Safety <#thread_safety>`__
|
||||
----------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
Code developed using the NSS APIs needs to make use of thread safety features. First to examine
|
||||
is **object creation** and **deletion**.
|
||||
|
||||
Object creation is usually not a problem. No other threads have access to allocated memory just
|
||||
created. Exceptions to this include objects which are created on the fly, or as global objects.
|
||||
|
||||
Deletion, on the other hand, may be trickier. Threads may be referencing the object at the same
|
||||
time a another thread tries to delete it. The semantics depend on the way the application uses
|
||||
the object, also how and when the application wants to destroy it. For some data structures, this
|
||||
problem can be removed by protected reference counting. The object does not disappear until all
|
||||
users have released it.
|
||||
|
||||
Next we examine **global data**, including function local static structures. Just initialized,
|
||||
and never to be changed global data, does not need to protection from mutexes. We should also
|
||||
determine if global data should be moved to a session context (see `session
|
||||
context <#sessioncontext>`__ and `global effects <#globaleffects>`__ below).
|
||||
|
||||
.. note::
|
||||
|
||||
Note: Permanent objects, like data in files, databases, tokens, etc. should be treated as
|
||||
global data. Global data which is changed rarely, should be protected by reader/writer locks.
|
||||
|
||||
Aside from global data, **allocated data** that gets modified needs to be examined. Data that's
|
||||
just been allocated, within a function, is safe to modify. No other code has access to that data
|
||||
pointer. Once that data pointer is made visible to the 'outside', either by returning the
|
||||
pointer, or attaching the pointer to an existing visible data structure, access to the data
|
||||
should be protected. Data structures that are read only, like SECKEYPublicKeys or PK11SymKeys,
|
||||
need not be protected.
|
||||
|
||||
Many of the data structures in the security code contain some sort of **session state** or
|
||||
**session context**. These data structures may be accessed without data protection as long as:
|
||||
|
||||
#. This semantic is documented in the functions which use these data structures.
|
||||
#. These data structures are used for single streams, and not reused.
|
||||
|
||||
Examples of these data in structures may include things like the PKCS #7 ContentInfo structure.
|
||||
Example code should be included in the documentation, to show how to safely use these data
|
||||
objects.
|
||||
|
||||
A major type of global and allocated data that should be examined is various **data on lists**.
|
||||
Queued, linked, and hash table stored objects should be examined with special care. Make sure
|
||||
adding, removing, accessing, and destroying these objects are all safe operations.
|
||||
|
||||
There are a number of strategies, and entire books about how to safely access data on lists. Some
|
||||
simple strategies and their issues:
|
||||
|
||||
- **Use hash tables:** Hash table lookups are usually quite fast, limiting the contention on the
|
||||
lock. This is best for large lists of objects. Be sure to calculate the hash value first, then
|
||||
only lock over the hash table value itself. Be sure to increment the reference count, on the
|
||||
returned object, before unlocking. Examples of hash tables can be found in
|
||||
security/nss/lib/certdb/pcertdb.c
|
||||
- **Lock over the entire search:** For small linked listed, queues, or arrays, you can lock over
|
||||
the entire search. This strategy is best when lists are short, or even better if lists are
|
||||
relatively read only (they don't change very often) and using reader/writer locks.
|
||||
- **Copy the linked list:** Instead of operating on the global list, you can copy the list. This
|
||||
also requires small lists.
|
||||
- **Lock over single element with retry:** For medium sized lists, you can secure the reference
|
||||
to each element, complete a test, then detect if the given element has been removed from the
|
||||
list. In the case of removal, the search can either be either restarted, or terminated. This
|
||||
method is a more complicated than the other methods: requiring the calling of search code
|
||||
tolerant to often repeated element inspection.
|
||||
- Examples of the previous strategies can be found in
|
||||
`security/nss/lib/pk11wrap/pk11slot.c. <https://searchfox.org/mozilla-central/source/security/nss/lib/pk11wrap/pk11slot.c>`__
|
||||
|
||||
Where possible use the NSPR list primitives. From these you can even set up SECUtil style
|
||||
thread-safe lists that use some combination of the above strategies.
|
||||
|
||||
In order to be fully thread safe, your code must understand the semantics of the **service
|
||||
functions** it calls, and whether they are thread safe. For now, we should internally document
|
||||
which service functions we call, and how we expect them to behave in a threaded environment.
|
||||
|
||||
Finally, from an API point of view, we should examine functions which have **global effects**.
|
||||
Functions like XXX_SetDefaultYYY(); should not operate on global data, particularly if they may
|
||||
be called multiple times, to provide different semantics for different operations. For example,
|
||||
the following should be avoided :
|
||||
|
||||
- SEC_SetKey(keyForOperation);
|
||||
SEC_Encrypt(Data,Length);
|
||||
|
||||
Instead, a context handle should be created, and the SEC_SetKey() function, above, made on that
|
||||
handle. Fortunately most of the existing API has the correct semantics.
|
||||
|
||||
The exception to this global effects rule may be functions which set global state for an
|
||||
application at initialization time.
|
||||
|
||||
.. _methodsfunctions_design:
|
||||
|
||||
`Methods/Functions Design <#methodsfunctions_design>`__
|
||||
-------------------------------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
.. _init_shutdown_functions:
|
||||
|
||||
`Init, Shutdown Functions <#init_shutdown_functions>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
If a layer has some global initialization tasks, which need to be completed before the layer can
|
||||
be used, that layer should supply an initialization function of the form LAYER_Init(). If an
|
||||
initialization function is supplied, a corresponding LAYER_Shutdown() function should also be
|
||||
supplied. LAYER_INIT() should increment a count of the number of times it is called, and
|
||||
LAYER_Shutdown() should decrement that count, and shutdown when the count reaches '0'.
|
||||
|
||||
.. _open_close_functions:
|
||||
|
||||
`Open, Close Functions <#open_close_functions>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
Open functions should have a corresponding close function. Open and close function are not
|
||||
reference counted, like init and shutdown functions.
|
||||
|
||||
.. _creation_functions:
|
||||
|
||||
`Creation Functions <#creation_functions>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
In general, data objects should all have functions which create them. These functions should have
|
||||
the form LAYER_CreateDataType[FromDataType](). For instance generating a new key would change
|
||||
from PK11_KeyGen() to PK11_CreateSymKey().
|
||||
|
||||
.. _destruction_functions:
|
||||
|
||||
`Destruction Functions <#destruction_functions>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
In the security library we have 3 different ways of saying 'get rid of this data object': Free,
|
||||
Delete, and Destroy.
|
||||
|
||||
It turns out there are several different semantics of getting rid of a data object too:
|
||||
|
||||
#. decrement the reference count, and when the object goes to '0' free/delete/destroy it
|
||||
#. destroy it right now, this very instance, not matter what
|
||||
#. make any permanent objects associated with this data object go away
|
||||
#. a combination of 1 and 3, or 2 and 3
|
||||
|
||||
Unfortunately, within the security library Free, Delete, and Destroy are all used
|
||||
interchangeably, for all sorts of object destruction. For instance, CERT_DestroyCertificate() is
|
||||
type 1, PK11_DestroySlot() is type 2, and PK11_DestroyTokenObject() is type 3.
|
||||
|
||||
.. note::
|
||||
|
||||
Note: In non-reference counted functions, types 1 and 2 are the same.
|
||||
|
||||
We are standardizing on the following definitions:
|
||||
|
||||
Destroy - means #1 for reference counted objects, #2 for non reference counted objects.
|
||||
|
||||
Delete - means #3.
|
||||
|
||||
This has the advantage of *not* surfacing the reference countedness of a data object. If you own
|
||||
a pointer to an object, you must always destroy it. There is no way to destroy an object by
|
||||
bypassing it's reference count. Also, the signature of public destruction functions do not have
|
||||
the 'freeit' PRBool, since the structures being freed are opaque.
|
||||
|
||||
.. _dup_copy_and_reference_functions:
|
||||
|
||||
`Dup, Copy, and Reference Functions <#dup_copy_and_reference_functions>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
Functions that return a new reference or copy of a given object should have the form
|
||||
LAYER_DupDataType(). For instance, CERT_DupCertifiate() will remain the same, but
|
||||
PK11_ReferenceSlot() will become PK11_DupSlot(), and PK11_CloneContext() will become
|
||||
PK11_DupContext().
|
||||
|
||||
.. _search_functions:
|
||||
|
||||
`Search Functions <#search_functions>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
There are several different kinds of searches done via the security library. The first is a
|
||||
search for exactly one object, meeting a given criteria. These types of searches include
|
||||
CERT_FindCertByDERCert(), PK11_FindAnyCertFromDERCert(), PK11_FindKeyByCert(),
|
||||
PK11_GetBestSlot(). These functions should all have the form LAYER_FindDataType[ByDataType]().
|
||||
|
||||
The second kind of search, looks for all the objects that match a given criteria. These functions
|
||||
operate on a variety of levels. Some return allocated arrays of data, some return linked lists of
|
||||
data, others use callbacks to return data elements one at a time. Unfortunately, there are good
|
||||
reasons to maintain all these types. So here are some guidelines to make them more manageable:
|
||||
|
||||
All callback operating search functions should be in the low level of the API, if exposed at all.
|
||||
Developers dealing with SSL and PKCS #7 layers should not have to see any of these functions.
|
||||
These functions should have the form LAYER_TraverseStorageObjectOrList().
|
||||
|
||||
List and Array returning functions should be available at the higher layers of the API, most
|
||||
wrapping LAYER_Traverse() functions. They should have the form
|
||||
LAYER_LookupDataType{List|Array}[ByDataType]().
|
||||
|
||||
.. _accesssor_functions:
|
||||
|
||||
`Accesssor Functions <#accesssor_functions>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
Accessor Functions should take the following formats:
|
||||
|
||||
| LAYER_DataTypeGetElement() -- Get a specific element of a data structure.
|
||||
| LAYER_DataTypeSetElement() -- Set a specific element of a data structure.
|
||||
| LAYER_DataTypeExtractDataType() -- Get a pointer to the second data type which was derived for
|
||||
elements of the first data type.
|
||||
|
||||
Examples: PK11_SlotGetSeries(), PK11_SymKeyGetSeries(), CERT_CertificateExtractPublicKey()
|
||||
|
||||
.. _parameter_ordering:
|
||||
|
||||
`Parameter ordering <#parameter_ordering>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
Most functions will have a 'Natural' ordering for parameters. To keep consistency we should have
|
||||
some minimal parameter consistency. For most functions, they can be seen as operating on a
|
||||
particular object. This object, that the function is operating on, should come first. For
|
||||
instance, in most SSL functions this is the NSPR Socket, or the SSL Socket structure: Update,
|
||||
final, encrypt, decrypt type functions operating on their state contexts, etc.
|
||||
|
||||
All encrypt and decrypt functions, which return data inline, should have a consistent signature:
|
||||
|
||||
.. code::
|
||||
|
||||
SECStatus MY_FunctionName(MyContext *context,
|
||||
unsigned char *outBuf,
|
||||
SECBufferLen *outLen,
|
||||
SECBufferLenmaxOutLength,
|
||||
unsigned char *inBuf,
|
||||
SECBufferLeninLen)
|
||||
|
||||
Encrypt and decrypt like functions which have different properties, additional parameters,
|
||||
callbacks, etc., should insert their additional parameters between the context (first parameter)
|
||||
and the output buffer.
|
||||
|
||||
All hashing update, MACing update, and encrypt/decrypt functions which act like filters should
|
||||
have a consistent signature:
|
||||
|
||||
.. code::
|
||||
|
||||
SECStatus PK11_DigestOp(PK11Context *context,
|
||||
unsigned char *inBuf,
|
||||
SECBufferLeninLen)
|
||||
|
||||
Functions like these which have different properties, for example, additional parameters,
|
||||
callbacks, etc., should insert their additional parameters between the context (first parameter)
|
||||
and the input buffer.
|
||||
|
||||
Within your layer, multiple similar functions should have consistent parameter order.
|
||||
|
||||
.. _callback_functions:
|
||||
|
||||
`Callback Functions <#callback_functions>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
Callback functions should all contain an opaque parameter (void \*) as their first argument,
|
||||
passed by the original caller. Callbacks which are set, like SSL callbacks, should have defaults
|
||||
which provide generally useful semantics.
|
||||
|
|
@ -1,217 +0,0 @@
|
|||
.. _mozilla_projects_nss_nss_config_options:
|
||||
|
||||
NSS Config Options
|
||||
==================
|
||||
|
||||
.. _nss_config_options_format:
|
||||
|
||||
` NSS Config Options Format <#nss_config_options_format>`__
|
||||
-----------------------------------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
The specified ciphers will be allowed by policy, but an application may allow more by policy
|
||||
explicitly:
|
||||
|
||||
.. code::
|
||||
|
||||
config="allow=curve1:curve2:hash1:hash2:rsa-1024..."
|
||||
|
||||
Only the specified hashes and curves will be allowed:
|
||||
|
||||
.. code::
|
||||
|
||||
config="disallow=all allow=sha1:sha256:secp256r1:secp384r1"
|
||||
|
||||
Only the specified hashes and curves will be allowed, and RSA keys of 2048 or more will be
|
||||
accepted, and DH key exchange with 1024-bit primes or more:
|
||||
|
||||
.. code::
|
||||
|
||||
config="disallow=all allow=sha1:sha256:secp256r1:secp384r1:min-rsa=2048:min-dh=1024"
|
||||
|
||||
A policy that enables the AES ciphersuites and the SECP256/384 curves:
|
||||
|
||||
.. code::
|
||||
|
||||
config="allow=aes128-cbc:aes128-gcm::HMAC-SHA1:SHA1:SHA256:SHA384:RSA:ECDHE-RSA:SECP256R1:SECP384R1"
|
||||
|
||||
Turn off md5
|
||||
|
||||
.. code::
|
||||
|
||||
config="disallow=MD5"
|
||||
|
||||
Turn off md5 and sha1 only for SSL
|
||||
|
||||
.. code::
|
||||
|
||||
config="disallow=MD5(SSL):SHA1(SSL)"
|
||||
|
||||
Disallow values are parsed first, and then allow values, independent of the order in which they
|
||||
appear.
|
||||
|
||||
.. code::
|
||||
|
||||
Future key words (not yet implemented):
|
||||
enable: turn on ciphersuites by default.
|
||||
disable: turn off ciphersuites by default without disallowing them by policy.
|
||||
flags: turn on the following flags:
|
||||
ssl-lock: turn off the ability for applications to change policy with
|
||||
the SSL_SetCipherPolicy (or SSL_SetPolicy).
|
||||
policy-lock: turn off the ability for applications to change policy with
|
||||
the call NSS_SetAlgorithmPolicy.
|
||||
ssl-default-lock: turn off the ability for applications to change cipher
|
||||
suite states with SSL_EnableCipher, SSL_DisableCipher.
|
||||
|
||||
.. rubric:: ECC Curves
|
||||
:name: ecc_curves
|
||||
|
||||
|
|
||||
| PRIME192V1
|
||||
| PRIME192V2
|
||||
| PRIME192V3
|
||||
| PRIME239V1
|
||||
| PRIME239V2
|
||||
| PRIME239V3
|
||||
| PRIME256V1
|
||||
| SECP112R1
|
||||
| SECP112R2
|
||||
| SECP128R1
|
||||
| SECP128R2
|
||||
| SECP160K1
|
||||
| SECP160R1
|
||||
| SECP160R2
|
||||
| SECP192K1
|
||||
| SECP192R1
|
||||
| SECP224K1
|
||||
| SECP256K1
|
||||
| SECP256R1
|
||||
| SECP384R1
|
||||
| SECP521R1
|
||||
| C2PNB163V1
|
||||
| C2PNB163V2
|
||||
| C2PNB163V3
|
||||
| C2PNB176V1
|
||||
| C2TNB191V1
|
||||
| C2TNB191V2
|
||||
| C2TNB191V3
|
||||
| C2ONB191V4
|
||||
| C2ONB191V5
|
||||
| C2PNB208W1
|
||||
| C2TNB239V1
|
||||
| C2TNB239V2
|
||||
| C2TNB239V3
|
||||
| C2ONB239V4
|
||||
| C2ONB239V5
|
||||
| C2PNB272W1
|
||||
| C2PNB304W1
|
||||
| C2TNB359V1
|
||||
| C2PNB368W1
|
||||
| C2TNB431R1
|
||||
| SECT113R1
|
||||
| SECT131R1
|
||||
| SECT131R1
|
||||
| SECT131R2
|
||||
| SECT163K1
|
||||
| SECT163R1
|
||||
| SECT163R2
|
||||
| SECT193R1
|
||||
| SECT193R2
|
||||
| SECT233K1
|
||||
| SECT233R1
|
||||
| SECT239K1
|
||||
| SECT283K1
|
||||
| SECT283R1
|
||||
| SECT409K1
|
||||
| SECT409R1
|
||||
| SECT571K1
|
||||
| SECT571R1
|
||||
|
||||
.. rubric:: Hashes
|
||||
:name: hashes
|
||||
|
||||
|
|
||||
| MD2
|
||||
| MD4
|
||||
| MD5
|
||||
| SHA1
|
||||
| SHA224
|
||||
| SHA256
|
||||
| SHA384
|
||||
| SHA512
|
||||
|
||||
.. rubric:: MACS
|
||||
:name: macs
|
||||
|
||||
| HMAC-SHA1
|
||||
| HMAC-SHA224
|
||||
| HMAC-SHA256
|
||||
| HMAC-SHA384
|
||||
| HMAC-SHA512
|
||||
| HMAC-MD5
|
||||
|
||||
.. rubric:: Ciphers
|
||||
:name: ciphers
|
||||
|
||||
| AES128-CBC
|
||||
| AES192-CBC
|
||||
| AES256-CBC
|
||||
| AES128-GCM
|
||||
| AES192-GCM
|
||||
| AES256-GCM
|
||||
| CAMELLIA128-CBC
|
||||
| CAMELLIA192-CBC
|
||||
| CAMELLIA256-CBC
|
||||
| SEED-CBC
|
||||
| DES-EDE3-CBC
|
||||
| DES-40-CBC
|
||||
| DES-CBC
|
||||
| NULL-CIPHER
|
||||
| RC2
|
||||
| RC4
|
||||
| IDEA
|
||||
|
||||
.. rubric:: SSL Key exchanges
|
||||
:name: ssl_key_exchanges
|
||||
|
||||
| RSA
|
||||
| RSA-EXPORT
|
||||
| DHE-RSA
|
||||
| DHE-DSS
|
||||
| DH-RSA
|
||||
| DH-DSS
|
||||
| ECDHE-ECDSA
|
||||
| ECDHE-RSA
|
||||
| ECDH-ECDSA
|
||||
| ECDH-RSA
|
||||
|
||||
.. rubric:: Restrictions for asymmetric keys (integers)
|
||||
:name: restrictions_for_asymmetric_keys_(integers)
|
||||
|
||||
| RSA-MIN
|
||||
| DH-MIN
|
||||
| DSA-MIN
|
||||
|
||||
.. rubric:: Constraints on SSL Protocols Versions (integers)
|
||||
:name: constraints_on_ssl_protocols_versions_(integers)
|
||||
|
||||
| TLS-VERSION-MIN
|
||||
| TLS-VERSION-MAX
|
||||
|
||||
.. rubric:: Constraints on DTLS Protocols Versions (integers)
|
||||
:name: constraints_on_dtls_protocols_versions_(integers)
|
||||
|
||||
| DTLS-VERSION-MIN
|
||||
| DTLS-VERSION-MAX
|
||||
|
||||
.. rubric:: Policy flags for algorithms
|
||||
:name: policy_flags_for_algorithms
|
||||
|
||||
| SSL
|
||||
| SSL-KEY-EXCHANGE
|
||||
| KEY-EXCHANGE
|
||||
| CERT-SIGNATURE
|
||||
| SIGNATURE
|
||||
| ALL
|
||||
| NONE
|
||||
|
|
@ -1,277 +0,0 @@
|
|||
.. _mozilla_projects_nss_nss_developer_tutorial:
|
||||
|
||||
NSS Developer Tutorial
|
||||
======================
|
||||
|
||||
.. _nss_coding_style:
|
||||
|
||||
`NSS Coding Style <#nss_coding_style>`__
|
||||
----------------------------------------
|
||||
|
||||
`Formatting <#formatting>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
**Line length** should not exceed 80 characters.
|
||||
|
||||
**Indentation level** is 4.
|
||||
|
||||
**Tabs** are used heavily in many NSS source files. Try to stay consistent when you modify
|
||||
existing code. The proper use of tabs has often been confusing for new NSS developers, so in
|
||||
``nss/lib/ssl``, we're gradually removing the use of tabs.
|
||||
|
||||
**Curly braces**: both of the following styles are allowed:
|
||||
|
||||
.. code::
|
||||
|
||||
if (condition) {
|
||||
action1();
|
||||
} else {
|
||||
action2();
|
||||
}
|
||||
|
||||
Or:
|
||||
|
||||
.. code::
|
||||
|
||||
if (condition)
|
||||
{
|
||||
action1();
|
||||
}
|
||||
else
|
||||
{
|
||||
action2();
|
||||
}
|
||||
|
||||
The former style is more common. When modifying existing code, try to stay consistent. In new
|
||||
code, prefer the former style, as it conserves vertical space.
|
||||
|
||||
When a block of code consists of a single statement, NSS doesn’t require curly braces, so both of
|
||||
these examples are fine:
|
||||
|
||||
.. code::
|
||||
|
||||
if (condition) {
|
||||
action();
|
||||
}
|
||||
|
||||
Or:
|
||||
|
||||
.. code::
|
||||
|
||||
if (condition)
|
||||
action();
|
||||
|
||||
although the use of curly braces is more common.
|
||||
|
||||
**Multiple-line comments** should be formatted as follows:
|
||||
|
||||
.. code::
|
||||
|
||||
/*
|
||||
* Line1
|
||||
* Line2
|
||||
*/
|
||||
|
||||
or
|
||||
|
||||
.. code::
|
||||
|
||||
/*
|
||||
** Line 1
|
||||
** Line 2
|
||||
*/
|
||||
|
||||
The following styles are also common, because they conserve vertical space:
|
||||
|
||||
.. code::
|
||||
|
||||
/* Line1
|
||||
* Line2
|
||||
*/
|
||||
|
||||
or
|
||||
|
||||
.. code::
|
||||
|
||||
/* Line1
|
||||
** Line2
|
||||
*/
|
||||
|
||||
or
|
||||
|
||||
.. code::
|
||||
|
||||
/* Line1
|
||||
* Line2 */
|
||||
|
||||
`Naming <#naming>`__
|
||||
~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
Public functions are named ``FOO_DoOneAction``.
|
||||
|
||||
Global, but unexported functions, are usually named ``foo_DoOneAction``.
|
||||
|
||||
Variable, and function parameter names, always start with a lowercase letter. The most common
|
||||
style is ``fooBarBaz``, although ``foobarbaz`` and ``foo_bar_baz`` are also used.
|
||||
|
||||
`Miscellaneous <#miscellaneous>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
**goto** can be used, to simplify resource deallocation, before returning from a function.
|
||||
|
||||
A data buffer is usually represented as:
|
||||
|
||||
.. code:: c
|
||||
|
||||
unsigned char *data;
|
||||
unsigned int len;
|
||||
|
||||
The buffer pointer is ``unsigned char *``, as opposed to ``void *``, so we can perform pointer
|
||||
arithmetic without casting. Use ``char *`` only if the data is interpreted as text characters.
|
||||
|
||||
For historical reasons, the buffer length is ``unsigned int``, as opposed to ``size_t``.
|
||||
Unfortunately, this can be a source of integer overflow bugs on 64-bit systems.
|
||||
|
||||
.. _c_features:
|
||||
|
||||
`C Features <#c_features>`__
|
||||
----------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
NSS requires C99. However, not all features from C99 are equally available.
|
||||
|
||||
- Variables can be declared, at the point they are first used.
|
||||
- The ``inline`` keyword can be used.
|
||||
- Variadic macro arguments are permitted, but their use should be limited to using
|
||||
``__VA_ARGS__``.
|
||||
- The exact-width integer types in NSPR should be used, in preference to those declared in
|
||||
``<stdint.h>`` (which will be used by NSPR in the future).
|
||||
- Universal character names are not permitted, as are wide character types (``char16_t`` and
|
||||
``char32_t``). NSS source should only include ASCII text. Escape non-printing characters
|
||||
(with ``\x`` if there is no special escape such as \\r, \\n, and \\t) and avoid defining
|
||||
string literals that use non-ASCII characters.
|
||||
- One line comments starting with ``//`` are permitted.
|
||||
|
||||
Check with nss-dev@ before using a language feature not already used, if you are uncertain.
|
||||
Please update this list if you do.
|
||||
|
||||
These restrictions are different for C++ unit tests, which can use most C++11 features. The
|
||||
`Mozilla C++ language features
|
||||
guide <https://developer.mozilla.org/en-US/docs/Using_CXX_in_Mozilla_code>`__, and the `Chromium
|
||||
C++ usage guide <https://chromium-cpp.appspot.com/>`__, list C++ features that are known to be
|
||||
widely available and compatible. You should limit features to those that appear in both guides.
|
||||
Ask on nss-dev@ if you think this is restrictive, or if you wish to prohibit a specific feature.
|
||||
|
||||
.. _nss_c_abi_backward_compatibility:
|
||||
|
||||
`NSS C ABI backward compatibility <#nss_c_abi_backward_compatibility>`__
|
||||
------------------------------------------------------------------------
|
||||
|
||||
`Functions <#functions>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
Exported functions cannot be removed.
|
||||
|
||||
The function prototype of an exported function, cannot be changed, with these exceptions:
|
||||
|
||||
- A ``Foo *`` parameter can be changed to ``const Foo *``. This change is always safe.
|
||||
|
||||
- Sometimes an ``int`` parameter can be changed to ``unsigned int``, or an ``int *`` parameter
|
||||
can be changed to ``unsigned int *``. Whether such a change is safe needs to be reviewed on a
|
||||
case-by-case basis.
|
||||
|
||||
`Types <#types>`__
|
||||
------------------
|
||||
|
||||
`Structs <#structs>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
Members of an exported struct, cannot be reordered or removed.
|
||||
|
||||
Under certain circumstances, it is safe to add new members to an exported struct at the end.
|
||||
|
||||
Opaque structs give us complete freedom to change them, but require applications to call NSS
|
||||
functions, to allocate and free them.
|
||||
|
||||
`Enums <#enums>`__
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
The numeric values of public enumerators cannot be changed. To stress this fact, we often
|
||||
explicitly assign numeric values to enumerators, rather than relying on the values assigned by
|
||||
the compiler.
|
||||
|
||||
.. _symbol_export_lists:
|
||||
|
||||
`Symbol export lists <#symbol_export_lists>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
The ``manifest.mn`` file, in a directory in the NSS source tree, specifies which headers are
|
||||
public, and which headers are private.
|
||||
|
||||
Public headers are in the ``EXPORTS`` variable.
|
||||
|
||||
Private headers,which may be included by files in other directories, are in the
|
||||
``PRIVATE_EXPORTS`` variable.
|
||||
|
||||
Private headers, that are only included by files in the same directory, are not listed in either
|
||||
variable.
|
||||
|
||||
Only functions listed in the symbol export lists (``nss.def``, ``ssl.def``, ``smime.def``, etc.)
|
||||
are truly public functions. Unfortunately, public headers may declare private functions, for
|
||||
historical reasons. The symbol export lists are the authoritative source of public functions.
|
||||
|
||||
.. _behavioral_changes:
|
||||
|
||||
`Behavioral changes <#behavioral_changes>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
**Bug/quirk compatible**: Occasionally we cannot fix a bug, because applications may depend on
|
||||
the buggy behavior. We would need to add a new function to provide the desired behavior.
|
||||
|
||||
Similarly, **new options** often need to be disabled by default.
|
||||
|
||||
.. _nss_reviewfeature_approval_process:
|
||||
|
||||
`NSS review/feature approval process <#nss_reviewfeature_approval_process>`__
|
||||
-----------------------------------------------------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
NSS doesn’t have 'super reviewers'. We wish to increase the number of NSS developers, who have
|
||||
broad understanding of NSS.
|
||||
|
||||
One review is usually enough for the review to pass. For critical code reviews, such as a patch
|
||||
release of a stable branch, two reviews may be more reasonable.
|
||||
|
||||
For new features, especially those that appear controversial, try to find a reviewer from a
|
||||
different company or organization than your own, to avoid any perceptions of bias.
|
||||
|
||||
.. _update_nss_in_mozilla-inbound_and_mozilla-central:
|
||||
|
||||
`Update NSS in mozilla-inbound and mozilla-central <#update_nss_in_mozilla-inbound_and_mozilla-central>`__
|
||||
----------------------------------------------------------------------------------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
The procedure is documented at
|
||||
`https://developer.mozilla.org//en-US/docs/Mozilla/Developer_guide/Build_Instructions/Updating_NSPR_or_NSS_in_mozilla-central <https://developer.mozilla.org/en-US/docs/Mozilla/Developer_guide/Build_Instructions/Updating_NSPR_or_NSS_in_mozilla-central>`__.
|
||||
|
||||
If it is necessary to apply private patches, please document them in
|
||||
``<tree>/security/patches/README``.
|
||||
|
|
@ -1,126 +0,0 @@
|
|||
.. _mozilla_projects_nss_nss_release_notes_template:
|
||||
|
||||
NSS release notes template
|
||||
==========================
|
||||
|
||||
.. _draft_(remove_line_when_document_is_finished):
|
||||
|
||||
`DRAFT (remove line when document is finished) <#draft_(remove_line_when_document_is_finished)>`__
|
||||
--------------------------------------------------------------------------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
`Introduction <#introduction>`__
|
||||
--------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
| The NSS team has released Network Security Services (NSS) 3.XX, which is a minor release.
|
||||
| or
|
||||
| Network Security Services (NSS) 3.XX.y is a patch release for NSS 3.XX. The bug fixes in NSS
|
||||
3.XX.y are described in the "Bugs Fixed" section below.
|
||||
|
||||
.. _distribution_information:
|
||||
|
||||
`Distribution Information <#distribution_information>`__
|
||||
--------------------------------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
The HG tag is NSS_3_XX_RTM. NSS 3.XX requires NSPR 4.XX or newer.
|
||||
|
||||
NSS 3.XX source distributions are available on ftp.mozilla.org for secure HTTPS download:
|
||||
|
||||
- Source tarballs:
|
||||
https://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_XX_RTM/src/ (make a link)
|
||||
|
||||
.. _new_in_nss_3.xx:
|
||||
|
||||
`New in NSS 3.XX <#new_in_nss_3.xx>`__
|
||||
--------------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
.. _new_functionality:
|
||||
|
||||
`New Functionality <#new_functionality>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
either:
|
||||
|
||||
No new functionality is introduced in this release. This is a patch release to fix ...
|
||||
|
||||
or:
|
||||
|
||||
- ...
|
||||
|
||||
.. rubric:: New Functions
|
||||
:name: new_functions
|
||||
|
||||
- *in \___.h*
|
||||
|
||||
- **function** - description
|
||||
|
||||
.. rubric:: New Types
|
||||
:name: new_types
|
||||
|
||||
- *in \___.h*
|
||||
|
||||
- **type** - description.
|
||||
|
||||
.. rubric:: New Macros
|
||||
:name: new_macros
|
||||
|
||||
- *in \___.h*
|
||||
|
||||
- **macro** - description
|
||||
|
||||
.. _notable_changes_in_nss_3.xx:
|
||||
|
||||
`Notable Changes in NSS 3.XX <#notable_changes_in_nss_3.xx>`__
|
||||
--------------------------------------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
- ...
|
||||
|
||||
.. _bugs_fixed_in_nss_3.xx:
|
||||
|
||||
`Bugs fixed in NSS 3.XX <#bugs_fixed_in_nss_3.xx>`__
|
||||
----------------------------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
This Bugzilla query returns all the bugs fixed in NSS 3.XX:
|
||||
|
||||
https://bugzilla.mozilla.org/buglist.cgi?resolution=FIXED&classification=Components&query_format=advanced&product=NSS&target_milestone=3.XX
|
||||
(make a link)
|
||||
|
||||
`Acknowledgements <#acknowledgements>`__
|
||||
----------------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
The NSS development team would like to thank ... for responsibly disclosing the issue by
|
||||
providing advance copies of their research.
|
||||
|
||||
`Compatibility <#compatibility>`__
|
||||
----------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
NSS 3.XX.y shared libraries are backward compatible with all older NSS 3.x shared libraries. A
|
||||
program linked with older NSS 3.x shared libraries will work with NSS 3.XX.y shared libraries
|
||||
without recompiling or relinking. Furthermore, applications that restrict their use of NSS APIs
|
||||
to the functions listed in NSS Public Functions will remain compatible with future versions of
|
||||
the NSS shared libraries.
|
||||
|
||||
`Feedback <#feedback>`__
|
||||
------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
Bugs discovered should be reported by filing a bug report with
|
||||
`bugzilla.mozilla.org <https://bugzilla.mozilla.org/enter_bug.cgi?product=NSS>`__ (product NSS).
|
||||
|
|
@ -1,161 +0,0 @@
|
|||
.. _mozilla_projects_nss_nss_releases:
|
||||
|
||||
Release notes for recent versions of NSS
|
||||
========================================
|
||||
|
||||
.. container::
|
||||
|
||||
The current **Stable** release of NSS is 3.64, which was released on **15 April 2021**.
|
||||
(:ref:`mozilla_projects_nss_nss_3_64_release_notes`)
|
||||
|
||||
The current **ESR** releases of NSS are 3.44.4
|
||||
(:ref:`mozilla_projects_nss_nss_3_44_4_release_notes`), intended for Firefox ESR 68, which was
|
||||
released on **19 May 2020**, and 3.53.1 :ref:`mozilla_projects_nss_nss_3_53_1_release_notes`,
|
||||
intended for Firefox ESR 78, which was released on **16 June 2020**.
|
||||
|
||||
.. _past_releases:
|
||||
|
||||
`Past releases <#past_releases>`__
|
||||
----------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
- :ref:`mozilla_projects_nss_nss_3_63_1_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_63_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_62_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_61_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_60_1_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_60_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_59_1_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_59_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_58_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_57_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_56_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_55_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_54_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_53_1_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_53_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_52_1_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_44_4_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_52_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_51_1_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_51_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_50_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_49_2_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_49_1_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_49_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_48_1_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_48_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_47_1_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_47_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_46_1_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_46_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_45_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_44_3_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_44_2_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_44_1_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_44_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_43_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_42_1_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_42_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_36_8_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_36_7_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_41_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_40_1_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_36_6_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_40_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_39_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_38_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_37_3release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_37_1_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_37_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_36_5_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_36_4_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_36_2_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_36_1_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_36_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_35_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_34_1_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_34_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_33_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_32_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_31_1_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_31_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_30_2_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_30_1_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_30_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_29_5_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_29_3_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_29_2_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_29_1_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_29_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_28_5_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_28_4_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_28_3_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_28_2_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_28_1_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_28_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_27_2_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_27_1_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_27_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_26_2_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_26_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_25_1_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_25_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_24_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_23_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_22_2_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_22_1_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_22_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_21_4_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_21_3_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_21_2_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_21_1_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_21_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_20_1_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_20_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_19_3_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_19_2_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_19_1_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_19_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_18_1_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_18_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_17_4_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_17_3_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_17_2_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_17_1_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_17_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_16_6_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_16_5_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_16_4_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_16_3_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_16_2_3_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_16_2_2_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_16_2_1_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_16_2_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_16_1_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_16_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_15_5_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_15_4_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_15_3_1_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_15_3_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_15_2_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_15_1_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_15_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_14_5_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_14_4_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_14_3_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_14_2_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_14_1_release_notes`
|
||||
- :ref:`mozilla_projects_nss_nss_3_14_release_notes`
|
||||
- :ref:`mozilla_projects_nss_release_notes`
|
||||
|
||||
.. _future_releases:
|
||||
|
||||
`Future releases <#future_releases>`__
|
||||
--------------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
Release planning is done on the Mozilla wiki: `NSS:Release
|
||||
Versions <https://wiki.mozilla.org/NSS:Release_Versions>`__.
|
||||
|
|
@ -1,109 +0,0 @@
|
|||
.. _mozilla_projects_nss_jss_4_4_0_release_notes:
|
||||
|
||||
JSS 4.4.0 Release Notes
|
||||
=======================
|
||||
|
||||
`Introduction <#introduction>`__
|
||||
--------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
The Java Security Services (JSS) team has released JSS 4.4.0, which is a minor release.
|
||||
|
||||
.. _distribution_information:
|
||||
|
||||
`Distribution information <#distribution_information>`__
|
||||
--------------------------------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
The hg tag is JSS_4_4\ **\_20170313**. JSS 4.4.0 requires Netswork Security Services (NSS) 3.29.1
|
||||
and Netscape Portable Runtime (NSPR) 4.13.1 or newer.
|
||||
|
||||
JSS 4.4.0 source distributions are available on ftp.mozilla.org for secure HTTPS download:
|
||||
|
||||
- Source tarballs:
|
||||
`https://ftp.mozilla.org/pub/mozilla.org/security/jss/releases/JSS_4_4_0_RTM/src/ <https://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_30_RTM/src/>`__
|
||||
|
||||
.. _new_in_jss_4.40:
|
||||
|
||||
`New in JSS 4.40 <#new_in_jss_4.40>`__
|
||||
--------------------------------------
|
||||
|
||||
.. _new_functionality:
|
||||
|
||||
`New Functionality <#new_functionality>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
.. rubric:: New Functions
|
||||
:name: new_functions
|
||||
|
||||
New Macros
|
||||
|
||||
.. _notable_changes_in_jss_4.40:
|
||||
|
||||
`Notable Changes in JSS 4.40 <#notable_changes_in_jss_4.40>`__
|
||||
--------------------------------------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
- Picks up work done downstream for Fedora and RHEL and used by various Linux distributions with
|
||||
includes:.
|
||||
- Support for IPv6.
|
||||
- Support for TLS v1.1 and TLS v1.2 via NSS though JSS.
|
||||
|
||||
.. _bugs_fixed_in_jss_4.4.0:
|
||||
|
||||
`Bugs fixed in JSS 4.4.0 <#bugs_fixed_in_jss_4.4.0>`__
|
||||
------------------------------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
This Bugzilla query returns all the bugs fixed in NSS 4.4.0:
|
||||
|
||||
https://bugzilla.mozilla.org/buglist.cgi?product=JSS&target_milestone=4.4&target_milestone=4.4&bug_status=RESOLVED&resolution=FIXED
|
||||
|
||||
`Documentation <#documentation>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
Build instructions for JSS at https://hg.mozilla.org/projects/jss/file/tip/README
|
||||
|
||||
.. _platform_information:
|
||||
|
||||
`Platform Information <#platform_information>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
- You can check out the source from mercurial via hg clone -r 055aa3ce8a61
|
||||
https://hg.mozilla.org/projects/jss
|
||||
|
||||
- JSS 4.4.0 works with OpenJDK versions 1.7 or higher we suggest the latest - OpenJDK 1.8.
|
||||
- JSS 4.4.0 requires :ref:`mozilla_projects_nss_nss_3_12_5_release_notes` or higher though NSS
|
||||
3.28.3 is recommended.
|
||||
- JSS 4.3.1 requires `NSPR 4.7.1 <https://www.mozilla.org/projects/nspr/release-notes/>`__ or
|
||||
higher though NSPR 3.13 is recommended.
|
||||
- JSS only supports the native threading model (no green threads).
|
||||
|
||||
`Compatibility <#compatibility>`__
|
||||
----------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
JSS 3.30 shared libraries are not backward compatible with all older JSS 4.3.2 shared libraries.
|
||||
A program linked with older jSS 4.3.2 shared libraries will not work with JSS 4.4.0 shared
|
||||
libraries without recompiling or relinking. Furthermore, applications that restrict their use of
|
||||
jSS APIs to the functions listed in JSS Public Functions will remain compatible with future
|
||||
versions of the JSS shared libraries.
|
||||
|
||||
`Feedback <#feedback>`__
|
||||
------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
Bugs discovered should be reported by filing a bug report with
|
||||
`bugzilla.mozilla.org <https://bugzilla.mozilla.org/enter_bug.cgi?product=NSS>`__ (product JSS).
|
||||
|
|
@ -1,432 +0,0 @@
|
|||
.. _mozilla_projects_nss_nss_3_12_3_release_notes:
|
||||
|
||||
NSS_3.12.3_release_notes.html
|
||||
=============================
|
||||
|
||||
.. _nss_3.12.3_release_notes:
|
||||
|
||||
`NSS 3.12.3 Release Notes <#nss_3.12.3_release_notes>`__
|
||||
--------------------------------------------------------
|
||||
|
||||
.. _2009-04-01:
|
||||
|
||||
`2009-04-01 <#2009-04-01>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
Newsgroup: `mozilla.dev.tech.crypto <news://news.mozilla.org/mozilla.dev.tech.crypto>`__
|
||||
|
||||
`Contents <#contents>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
- `Introduction <#introduction>`__
|
||||
- `Distribution Information <#distribution_information>`__
|
||||
- `New in NSS 3.12.3 <#new_in_nss_3.12.3>`__
|
||||
- `Bugs Fixed <#bugs_fixed>`__
|
||||
- `Documentation <#documentation>`__
|
||||
- `Compatibility <#compatibility>`__
|
||||
- `Feedback <#feedback>`__
|
||||
|
||||
--------------
|
||||
|
||||
`Introduction <#introduction>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
Network Security Services (NSS) 3.12.3 is a patch release for NSS 3.12. The bug fixes in NSS
|
||||
3.12.3 are described in the "`Bugs Fixed <#bugs_fixed>`__" section below.
|
||||
|
||||
NSS 3.12.3 is tri-licensed under the MPL 1.1/GPL 2.0/LGPL 2.1.
|
||||
|
||||
--------------
|
||||
|
||||
.. _distribution_information:
|
||||
|
||||
`Distribution Information <#distribution_information>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
| The CVS tag for the NSS 3.12.3 release is NSS_3_12_3_RTM. NSS 3.12.3 requires `NSPR
|
||||
4.7.4 <https://www.mozilla.org/projects/nspr/release-notes/nspr474.html>`__.
|
||||
| See the `Documentation <#documentation>`__ section for the build instructions.
|
||||
|
||||
NSS 3.12.3 source and binary distributions are also available on ftp.mozilla.org for secure HTTPS
|
||||
download:
|
||||
|
||||
- Source tarballs:
|
||||
https://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_12_3_RTM/src/.
|
||||
- Binary distributions:
|
||||
https://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_12_3_RTM/. Both debug and
|
||||
optimized builds are provided. Go to the subdirectory for your platform, DBG (debug) or OPT
|
||||
(optimized), to get the tar.gz or zip file. The tar.gz or zip file expands to an nss-3.12.3
|
||||
directory containing three subdirectories:
|
||||
|
||||
- include - NSS header files
|
||||
- lib - NSS shared libraries
|
||||
- bin - `NSS Tools <https://www.mozilla.org/projects/security/pki/nss/tools/>`__ and test
|
||||
programs
|
||||
|
||||
You also need to download the NSPR 4.7.4 binary distributions to get the NSPR 4.7.4 header files
|
||||
and shared libraries, which NSS 3.12.3 requires. NSPR 4.7.4 binary distributions are in
|
||||
https://ftp.mozilla.org/pub/mozilla.org/nspr/releases/v4.7.4/.
|
||||
|
||||
--------------
|
||||
|
||||
.. _new_in_nss_3.12.3:
|
||||
|
||||
`New in NSS 3.12.3 <#new_in_nss_3.12.3>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
- Changes in behavior:
|
||||
- In the development of NSS 3.12.3, it became necessary to change some old library behaviors due
|
||||
to the discovery of certain vulnerabilities in the old behaviors, and to correct some errors
|
||||
that had limited NSS's ability to interoperate with cryptographic hardware and software from
|
||||
other sources.
|
||||
Most of these changes should cause NO problems for NSS users, but in some cases, some
|
||||
customers' software, hardware and/or certificates may be dependent on the old behaviors, and
|
||||
may have difficulty with the new behaviors. In anticipation of that, the NSS team has provided
|
||||
ways to easily cause NSS to revert to its previous behavior through the use of environment
|
||||
variables.
|
||||
Here is a table of the new environment variables introduced in NSS 3.12.3 and information
|
||||
about how they affect these new behaviors. The information in this table is excerpted from
|
||||
:ref:`mozilla_projects_nss_reference_nss_environment_variables`
|
||||
|
||||
+--------------------------------+--------------------------------+--------------------------------+
|
||||
| **Environment Variable** | **Value Type** | **Description** |
|
||||
+--------------------------------+--------------------------------+--------------------------------+
|
||||
| NSRANDCOUNT | Integer | Sets the maximum number of |
|
||||
| | (byte count) | bytes to read from the file |
|
||||
| | | named in the environment |
|
||||
| | | variable NSRANDFILE (see |
|
||||
| | | below). Makes NSRANDFILE |
|
||||
| | | usable with /dev/urandom. |
|
||||
+--------------------------------+--------------------------------+--------------------------------+
|
||||
| NSS_ALLOW_WEAK_SIGNATURE_ALG | Boolean | Enables the use of MD2 and MD4 |
|
||||
| | (any non-empty value to | hash algorithms inside |
|
||||
| | enable) | signatures. This was allowed |
|
||||
| | | by default before NSS 3.12.3. |
|
||||
+--------------------------------+--------------------------------+--------------------------------+
|
||||
| NSS_HASH_ALG_SUPPORT | String | Specifies algorithms allowed |
|
||||
| | | to be used in certain |
|
||||
| | | applications, such as in |
|
||||
| | | signatures on certificates and |
|
||||
| | | CRLs. See documentation at |
|
||||
| | | `this |
|
||||
| | | link |
|
||||
| | | <https://bugzilla.mozilla.org/ |
|
||||
| | | show_bug.cgi?id=483113#c0>`__. |
|
||||
+--------------------------------+--------------------------------+--------------------------------+
|
||||
| NSS_STRICT_NOFORK | String | It is an error to try to use a |
|
||||
| | ("1", | PKCS#11 crypto module in a |
|
||||
| | "DISABLED", | process before it has been |
|
||||
| | or any other non-empty value) | initialized in that process, |
|
||||
| | | even if the module was |
|
||||
| | | initialized in the parent |
|
||||
| | | process. Beginning in NSS |
|
||||
| | | 3.12.3, Softoken will detect |
|
||||
| | | this error. This environment |
|
||||
| | | variable controls Softoken's |
|
||||
| | | response to that error. |
|
||||
| | | |
|
||||
| | | - If set to "1" or unset, |
|
||||
| | | Softoken will trigger an |
|
||||
| | | assertion failure in debug |
|
||||
| | | builds, and will report an |
|
||||
| | | error in non-DEBUG builds. |
|
||||
| | | - If set to "DISABLED", |
|
||||
| | | Softoken will ignore forks, |
|
||||
| | | and behave as it did in |
|
||||
| | | older versions. |
|
||||
| | | - If set to any other |
|
||||
| | | non-empty value, Softoken |
|
||||
| | | will report an error in |
|
||||
| | | both DEBUG and non-DEBUG |
|
||||
| | | builds. |
|
||||
+--------------------------------+--------------------------------+--------------------------------+
|
||||
| NSS_USE_DECODED_CKA_EC_POINT | Boolean | Tells NSS to send EC key |
|
||||
| | (any non-empty value to | points across the PKCS#11 |
|
||||
| | enable) | interface in the non-standard |
|
||||
| | | unencoded format that was used |
|
||||
| | | by default before NSS 3.12.3. |
|
||||
| | | The new key point format is a |
|
||||
| | | DER encoded ASN.1 OCTET |
|
||||
| | | STRING. |
|
||||
+--------------------------------+--------------------------------+--------------------------------+
|
||||
| NSS_USE_SHEXP_IN_CERT_NAME | Boolean | Tells NSS to allow shell-style |
|
||||
| | (any non-empty value to | wildcard patterns in |
|
||||
| | enable) | certificates to match SSL |
|
||||
| | | server host names. This |
|
||||
| | | behavior was the default |
|
||||
| | | before NSS 3.12.3. The new |
|
||||
| | | behavior conforms to RFC 2818. |
|
||||
+--------------------------------+--------------------------------+--------------------------------+
|
||||
|
||||
- New Korean SEED cipher:
|
||||
|
||||
- New macros for SEED support:
|
||||
|
||||
- *in blapit.h:*
|
||||
NSS_SEED
|
||||
NSS_SEED_CBC
|
||||
SEED_BLOCK_SIZE
|
||||
SEED_KEY_LENGTH
|
||||
*in pkcs11t.h:*
|
||||
CKK_SEED
|
||||
CKM_SEED_KEY_GEN
|
||||
CKM_SEED_ECB
|
||||
CKM_SEED_CBC
|
||||
CKM_SEED_MAC
|
||||
CKM_SEED_MAC_GENERAL
|
||||
CKM_SEED_CBC_PAD
|
||||
CKM_SEED_ECB_ENCRYPT_DATA
|
||||
CKM_SEED_CBC_ENCRYPT_DATA
|
||||
*in secmod.h:*
|
||||
PUBLIC_MECH_SEED_FLAG
|
||||
*in secmodt.h:*
|
||||
SECMOD_SEED_FLAG
|
||||
*in secoidt.h:*
|
||||
SEC_OID_SEED_CBC
|
||||
*in sslproto.h:*
|
||||
TLS_RSA_WITH_SEED_CBC_SHA
|
||||
*in sslt.h:*
|
||||
ssl_calg_seed
|
||||
|
||||
- New structure for SEED support:
|
||||
|
||||
- (see blapit.h)
|
||||
SEEDContextStr
|
||||
SEEDContext
|
||||
|
||||
- New functions in the nss shared library:
|
||||
|
||||
- CERT_RFC1485_EscapeAndQuote (see cert.h)
|
||||
CERT_CompareCerts (see cert.h)
|
||||
CERT_RegisterAlternateOCSPAIAInfoCallBack (see ocsp.h)
|
||||
PK11_GetSymKeyHandle (see pk11pqg.h)
|
||||
UTIL_SetForkState (see secoid.h)
|
||||
NSS_GetAlgorithmPolicy (see secoid.h)
|
||||
NSS_SetAlgorithmPolicy (see secoid.h)
|
||||
|
||||
- For the 2 functions above see also (in secoidt.h):
|
||||
NSS_USE_ALG_IN_CERT_SIGNATURE
|
||||
NSS_USE_ALG_IN_CMS_SIGNATURE
|
||||
NSS_USE_ALG_RESERVED
|
||||
|
||||
- Support for the Watcom C compiler is removed
|
||||
|
||||
- The file watcomfx.h is removed.
|
||||
|
||||
--------------
|
||||
|
||||
.. _bugs_fixed:
|
||||
|
||||
`Bugs Fixed <#bugs_fixed>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
The following bugs have been fixed in NSS 3.12.3.
|
||||
|
||||
- `Bug 159483 <https://bugzilla.mozilla.org/show_bug.cgi?id=159483>`__: cert name matching: RFC
|
||||
2818 vs. backwards compatibility (wildcards)
|
||||
- `Bug 334678 <https://bugzilla.mozilla.org/show_bug.cgi?id=334678>`__: prng_fips1861.c
|
||||
redefines the macro BSIZE on HP-UX
|
||||
- `Bug 335016 <https://bugzilla.mozilla.org/show_bug.cgi?id=335016>`__: mpp_pprime (Miller-Rabin
|
||||
probabilistic primality test) may choose 0 or 1 as the random integer
|
||||
- `Bug 347037 <https://bugzilla.mozilla.org/show_bug.cgi?id=347037>`__: Make shlibsign depend on
|
||||
the softoken only
|
||||
- `Bug 371522 <https://bugzilla.mozilla.org/show_bug.cgi?id=371522>`__: Auto-Update of CRLs
|
||||
stops after first update
|
||||
- `Bug 380784 <https://bugzilla.mozilla.org/show_bug.cgi?id=380784>`__: PK11MODE in non FIPS
|
||||
mode failed.
|
||||
- `Bug 394077 <https://bugzilla.mozilla.org/show_bug.cgi?id=394077>`__: libpkix need to return
|
||||
revocation status of a cert
|
||||
- `Bug 412468 <https://bugzilla.mozilla.org/show_bug.cgi?id=412468>`__: modify certutil
|
||||
- `Bug 417092 <https://bugzilla.mozilla.org/show_bug.cgi?id=417092>`__: Modify pkix_CertSelector
|
||||
API to return an error if cert was rejected.
|
||||
- `Bug 426413 <https://bugzilla.mozilla.org/show_bug.cgi?id=426413>`__: Audit messages need
|
||||
distinct types
|
||||
- `Bug 438870 <https://bugzilla.mozilla.org/show_bug.cgi?id=438870>`__: Free Freebl hashing code
|
||||
of dependencies on NSPR and libUtil
|
||||
- `Bug 439115 <https://bugzilla.mozilla.org/show_bug.cgi?id=439115>`__: DB merge allows nickname
|
||||
conflicts in merged DB
|
||||
- `Bug 439199 <https://bugzilla.mozilla.org/show_bug.cgi?id=439199>`__: SSE2 instructions for
|
||||
bignum are not implemented on Windows 32-bit
|
||||
- `Bug 441321 <https://bugzilla.mozilla.org/show_bug.cgi?id=441321>`__: Tolerate incorrect
|
||||
encoding of DSA signatures in SSL 3.0 handshakes
|
||||
- `Bug 444404 <https://bugzilla.mozilla.org/show_bug.cgi?id=444404>`__: libpkix reports unknown
|
||||
issuer for nearly all certificate errors
|
||||
- `Bug 452391 <https://bugzilla.mozilla.org/show_bug.cgi?id=452391>`__: certutil -K incorrectly
|
||||
reports ec private key as an orphan
|
||||
- `Bug 453234 <https://bugzilla.mozilla.org/show_bug.cgi?id=453234>`__: Support for SEED Cipher
|
||||
Suites to TLS RFC4010
|
||||
- `Bug 453364 <https://bugzilla.mozilla.org/show_bug.cgi?id=453364>`__: Improve PK11_CipherOp
|
||||
error reporting (was: PK11_CreateContextBySymKey returns NULL
|
||||
- `Bug 456406 <https://bugzilla.mozilla.org/show_bug.cgi?id=456406>`__: Slot list leaks in
|
||||
symkeyutil
|
||||
- `Bug 461085 <https://bugzilla.mozilla.org/show_bug.cgi?id=461085>`__: RFE: export function
|
||||
CERT_CompareCerts
|
||||
- `Bug 462293 <https://bugzilla.mozilla.org/show_bug.cgi?id=462293>`__: Crash on fork after
|
||||
Softoken is dlClose'd on some Unix platforms in NSS 3.12
|
||||
- `Bug 463342 <https://bugzilla.mozilla.org/show_bug.cgi?id=463342>`__: move some headers to
|
||||
freebl/softoken
|
||||
- `Bug 463452 <https://bugzilla.mozilla.org/show_bug.cgi?id=463452>`__: SQL DB creation does not
|
||||
set files protections to 0600
|
||||
- `Bug 463678 <https://bugzilla.mozilla.org/show_bug.cgi?id=463678>`__: Need to add RPATH to
|
||||
64-bit libraries on HP-UX
|
||||
- `Bug 464088 <https://bugzilla.mozilla.org/show_bug.cgi?id=464088>`__: Option to build NSS
|
||||
without dbm (handy for WinCE)
|
||||
- `Bug 464223 <https://bugzilla.mozilla.org/show_bug.cgi?id=464223>`__: Certutil didn't accept
|
||||
certificate request to sign.
|
||||
- `Bug 464406 <https://bugzilla.mozilla.org/show_bug.cgi?id=464406>`__: Fix signtool regressions
|
||||
- `Bug 465270 <https://bugzilla.mozilla.org/show_bug.cgi?id=465270>`__: uninitialised value in
|
||||
devutil.c::create_object()
|
||||
- `Bug 465273 <https://bugzilla.mozilla.org/show_bug.cgi?id=465273>`__: dead assignment in
|
||||
devutil.c::nssSlotArray_Clone()
|
||||
- `Bug 465926 <https://bugzilla.mozilla.org/show_bug.cgi?id=465926>`__: During import of PKCS
|
||||
#12 files
|
||||
- `Bug 466180 <https://bugzilla.mozilla.org/show_bug.cgi?id=466180>`__:
|
||||
SSL_ConfigMPServerSIDCache with default parameters fails on {Net
|
||||
- `Bug 466194 <https://bugzilla.mozilla.org/show_bug.cgi?id=466194>`__: CERT_DecodeTrustString
|
||||
should take a const char \* input trusts string.
|
||||
- `Bug 466736 <https://bugzilla.mozilla.org/show_bug.cgi?id=466736>`__: Incorrect use of
|
||||
NSS_USE_64 in lib/libpkix/pkix_pl_nss/system/pkix_pl_object.c
|
||||
- `Bug 466745 <https://bugzilla.mozilla.org/show_bug.cgi?id=466745>`__: random number generator
|
||||
fails on windows ce
|
||||
- `Bug 467298 <https://bugzilla.mozilla.org/show_bug.cgi?id=467298>`__: SQL DB code uses local
|
||||
cache on local file system
|
||||
- `Bug 468279 <https://bugzilla.mozilla.org/show_bug.cgi?id=468279>`__: softoken crash importing
|
||||
email cert into newly upgraded DB
|
||||
- `Bug 468532 <https://bugzilla.mozilla.org/show_bug.cgi?id=468532>`__: Trusted CA trust flags
|
||||
not being honored in CERT_VerifyCert
|
||||
- `Bug 469583 <https://bugzilla.mozilla.org/show_bug.cgi?id=469583>`__: Coverity: uninitialized
|
||||
variable used in sec_pkcs5CreateAlgorithmID
|
||||
- `Bug 469944 <https://bugzilla.mozilla.org/show_bug.cgi?id=469944>`__: when built with
|
||||
Microsoft compilers
|
||||
- `Bug 470351 <https://bugzilla.mozilla.org/show_bug.cgi?id=470351>`__: crlutil build fails on
|
||||
Windows because it calls undeclared isatty
|
||||
- `Bug 471539 <https://bugzilla.mozilla.org/show_bug.cgi?id=471539>`__: Stop honoring digital
|
||||
signatures in certificates and CRLs based on weak hashes
|
||||
- `Bug 471665 <https://bugzilla.mozilla.org/show_bug.cgi?id=471665>`__: NSS reports incorrect
|
||||
sizes for (AES) symmetric keys
|
||||
- `Bug 471715 <https://bugzilla.mozilla.org/show_bug.cgi?id=471715>`__: Add cert to nssckbi to
|
||||
override rogue md5-collision CA cert
|
||||
- `Bug 472291 <https://bugzilla.mozilla.org/show_bug.cgi?id=472291>`__: crash in libpkix object
|
||||
leak tests due to null pointer dereferencing in pkix_build.c:3218.
|
||||
- `Bug 472319 <https://bugzilla.mozilla.org/show_bug.cgi?id=472319>`__: Vfychain validates chain
|
||||
even if revoked certificate.
|
||||
- `Bug 472749 <https://bugzilla.mozilla.org/show_bug.cgi?id=472749>`__: Softoken permits AES
|
||||
keys of ANY LENGTH to be created
|
||||
- `Bug 473147 <https://bugzilla.mozilla.org/show_bug.cgi?id=473147>`__: pk11mode tests fails on
|
||||
AIX when using shareable DBs.
|
||||
- `Bug 473357 <https://bugzilla.mozilla.org/show_bug.cgi?id=473357>`__: ssltap incorrectly
|
||||
parses handshake messages that span record boundaries
|
||||
- `Bug 473365 <https://bugzilla.mozilla.org/show_bug.cgi?id=473365>`__: Incompatible argument in
|
||||
pkix_validate.c.
|
||||
- `Bug 473505 <https://bugzilla.mozilla.org/show_bug.cgi?id=473505>`__: softoken's C_Initialize
|
||||
and C_Finalize should succeed after a fork in a child process
|
||||
- `Bug 473944 <https://bugzilla.mozilla.org/show_bug.cgi?id=473944>`__: Trust anchor is not
|
||||
trusted when requireFreshInfo flag is set.
|
||||
- `Bug 474532 <https://bugzilla.mozilla.org/show_bug.cgi?id=474532>`__: Softoken cannot import
|
||||
certs with empty subjects and non-empty nicknames
|
||||
- `Bug 474777 <https://bugzilla.mozilla.org/show_bug.cgi?id=474777>`__: Wrong deallocation when
|
||||
modifying CRL.
|
||||
- `Bug 476126 <https://bugzilla.mozilla.org/show_bug.cgi?id=476126>`__: CERT_AsciiToName fails
|
||||
when AVAs in an RDN are separated by '+'
|
||||
- `Bug 477186 <https://bugzilla.mozilla.org/show_bug.cgi?id=477186>`__: Infinite loop in
|
||||
CERT_GetCertChainFromCert
|
||||
- `Bug 477777 <https://bugzilla.mozilla.org/show_bug.cgi?id=477777>`__: Selfserv crashed in
|
||||
client/server tests.
|
||||
- `Bug 478171 <https://bugzilla.mozilla.org/show_bug.cgi?id=478171>`__: Consolidate the
|
||||
coreconf/XXX.mk files for Windows
|
||||
- `Bug 478563 <https://bugzilla.mozilla.org/show_bug.cgi?id=478563>`__: Add \_MSC_VER (the cl
|
||||
version) to coreconf.
|
||||
- `Bug 478724 <https://bugzilla.mozilla.org/show_bug.cgi?id=478724>`__: NSS build fails on
|
||||
Windows since 20090213.1 nightly build.
|
||||
- `Bug 478931 <https://bugzilla.mozilla.org/show_bug.cgi?id=478931>`__: object leak in
|
||||
pkix_List_MergeLists function
|
||||
- `Bug 478994 <https://bugzilla.mozilla.org/show_bug.cgi?id=478994>`__: Allow Softoken's fork
|
||||
check to be disabled
|
||||
- `Bug 479029 <https://bugzilla.mozilla.org/show_bug.cgi?id=479029>`__: OCSP Response signature
|
||||
cert found invalid if issuer is trusted only for SSL
|
||||
- `Bug 479601 <https://bugzilla.mozilla.org/show_bug.cgi?id=479601>`__: Wrong type (UTF8 String)
|
||||
for email addresses in subject by CERT_AsciiToName
|
||||
- `Bug 480142 <https://bugzilla.mozilla.org/show_bug.cgi?id=480142>`__: Use sizeof on the
|
||||
correct type of ckc_x509 in lib/ckfw
|
||||
- `Bug 480257 <https://bugzilla.mozilla.org/show_bug.cgi?id=480257>`__: OCSP fails when response
|
||||
> 1K Byte
|
||||
- `Bug 480280 <https://bugzilla.mozilla.org/show_bug.cgi?id=480280>`__: The CKA_EC_POINT PKCS#11
|
||||
attribute is encoded in the wrong way: missing encapsulating octet string
|
||||
- `Bug 480442 <https://bugzilla.mozilla.org/show_bug.cgi?id=480442>`__: Remove (empty)
|
||||
watcomfx.h from nss
|
||||
- `Bug 481216 <https://bugzilla.mozilla.org/show_bug.cgi?id=481216>`__: Fix specific spelling
|
||||
errors in NSS
|
||||
- `Bug 482702 <https://bugzilla.mozilla.org/show_bug.cgi?id=482702>`__: OCSP test with revoked
|
||||
CA cert validated as good.
|
||||
- `Bug 483113 <https://bugzilla.mozilla.org/show_bug.cgi?id=483113>`__: add environment variable
|
||||
to disable/enable hash algorithms in cert/CRL signatures
|
||||
- `Bug 483168 <https://bugzilla.mozilla.org/show_bug.cgi?id=483168>`__: NSS Callback API for
|
||||
looking up a default OCSP Responder URL
|
||||
- `Bug 483963 <https://bugzilla.mozilla.org/show_bug.cgi?id=483963>`__: Assertion failure in
|
||||
OCSP tests.
|
||||
- `Bug 484425 <https://bugzilla.mozilla.org/show_bug.cgi?id=484425>`__: Need accessor function
|
||||
to retrieve SymKey handle
|
||||
- `Bug 484466 <https://bugzilla.mozilla.org/show_bug.cgi?id=484466>`__: sec_error_invalid_args
|
||||
with NSS_ENABLE_PKIX_VERIFY=1
|
||||
- `Bug 485127 <https://bugzilla.mozilla.org/show_bug.cgi?id=485127>`__: bltest crashes when
|
||||
attempting rc5_cbc or rc5_ecb
|
||||
- `Bug 485140 <https://bugzilla.mozilla.org/show_bug.cgi?id=485140>`__: Wrong command line flags
|
||||
used to build intel-aes.s with Solaris gas for x86_64
|
||||
- `Bug 485370 <https://bugzilla.mozilla.org/show_bug.cgi?id=485370>`__: crash
|
||||
- `Bug 485713 <https://bugzilla.mozilla.org/show_bug.cgi?id=485713>`__: Files added by Red Hat
|
||||
recently have missing texts in license headers.
|
||||
- `Bug 485729 <https://bugzilla.mozilla.org/show_bug.cgi?id=485729>`__: Remove
|
||||
lib/freebl/mapfile.Solaris
|
||||
- `Bug 485837 <https://bugzilla.mozilla.org/show_bug.cgi?id=485837>`__: vc90.pdb files are
|
||||
output in source directory instead of OBJDIR
|
||||
- `Bug 486060 <https://bugzilla.mozilla.org/show_bug.cgi?id=486060>`__: sec_asn1d_parse_leaf
|
||||
uses argument uninitialized by caller pbe_PK11AlgidToParam
|
||||
|
||||
--------------
|
||||
|
||||
`Documentation <#documentation>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
For a list of the primary NSS documentation pages on mozilla.org, see `NSS
|
||||
Documentation <../index.html#Documentation>`__. New and revised documents available since the
|
||||
release of NSS 3.11 include the following:
|
||||
|
||||
- `Build Instructions for NSS 3.11.4 and above <../nss-3.11.4/nss-3.11.4-build.html>`__
|
||||
- `NSS Shared DB <http://wiki.mozilla.org/NSS_Shared_DB>`__
|
||||
|
||||
--------------
|
||||
|
||||
`Compatibility <#compatibility>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
NSS 3.12.3 shared libraries are backward compatible with all older NSS 3.x shared libraries. A
|
||||
program linked with older NSS 3.x shared libraries will work with NSS 3.12.3 shared libraries
|
||||
without recompiling or relinking. Furthermore, applications that restrict their use of NSS APIs
|
||||
to the functions listed in `NSS Public Functions <../ref/nssfunctions.html>`__ will remain
|
||||
compatible with future versions of the NSS shared libraries.
|
||||
|
||||
--------------
|
||||
|
||||
`Feedback <#feedback>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
| Bugs discovered should be reported by filing a bug report with `mozilla.org
|
||||
Bugzilla <https://bugzilla.mozilla.org/>`__ (product NSS).
|
||||
|
|
@ -1,327 +0,0 @@
|
|||
.. _mozilla_projects_nss_nss_3_12_4_release_notes:
|
||||
|
||||
NSS 3.12.4 release notes
|
||||
========================
|
||||
|
||||
.. container::
|
||||
|
||||
.. code::
|
||||
|
||||
2009-08-20
|
||||
|
||||
*Newsgroup:*\ `mozilla.dev.tech.crypto <news://news.mozilla.org/mozilla.dev.tech.crypto>`__
|
||||
.. rubric:: Introduction
|
||||
:name: Introduction
|
||||
|
||||
Network Security Services (NSS) 3.12.4 is a patch release for NSS 3.12. The bug fixes in NSS
|
||||
3.12.4 are described in the "`Bugs Fixed <#bugsfixed>`__" section below.
|
||||
|
||||
NSS 3.12.4 is tri-licensed under the MPL 1.1/GPL 2.0/LGPL 2.1.
|
||||
|
||||
.. rubric:: Distribution Information
|
||||
:name: Distribution_Information
|
||||
|
||||
This release is built from the source, at the CVS repository rooted at cvs.mozilla.org:/cvsroot,
|
||||
with the CVS tag ``NSS_3_12_4_RTM``.
|
||||
|
||||
NSS 3.12.4 requires `NSPR 4.8 <https://www.mozilla.org/projects/nspr/release-notes/>`__. This is
|
||||
not a hard requirement. Our QA tested NSS 3.12.4 with NSPR 4.8, but it should work with NSPR
|
||||
4.7.1 or later.
|
||||
|
||||
You can check out the source from CVS by
|
||||
|
||||
.. note::
|
||||
|
||||
cvs co -r NSPR_4_8_RTM NSPR
|
||||
cvs co -r NSS_3_12_4_RTM NSS
|
||||
|
||||
See the `Documentation <#docs>`__ section for the build instructions.
|
||||
|
||||
NSS 3.12.4 source is also available on ``ftp.mozilla.org`` for secure HTTPS download:
|
||||
|
||||
- Source tarball:
|
||||
https://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_12_4_RTM/src/.
|
||||
|
||||
.. rubric:: Major changes in NSS 3.12.4
|
||||
:name: Major_changes_in_NSS_3.12.4
|
||||
|
||||
- NSS 3.12.4 is the version that we submitted to NIST for FIPS 140-2 validation.
|
||||
Currently NSS 3.12.4 is in the "Review Pending" state in the FIPS 140-2 pre-validation
|
||||
list at http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140InProcess.pdf
|
||||
- Added CRL Distribution Point support (see cert.h).
|
||||
**CERT_DecodeCRLIssuingDistributionPoint**
|
||||
**CERT_FindCRLIssuingDistPointExten**
|
||||
- The old documentation of the expression matching syntax rules was
|
||||
incorrect, and the new corrected documentation is as follows for
|
||||
public nssutil functions (see portreq.h):
|
||||
|
||||
- **PORT_RegExpValid**
|
||||
- **PORT_RegExpSearch**
|
||||
- **PORT_RegExpCaseSearch**
|
||||
|
||||
- These functions will match a string with a shell expression. The expressions
|
||||
accepted are based loosely on the expressions accepted by zsh.
|
||||
Expected return values:
|
||||
|
||||
- NON_SXP if exp is a standard string
|
||||
- INVALID_SXP if exp is a shell expression, but invalid
|
||||
- VALID_SXP if exp is a valid shell expression
|
||||
|
||||
Expression matching rules:
|
||||
|
||||
- \* matches anything
|
||||
- ? matches one character
|
||||
- \\ will escape a special character
|
||||
- $ matches the end of the string
|
||||
- Bracketed expressions:
|
||||
[abc] matches one occurrence of a, b, or c.
|
||||
[^abc] matches any character except a, b, or c.
|
||||
To be matched between [ and ], these characters must be escaped: \\ ]
|
||||
No other characters need be escaped between brackets.
|
||||
Unnecessary escaping is permitted.
|
||||
- [a-z] matches any character between a and z, inclusive.
|
||||
The two range-definition characters must be alphanumeric ASCII.
|
||||
If one is upper case and the other is lower case, then the ASCII
|
||||
non-alphanumeric characters between Z and a will also be in range.
|
||||
- [^a-z] matches any character except those between a and z, inclusive.
|
||||
These forms cannot be combined, e.g [a-gp-z] does not work.
|
||||
- Exclusions:
|
||||
As a top level, outter-most expression only, the expression
|
||||
foo~bar will match the expression foo, provided it does not also
|
||||
match the expression bar. Either expression or both may be a union.
|
||||
Except between brackets, any unescaped ~ is an exclusion.
|
||||
At most one exclusion is permitted.
|
||||
Exclusions cannot be nested (contain other exclusions).
|
||||
example: \*~abc will match any string except abc
|
||||
- Unions:
|
||||
(foo|bar) will match either the expression foo, or the expression bar.
|
||||
At least one '|' separator is required. More are permitted.
|
||||
Expressions inside unions may not include unions or exclusions.
|
||||
Inside a union, to be matched and not treated as a special character,
|
||||
these characters must be escaped: \\ ( \| ) [ ~ except when they occur
|
||||
inside a bracketed expression, where only \\ and ] require escaping.
|
||||
|
||||
- New functions in the nss shared library:
|
||||
|
||||
- PK11_IsInternalKeySlot (see pk11pub.h)
|
||||
- SECMOD_OpenNewSlot (see pk11pub.h)
|
||||
|
||||
- New error codes (see secerr.h):
|
||||
|
||||
- SEC_ERROR_BAD_INFO_ACCESS_METHOD
|
||||
- SEC_ERROR_CRL_IMPORT_FAILED
|
||||
|
||||
- New OIDs (see secoidt.h)
|
||||
|
||||
- SEC_OID_X509_ANY_POLICY
|
||||
|
||||
- The nssckbi PKCS #11 module's version changed to 1.75.
|
||||
- Obsolete code for Win16 has been removed.
|
||||
- Support for OpenVMS has been removed.
|
||||
|
||||
.. rubric:: Bugs Fixed
|
||||
:name: Bugs_Fixed
|
||||
|
||||
The following bugs have been fixed in NSS 3.12.4.
|
||||
|
||||
- `Bug 321755 <https://bugzilla.mozilla.org/show_bug.cgi?id=321755>`__: implement
|
||||
crlDistributionPoint extension in libPKIX
|
||||
- `Bug 391434 <https://bugzilla.mozilla.org/show_bug.cgi?id=391434>`__: avoid multiple
|
||||
encoding/decoding of PKIX_PL_OID to and from ascii string
|
||||
- `Bug 405297 <https://bugzilla.mozilla.org/show_bug.cgi?id=405297>`__: Problems building
|
||||
nss/lib/ckfw/capi/ with MingW GCC
|
||||
- `Bug 420991 <https://bugzilla.mozilla.org/show_bug.cgi?id=420991>`__: libPKIX returns wrong
|
||||
NSS error code
|
||||
- `Bug 427135 <https://bugzilla.mozilla.org/show_bug.cgi?id=427135>`__: Add super-H (sh3,4)
|
||||
architecture support
|
||||
- `Bug 431958 <https://bugzilla.mozilla.org/show_bug.cgi?id=431958>`__: Improve DES and SHA512
|
||||
for x86_64 platform
|
||||
- `Bug 433791 <https://bugzilla.mozilla.org/show_bug.cgi?id=433791>`__: Win16 support should be
|
||||
deleted from NSS
|
||||
- `Bug 449332 <https://bugzilla.mozilla.org/show_bug.cgi?id=449332>`__: SECU_ParseCommandLine
|
||||
does not validate its inputs
|
||||
- `Bug 453735 <https://bugzilla.mozilla.org/show_bug.cgi?id=453735>`__: When using cert9
|
||||
(SQLite3) DB, set or change master password fails
|
||||
- `Bug 463544 <https://bugzilla.mozilla.org/show_bug.cgi?id=463544>`__: warning: passing enum\*
|
||||
for an int\* argument in pkix_validate.c
|
||||
- `Bug 469588 <https://bugzilla.mozilla.org/show_bug.cgi?id=469588>`__: Coverity errors reported
|
||||
for softoken
|
||||
- `Bug 470055 <https://bugzilla.mozilla.org/show_bug.cgi?id=470055>`__:
|
||||
pkix_HttpCertStore_FindSocketConnection reuses closed socket
|
||||
- `Bug 470070 <https://bugzilla.mozilla.org/show_bug.cgi?id=470070>`__: Multiple object leaks
|
||||
reported by tinderbox
|
||||
- `Bug 470479 <https://bugzilla.mozilla.org/show_bug.cgi?id=470479>`__: IO timeout during cert
|
||||
fetching makes libpkix abort validation.
|
||||
- `Bug 470500 <https://bugzilla.mozilla.org/show_bug.cgi?id=470500>`__: Firefox 3.1b2 Crash
|
||||
Report [[@ nssutil3.dll@0x34c0 ]
|
||||
- `Bug 482742 <https://bugzilla.mozilla.org/show_bug.cgi?id=482742>`__: Enable building util
|
||||
independently of the rest of nss
|
||||
- `Bug 483653 <https://bugzilla.mozilla.org/show_bug.cgi?id=483653>`__: unable to build
|
||||
certutil.exe for fennec/wince
|
||||
- `Bug 485145 <https://bugzilla.mozilla.org/show_bug.cgi?id=485145>`__: Miscellaneous crashes in
|
||||
signtool on Windows
|
||||
- `Bug 485155 <https://bugzilla.mozilla.org/show_bug.cgi?id=485155>`__: NSS_ENABLE_PKIX_VERIFY=1
|
||||
causes sec_error_unknown_issuer errors
|
||||
- `Bug 485527 <https://bugzilla.mozilla.org/show_bug.cgi?id=485527>`__: Rename the \_X86\_ macro
|
||||
in lib/freebl
|
||||
- `Bug 485658 <https://bugzilla.mozilla.org/show_bug.cgi?id=485658>`__: vfychain -p reports
|
||||
revoked cert
|
||||
- `Bug 485745 <https://bugzilla.mozilla.org/show_bug.cgi?id=485745>`__: modify fipstest.c to
|
||||
support CAVS 7.1 DRBG testing
|
||||
- `Bug 486304 <https://bugzilla.mozilla.org/show_bug.cgi?id=486304>`__: cert7.db/cert8.db
|
||||
corruption when importing a large certificate (>64K)
|
||||
- `Bug 486405 <https://bugzilla.mozilla.org/show_bug.cgi?id=486405>`__: Allocator mismatches in
|
||||
pk12util.c
|
||||
- `Bug 486537 <https://bugzilla.mozilla.org/show_bug.cgi?id=486537>`__: Disable execstack in
|
||||
freebl x86_64 builds on Linux
|
||||
- `Bug 486698 <https://bugzilla.mozilla.org/show_bug.cgi?id=486698>`__: Facilitate the building
|
||||
of major components independently and in a chain manner by downstream distributions
|
||||
- `Bug 486999 <https://bugzilla.mozilla.org/show_bug.cgi?id=486999>`__: Calling
|
||||
SSL_SetSockPeerID a second time leaks the previous value
|
||||
- `Bug 487007 <https://bugzilla.mozilla.org/show_bug.cgi?id=487007>`__: Make lib/jar conform to
|
||||
NSS coding style
|
||||
- `Bug 487162 <https://bugzilla.mozilla.org/show_bug.cgi?id=487162>`__: ckfw/capi build failure
|
||||
on windows
|
||||
- `Bug 487239 <https://bugzilla.mozilla.org/show_bug.cgi?id=487239>`__: nssutil.rc doesn't
|
||||
compile on WinCE
|
||||
- `Bug 487254 <https://bugzilla.mozilla.org/show_bug.cgi?id=487254>`__: sftkmod.c uses POSIX
|
||||
file IO Functions on WinCE
|
||||
- `Bug 487255 <https://bugzilla.mozilla.org/show_bug.cgi?id=487255>`__: sdb.c uses POSIX file IO
|
||||
Functions on WinCE
|
||||
- `Bug 487487 <https://bugzilla.mozilla.org/show_bug.cgi?id=487487>`__: CERT_NameToAscii reports
|
||||
!Invalid AVA! whenever value exceeds 384 bytes
|
||||
- `Bug 487736 <https://bugzilla.mozilla.org/show_bug.cgi?id=487736>`__: libpkix passes wrong
|
||||
argument to DER_DecodeTimeChoice and crashes
|
||||
- `Bug 487858 <https://bugzilla.mozilla.org/show_bug.cgi?id=487858>`__: Remove obsolete build
|
||||
options MOZILLA_SECURITY_BUILD and MOZILLA_BSAFE_BUILD
|
||||
- `Bug 487884 <https://bugzilla.mozilla.org/show_bug.cgi?id=487884>`__: object leak in libpkix
|
||||
library upon error
|
||||
- `Bug 488067 <https://bugzilla.mozilla.org/show_bug.cgi?id=488067>`__: PK11_ImportCRL reports
|
||||
SEC_ERROR_CRL_NOT_FOUND when it fails to import a CRL
|
||||
- `Bug 488350 <https://bugzilla.mozilla.org/show_bug.cgi?id=488350>`__: NSPR-free freebl
|
||||
interface need to do post tests only in fips mode.
|
||||
- `Bug 488396 <https://bugzilla.mozilla.org/show_bug.cgi?id=488396>`__: DBM needs to be FIPS
|
||||
certifiable.
|
||||
- `Bug 488550 <https://bugzilla.mozilla.org/show_bug.cgi?id=488550>`__: crash in certutil or pp
|
||||
when printing cert with empty subject name
|
||||
- `Bug 488992 <https://bugzilla.mozilla.org/show_bug.cgi?id=488992>`__: Fix
|
||||
lib/freebl/win_rand.c warnings
|
||||
- `Bug 489010 <https://bugzilla.mozilla.org/show_bug.cgi?id=489010>`__: stop exporting mktemp
|
||||
and dbopen (again)
|
||||
- `Bug 489287 <https://bugzilla.mozilla.org/show_bug.cgi?id=489287>`__: Resolve a few remaining
|
||||
issues with NSS's new revocation flags
|
||||
- `Bug 489710 <https://bugzilla.mozilla.org/show_bug.cgi?id=489710>`__: byteswap optimize for
|
||||
MSVC++
|
||||
- `Bug 490154 <https://bugzilla.mozilla.org/show_bug.cgi?id=490154>`__: Cryptokey framework
|
||||
requires module to implement GenerateKey when they support KeyPairGeneration
|
||||
- `Bug 491044 <https://bugzilla.mozilla.org/show_bug.cgi?id=491044>`__: Remove support for VMS
|
||||
(a.k.a., OpenVMS) from NSS
|
||||
- `Bug 491174 <https://bugzilla.mozilla.org/show_bug.cgi?id=491174>`__: CERT_PKIXVerifyCert
|
||||
reports wrong error code when EE cert is expired
|
||||
- `Bug 491919 <https://bugzilla.mozilla.org/show_bug.cgi?id=491919>`__: cert.h doesn't have
|
||||
valid functions prototypes
|
||||
- `Bug 492131 <https://bugzilla.mozilla.org/show_bug.cgi?id=492131>`__: A failure to import a
|
||||
cert from a P12 file leaves error code set to zero
|
||||
- `Bug 492385 <https://bugzilla.mozilla.org/show_bug.cgi?id=492385>`__: crash freeing named CRL
|
||||
entry on shutdown
|
||||
- `Bug 493135 <https://bugzilla.mozilla.org/show_bug.cgi?id=493135>`__: bltest crashes if it
|
||||
can't open the input file
|
||||
- `Bug 493364 <https://bugzilla.mozilla.org/show_bug.cgi?id=493364>`__: can't build with
|
||||
--disable-dbm option when not cross-compiling
|
||||
- `Bug 493693 <https://bugzilla.mozilla.org/show_bug.cgi?id=493693>`__: SSE2 instructions for
|
||||
bignum are not implemented on OS/2
|
||||
- `Bug 493912 <https://bugzilla.mozilla.org/show_bug.cgi?id=493912>`__: sqlite3_reset should be
|
||||
invoked in sdb_FindObjectsInit when error occurs
|
||||
- `Bug 494073 <https://bugzilla.mozilla.org/show_bug.cgi?id=494073>`__: update RSA/DSA
|
||||
powerupself tests to be compliant for 2011
|
||||
- `Bug 494087 <https://bugzilla.mozilla.org/show_bug.cgi?id=494087>`__: Passing NULL as the
|
||||
value of cert_pi_trustAnchors causes a crash in cert_pkixSetParam
|
||||
- `Bug 494107 <https://bugzilla.mozilla.org/show_bug.cgi?id=494107>`__: During NSS_NoDB_Init(),
|
||||
softoken tries but fails to load libsqlite3.so crash [@ @0x0 ]
|
||||
- `Bug 495097 <https://bugzilla.mozilla.org/show_bug.cgi?id=495097>`__: sdb_mapSQLError returns
|
||||
signed int
|
||||
- `Bug 495103 <https://bugzilla.mozilla.org/show_bug.cgi?id=495103>`__:
|
||||
NSS_InitReadWrite(sql:<dbdir>) causes NSS to look for sql:<dbdir>/libnssckbi.so
|
||||
- `Bug 495365 <https://bugzilla.mozilla.org/show_bug.cgi?id=495365>`__: Add const to the
|
||||
'nickname' parameter of SEC_CertNicknameConflict
|
||||
- `Bug 495656 <https://bugzilla.mozilla.org/show_bug.cgi?id=495656>`__:
|
||||
NSS_InitReadWrite(sql:<configdir>) leaves behind a pkcs11.txu file if libnssckbi.so is in
|
||||
<configdir>.
|
||||
- `Bug 495717 <https://bugzilla.mozilla.org/show_bug.cgi?id=495717>`__: Unable to compile
|
||||
nss/cmd/certutil/keystuff.c on WinCE
|
||||
- `Bug 496961 <https://bugzilla.mozilla.org/show_bug.cgi?id=496961>`__: provide truncated HMAC
|
||||
support for testing tool fipstest
|
||||
- `Bug 497002 <https://bugzilla.mozilla.org/show_bug.cgi?id=497002>`__: Lab required nspr-free
|
||||
freebl changes.
|
||||
- `Bug 497217 <https://bugzilla.mozilla.org/show_bug.cgi?id=497217>`__: The first random value
|
||||
ever generated by the RNG should be discarded
|
||||
- `Bug 498163 <https://bugzilla.mozilla.org/show_bug.cgi?id=498163>`__: assert if profile path
|
||||
contains cyrillic chars. [[@isspace - secmod_argIsBlank - secmod_argHasBlanks -
|
||||
secmod_formatPair - secmod_mkNewModuleSpec]
|
||||
- `Bug 498509 <https://bugzilla.mozilla.org/show_bug.cgi?id=498509>`__: Produce debuggable
|
||||
optimized builds for Mozilla on MacOSX
|
||||
- `Bug 498511 <https://bugzilla.mozilla.org/show_bug.cgi?id=498511>`__: Produce debuggable
|
||||
optimized NSS builds for Mozilla on Linux
|
||||
- `Bug 499385 <https://bugzilla.mozilla.org/show_bug.cgi?id=499385>`__: DRBG Reseed function
|
||||
needs to be tested on POST
|
||||
- `Bug 499825 <https://bugzilla.mozilla.org/show_bug.cgi?id=499825>`__: utilrename.h is missing
|
||||
from Solaris packages
|
||||
- `Bug 502961 <https://bugzilla.mozilla.org/show_bug.cgi?id=502961>`__: Allocator mismatch in
|
||||
pk11mode
|
||||
- `Bug 502965 <https://bugzilla.mozilla.org/show_bug.cgi?id=502965>`__: Allocator mismatch in
|
||||
sdrtest
|
||||
- `Bug 502972 <https://bugzilla.mozilla.org/show_bug.cgi?id=502972>`__: Another allocator
|
||||
mismatch in sdrtest
|
||||
- `Bug 504398 <https://bugzilla.mozilla.org/show_bug.cgi?id=504398>`__:
|
||||
pkix_pl_AIAMgr_GetHTTPCerts could crash if SEC_GetRegisteredHttpClient fails
|
||||
- `Bug 504405 <https://bugzilla.mozilla.org/show_bug.cgi?id=504405>`__: pkix_pl_CrlDp_Create
|
||||
will fail on alloc success because of a missing !
|
||||
- `Bug 504408 <https://bugzilla.mozilla.org/show_bug.cgi?id=504408>`__: pkix_pl_CrlDp_Create
|
||||
will always fail if dp->distPointType != generalName
|
||||
- `Bug 504456 <https://bugzilla.mozilla.org/show_bug.cgi?id=504456>`__: Exploitable heap
|
||||
overflow in NSS shell expression (filename globbing) parsing
|
||||
- `Bug 505559 <https://bugzilla.mozilla.org/show_bug.cgi?id=505559>`__: Need function to
|
||||
identify the one and only default internal private key slot.
|
||||
- `Bug 505561 <https://bugzilla.mozilla.org/show_bug.cgi?id=505561>`__: Need a generic function
|
||||
a la SECMOD_OpenUserDB() that can be used on non-softoken modules.
|
||||
- `Bug 505858 <https://bugzilla.mozilla.org/show_bug.cgi?id=505858>`__: NSS_RegisterShutdown can
|
||||
return without unlocking nssShutdownList.lock
|
||||
- `Bug 507041 <https://bugzilla.mozilla.org/show_bug.cgi?id=507041>`__: Invalid build options
|
||||
for VC6
|
||||
- `Bug 507228 <https://bugzilla.mozilla.org/show_bug.cgi?id=507228>`__: coreconf.dep doesn't
|
||||
need to contain the NSS version number
|
||||
- `Bug 507422 <https://bugzilla.mozilla.org/show_bug.cgi?id=507422>`__: crash [[@ PORT_FreeArena
|
||||
- lg_mkSecretKeyRep] when PORT_NewArena fails
|
||||
- `Bug 507482 <https://bugzilla.mozilla.org/show_bug.cgi?id=507482>`__: NSS 3.12.3 (and later)
|
||||
doesn't build on AIX 5.1
|
||||
- `Bug 507937 <https://bugzilla.mozilla.org/show_bug.cgi?id=507937>`__: pwdecrypt program
|
||||
problems
|
||||
- `Bug 508259 <https://bugzilla.mozilla.org/show_bug.cgi?id=508259>`__: Pk11mode crashed on
|
||||
Linux2.4
|
||||
- `Bug 508467 <https://bugzilla.mozilla.org/show_bug.cgi?id=508467>`__: libpkix ocsp checker
|
||||
should use date argument to obtain the time for cert validity verification
|
||||
- `Bug 510367 <https://bugzilla.mozilla.org/show_bug.cgi?id=510367>`__: Fix the UTF8 characters
|
||||
in the nickname string for AC Raíz Certicamara S.A.
|
||||
|
||||
.. rubric:: Documentation
|
||||
:name: Documentation
|
||||
|
||||
For a list of the primary NSS documentation pages on developer.mozilla.org, see NSS. New and
|
||||
revised documents available since the release of NSS 3.12 include the following:
|
||||
|
||||
- :ref:`mozilla_projects_nss_reference_building_and_installing_nss_build_instructions`
|
||||
|
||||
.. rubric:: Compatibility
|
||||
:name: Compatibility
|
||||
|
||||
NSS 3.12.4 shared libraries are backward compatible with all older NSS 3.x shared libraries. A
|
||||
program linked with older NSS 3.x shared libraries will work with NSS 3.12.4 shared libraries
|
||||
without recompiling or relinking. Furthermore, applications that restrict their use of NSS APIs
|
||||
to the functions listed in `NSS Public Functions </ref/nssfunctions.html>`__ will remain
|
||||
compatible with future versions of the NSS shared libraries.
|
||||
|
||||
.. rubric:: Feedback
|
||||
:name: Feedback
|
||||
|
||||
Bugs discovered should be reported by filing a bug report with `mozilla.org
|
||||
Bugzilla <https://bugzilla.mozilla.org/>`__ (product NSS).
|
||||
|
|
@ -1,285 +0,0 @@
|
|||
.. _mozilla_projects_nss_nss_3_12_5_release_notes:
|
||||
|
||||
NSS 3.12.5 release_notes
|
||||
========================
|
||||
|
||||
.. _nss_3.12.5_release_notes:
|
||||
|
||||
`NSS 3.12.5 release notes <#nss_3.12.5_release_notes>`__
|
||||
--------------------------------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
.. container::
|
||||
|
||||
2009-12-02
|
||||
*Newsgroup:*\ `mozilla.dev.tech.crypto <news://news.mozilla.org/mozilla.dev.tech.crypto>`__
|
||||
|
||||
--------------
|
||||
|
||||
.. container::
|
||||
:name: section_1
|
||||
|
||||
.. rubric:: Introduction
|
||||
:name: Introduction
|
||||
|
||||
Network Security Services (NSS) 3.12.5 is a patch release for NSS 3.12. The bug fixes in
|
||||
NSS 3.12.5 are described in the "`Bugs
|
||||
Fixed <https://dev.mozilla.jp/localmdc/localmdc_5125.html#bugsfixed>`__" section below.
|
||||
|
||||
NSS 3.12.5 is tri-licensed under the MPL 1.1/GPL 2.0/LGPL 2.1.
|
||||
|
||||
.. container::
|
||||
:name: section_2
|
||||
|
||||
.. rubric:: Distribution Information
|
||||
:name: Distribution_Information
|
||||
|
||||
The CVS tag for the NSS 3.12.5 release is ``NSS_3_12_5_RTM``.
|
||||
|
||||
NSS 3.12.5 requires `NSPR 4.8 <https://www.mozilla.org/projects/nspr/release-notes/>`__.
|
||||
|
||||
You can check out the source from CVS by
|
||||
|
||||
.. note::
|
||||
|
||||
cvs co -r NSPR_4_8_RTM NSPR
|
||||
cvs co -r NSS_3_12_5_RTM NSS
|
||||
|
||||
See the `Documentation <https://dev.mozilla.jp/localmdc/localmdc_5125.html#docs>`__ section
|
||||
for the build instructions.
|
||||
|
||||
NSS 3.12.5 source is also available on ``ftp.mozilla.org`` for secure HTTPS download:
|
||||
|
||||
- Source tarball:
|
||||
https://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_12_5_RTM/src/.
|
||||
|
||||
.. container::
|
||||
:name: section_3
|
||||
|
||||
.. rubric:: New in NSS 3.12.5
|
||||
:name: New_in_NSS_3.12.5
|
||||
|
||||
.. container::
|
||||
:name: section_4
|
||||
|
||||
.. rubric:: SSL3 & TLS Renegotiation Vulnerability
|
||||
:name: SSL3_TLS_Renegotiation_Vulnerability
|
||||
|
||||
See `CVE-2009-3555 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3555>`__ and
|
||||
`US-CERT VU#120541 <http://www.kb.cert.org/vuls/id/120541>`__ for more information about
|
||||
this security vulnerability.
|
||||
|
||||
All SSL/TLS renegotiation is disabled by default in NSS 3.12.5. This will cause programs
|
||||
that attempt to perform renegotiation to experience failures where they formerly
|
||||
experienced successes, and is necessary for them to not be vulnerable, until such time
|
||||
as a new safe renegotiation scheme is standardized by the IETF.
|
||||
|
||||
If an application depends on renegotiation feature, it can be enabled by setting the
|
||||
environment variable NSS_SSL_ENABLE_RENEGOTIATION to 1. By setting this environmental
|
||||
variable, the fix provided by these patches will have no effect and the application may
|
||||
become vulnerable to the issue.
|
||||
|
||||
This default setting can also be changed within the application by using the following
|
||||
existing API functions:
|
||||
|
||||
-
|
||||
|
||||
- SECStatus SSL_OptionSet(PRFileDesc \*fd, PRInt32 option, PRBool on)
|
||||
- SECStatus SSL_OptionSetDefault(PRInt32 option, PRBool on)
|
||||
|
||||
- There is now a new value for "option", which is:
|
||||
|
||||
- SSL_ENABLE_RENEGOTIATION
|
||||
|
||||
The corresponding new values for SSL_ENABLE_RENEGOTIATION are:
|
||||
|
||||
- SSL_RENEGOTIATE_NEVER: Never renegotiate at all (default).
|
||||
- SSL_RENEGOTIATE_UNRESTRICTED: Renegotiate without restriction, whether or not the
|
||||
peer's client hello bears the renegotiation info extension (as we always did in
|
||||
the past). **UNSAFE**.
|
||||
|
||||
.. container::
|
||||
:name: section_5
|
||||
|
||||
.. rubric:: TLS compression
|
||||
:name: TLS_compression
|
||||
|
||||
- Enable TLS compression with:
|
||||
|
||||
- SSL_ENABLE_DEFLATE: Enable TLS compression with DEFLATE. Off by default. (See
|
||||
ssl.h)
|
||||
|
||||
Error codes:
|
||||
|
||||
- SSL_ERROR_DECOMPRESSION_FAILURE (see sslerr.h)
|
||||
- SSL_ERROR_RENEGOTIATION_NOT_ALLOWED (see sslerr.h)
|
||||
|
||||
.. container::
|
||||
:name: section_6
|
||||
|
||||
.. rubric:: New context initialization and shutdown functions
|
||||
:name: New_context_initialization_and_shutdown_functions
|
||||
|
||||
- See nss.h for details. The 2 new functions are:
|
||||
|
||||
- NSS_InitContext
|
||||
- NSS_ShutdownContext
|
||||
|
||||
Parameters for these functions are used to initialize softoken. These are mostly
|
||||
strings used to internationalize softoken. Memory for the strings are owned by the
|
||||
caller, who is free to free them once NSS_ContextInit returns. If the string
|
||||
parameter is NULL (as opposed to empty, zero length), then the softoken default is
|
||||
used. These are equivalent to the parameters for PK11_ConfigurePKCS11().
|
||||
|
||||
See the following struct in nss.h for details:
|
||||
|
||||
- NSSInitParametersStr
|
||||
|
||||
.. container::
|
||||
:name: section_7
|
||||
|
||||
.. rubric:: Other new functions
|
||||
:name: Other_new_functions
|
||||
|
||||
- *In secmod.h:*
|
||||
|
||||
- SECMOD_GetSkipFirstFlag
|
||||
- SECMOD_GetDefaultModDBFlag
|
||||
|
||||
*In prlink.h*
|
||||
|
||||
- NSS_SecureMemcmp
|
||||
- PORT_LoadLibraryFromOrigin
|
||||
|
||||
.. container::
|
||||
:name: section_8
|
||||
|
||||
.. rubric:: Modified functions
|
||||
:name: Modified_functions
|
||||
|
||||
- SGN_Update (see cryptohi.h)
|
||||
|
||||
- The parameter "input" of this function is changed from *unsigned char \** to
|
||||
*const unsigned char \**.
|
||||
|
||||
- PK11_ConfigurePKCS11 (see nss.h)
|
||||
|
||||
- The name of some parameters have been slightly changed ("des" became "desc").
|
||||
|
||||
.. container::
|
||||
:name: section_9
|
||||
|
||||
.. rubric:: Deprecated headers
|
||||
:name: Deprecated_headers
|
||||
|
||||
- The header file key.h is deprecated. Please use keyhi.h instead.
|
||||
|
||||
.. container::
|
||||
:name: section_10
|
||||
|
||||
.. rubric:: Additional documentation
|
||||
:name: Additional_documentation
|
||||
|
||||
- *In pk11pub.h:*
|
||||
|
||||
- The caller of PK11_DEREncodePublicKey should free the returned SECItem with a
|
||||
SECITEM_FreeItem(..., PR_TRUE) call.
|
||||
- PK11_ReadRawAttribute allocates the buffer for returning the attribute value. The
|
||||
caller of PK11_ReadRawAttribute should free the data buffer pointed to by item
|
||||
using a SECITEM_FreeItem(item, PR_FALSE) or PORT_Free(item->data) call.
|
||||
|
||||
*In secasn1.h:*
|
||||
|
||||
- If both pool and dest are NULL, the caller should free the returned SECItem with a
|
||||
SECITEM_FreeItem(..., PR_TRUE) call. If pool is NULL but dest is not NULL, the
|
||||
caller should free the data buffer pointed to by dest with a
|
||||
SECITEM_FreeItem(dest, PR_FALSE) or PORT_Free(dest->data) call.
|
||||
|
||||
.. container::
|
||||
:name: section_11
|
||||
|
||||
.. rubric:: Environment variables
|
||||
:name: Environment_variables
|
||||
|
||||
- NSS_FIPS
|
||||
|
||||
- Will start NSS in FIPS mode.
|
||||
|
||||
- NSS_SSL_ENABLE_RENEGOTIATION
|
||||
- NSS_SSL_REQUIRE_SAFE_NEGOTIATION
|
||||
|
||||
- See SSL3 & TLS Renegotiation Vulnerability.
|
||||
|
||||
.. container::
|
||||
:name: section_12
|
||||
|
||||
.. rubric:: Bugs Fixed
|
||||
:name: Bugs_Fixed
|
||||
|
||||
The following bugs have been fixed in NSS 3.12.5.
|
||||
|
||||
- `Bug 510435 <https://bugzilla.mozilla.org/show_bug.cgi?id=510435>`__: Remove unused make
|
||||
variable DSO_LDFLAGS
|
||||
- `Bug 510436 <https://bugzilla.mozilla.org/show_bug.cgi?id=510436>`__: Add macros for
|
||||
build numbers (4th component of version number) to nssutil.h
|
||||
- `Bug 511227 <https://bugzilla.mozilla.org/show_bug.cgi?id=511227>`__: Firefox 3.0.13
|
||||
fails to compile on FreeBSD/powerpc
|
||||
- `Bug 511312 <https://bugzilla.mozilla.org/show_bug.cgi?id=511312>`__: NSS fails to load
|
||||
softoken, looking for sqlite3.dll
|
||||
- `Bug 511781 <https://bugzilla.mozilla.org/show_bug.cgi?id=511781>`__: Add new TLS 1.2
|
||||
cipher suites implemented in Windows 7 to ssltap
|
||||
- `Bug 516101 <https://bugzilla.mozilla.org/show_bug.cgi?id=516101>`__: If PK11_ImportCert
|
||||
fails, it leaves the certificate undiscoverable by CERT_PKIXVerifyCert
|
||||
- `Bug 518443 <https://bugzilla.mozilla.org/show_bug.cgi?id=518443>`__:
|
||||
PK11_ImportAndReturnPrivateKey leaks an arena
|
||||
- `Bug 518446 <https://bugzilla.mozilla.org/show_bug.cgi?id=518446>`__:
|
||||
PK11_DEREncodePublicKey leaks a CERTSubjectPublicKeyInfo
|
||||
- `Bug 518457 <https://bugzilla.mozilla.org/show_bug.cgi?id=518457>`__:
|
||||
SECKEY_EncodeDERSubjectPublicKeyInfo and PK11_DEREncodePublicKey are duplicate
|
||||
- `Bug 522510 <https://bugzilla.mozilla.org/show_bug.cgi?id=522510>`__: Add deprecated
|
||||
comments to key.h and pk11func.h
|
||||
- `Bug 522580 <https://bugzilla.mozilla.org/show_bug.cgi?id=522580>`__: NSS uses
|
||||
PORT_Memcmp for comparing secret data.
|
||||
- `Bug 525056 <https://bugzilla.mozilla.org/show_bug.cgi?id=525056>`__: Timing attack
|
||||
against ssl3ext.c:ssl3_ServerHandleSessionTicketXtn()
|
||||
- `Bug 526689 <https://bugzilla.mozilla.org/show_bug.cgi?id=526689>`__: SSL3 & TLS
|
||||
Renegotiation Vulnerability
|
||||
|
||||
.. container::
|
||||
:name: section_13
|
||||
|
||||
.. rubric:: Documentation
|
||||
:name: Documentation
|
||||
|
||||
For a list of the primary NSS documentation pages on mozilla.org, see `NSS
|
||||
Documentation <https://www.mozilla.org/projects/security/pki/nss/#documentation>`__. New
|
||||
and revised documents available since the release of NSS 3.11 include the following:
|
||||
|
||||
- `Build Instructions <https://dev.mozilla.jp/localmdc/localmdc_5142.html>`__
|
||||
- `NSS Shared DB <http://wiki.mozilla.org/NSS_Shared_DB>`__
|
||||
|
||||
.. container::
|
||||
:name: section_14
|
||||
|
||||
.. rubric:: Compatibility
|
||||
:name: Compatibility
|
||||
|
||||
NSS 3.12.5 shared libraries are backward compatible with all older NSS 3.x shared
|
||||
libraries. A program linked with older NSS 3.x shared libraries will work with NSS 3.12.5
|
||||
shared libraries without recompiling or relinking. Furthermore, applications that restrict
|
||||
their use of NSS APIs to the functions listed in `NSS Public
|
||||
Functions <https://www.mozilla.org/projects/security/pki/nss/ref/nssfunctions.html>`__ will
|
||||
remain compatible with future versions of the NSS shared libraries.
|
||||
|
||||
.. container::
|
||||
:name: section_15
|
||||
|
||||
.. rubric:: Feedback
|
||||
:name: Feedback
|
||||
|
||||
Bugs discovered should be reported by filing a bug report with `mozilla.org
|
||||
Bugzilla <https://bugzilla.mozilla.org/>`__ (product NSS).
|
||||
|
||||
This document was generated by *genma teruaki* on *November 28, 2010* using `texi2html
|
||||
1.82 <http://www.nongnu.org/texi2html/>`__.
|
||||
|
|
@ -1,318 +0,0 @@
|
|||
.. _mozilla_projects_nss_nss_3_12_6_release_notes:
|
||||
|
||||
NSS 3.12.6 release notes
|
||||
========================
|
||||
|
||||
.. _nss_3.12.6_release_notes:
|
||||
|
||||
`NSS 3.12.6 release notes <#nss_3.12.6_release_notes>`__
|
||||
--------------------------------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
.. container::
|
||||
|
||||
2010-03-03
|
||||
*Newsgroup:*\ `mozilla.dev.tech.crypto <news://news.mozilla.org/mozilla.dev.tech.crypto>`__
|
||||
|
||||
.. container::
|
||||
:name: section_1
|
||||
|
||||
.. rubric:: Introduction
|
||||
:name: Introduction
|
||||
|
||||
Network Security Services (NSS) 3.12.6 is a patch release for NSS 3.12. The bug fixes in
|
||||
NSS 3.12.6 are described in the "`Bugs
|
||||
Fixed <http://mdn.beonex.com/en/NSS_3.12.6_release_notes.html#bugsfixed>`__" section below.
|
||||
|
||||
NSS 3.12.6 is tri-licensed under the MPL 1.1/GPL 2.0/LGPL 2.1.
|
||||
|
||||
.. container::
|
||||
:name: section_2
|
||||
|
||||
.. rubric:: Distribution Information
|
||||
:name: Distribution_Information
|
||||
|
||||
| The CVS tag for the NSS 3.12.6 release is ``NSS_3_12_6_RTM``. NSS 3.12.6 requires `NSPR
|
||||
4.8.4 <https://www.mozilla.org/projects/nspr/release-notes/>`__.
|
||||
| See the `Documentation <http://mdn.beonex.com/en/NSS_3.12.6_release_notes.html#docs>`__
|
||||
section for the build instructions.
|
||||
|
||||
NSS 3.12.6 source and binary distributions are also available on ``ftp.mozilla.org`` for
|
||||
secure HTTPS download:
|
||||
|
||||
- Source tarballs:
|
||||
https://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_12_6_RTM/src/.
|
||||
|
||||
| You also need to download the NSPR 4.8.4 binary distributions to get the NSPR 4.8.4
|
||||
header files and shared libraries, which NSS 3.12.6 requires. NSPR 4.8.4 binary
|
||||
distributions are in https://ftp.mozilla.org/pub/mozilla.org/nspr/releases/v4.8.4/.
|
||||
|
|
||||
|
||||
.. container::
|
||||
:name: section_3
|
||||
|
||||
.. rubric:: New in NSS 3.12.6
|
||||
:name: New_in_NSS_3.12.6
|
||||
|
||||
.. container::
|
||||
:name: section_4
|
||||
|
||||
.. rubric:: SSL3 & TLS Renegotiation Indication Extension (RFC 5746)
|
||||
:name: SSL3_TLS_Renegotiation_Indication_Extension_(RFC_5746)
|
||||
|
||||
- By default, NSS 3.12.6 uses the new TLS Renegotiation Indication Extension for TLS
|
||||
renegotiation but allows simple SSL/TLS connections (without renegotiation) with
|
||||
peers that don't support the TLS Renegotiation Indication Extension.
|
||||
|
||||
The behavior of NSS for renegotiation can be changed through API function calls, or
|
||||
with the following environment variables:
|
||||
|
||||
- NSS_SSL_ENABLE_RENEGOTIATION
|
||||
|
||||
- values:
|
||||
|
||||
- [0|n|N]: SSL_RENEGOTIATE_NEVER
|
||||
|
||||
- Never allow renegotiation - That was the default for 3.12.5 release.
|
||||
|
||||
- [1|u|U]: SSL_RENEGOTIATE_UNRESTRICTED
|
||||
|
||||
- Server and client are allowed to renegotiate without any restrictions.
|
||||
This setting was the default prior 3.12.5 and makes products vulnerable.
|
||||
|
||||
- [2|r|R]: SSL_RENEGOTIATE_REQUIRES_XTN (default)
|
||||
|
||||
- Only allows renegotiation if the peer's hello bears the TLS
|
||||
renegotiation_info extension. This is the safe renegotiation.
|
||||
|
||||
- [3|t|T]: SSL_RENEGOTIATE_TRANSITIONAL
|
||||
|
||||
- Disallows unsafe renegotiation in server sockets only, but allows clients
|
||||
to continue to renegotiate with vulnerable servers. This value should
|
||||
only be used during the transition period when few servers have been
|
||||
upgraded.
|
||||
|
||||
- NSS_SSL_REQUIRE_SAFE_NEGOTIATION
|
||||
|
||||
- values:
|
||||
|
||||
- 1: requireSafeNegotiation = TRUE
|
||||
- unset: requireSafeNegotiation = FALSE
|
||||
|
||||
Controls whether safe renegotiation indication is required for initial
|
||||
handshake. If TRUE, a connection will be dropped at initial handshake if the
|
||||
peer server or client does not support safe renegotiation. The default setting
|
||||
for this option is FALSE.
|
||||
|
||||
These options can also be set with the following SSL options:
|
||||
|
||||
- sslOptions.enableRenegotiation
|
||||
- sslOptions.requireSafeNegotiation
|
||||
- New pseudo cipher suite value: TLS_EMPTY_RENEGOTIATION_INFO_SCSV (cannot be
|
||||
negotiated)
|
||||
|
||||
.. container::
|
||||
:name: section_5
|
||||
|
||||
.. rubric:: TLS Server Name Indication for servers
|
||||
:name: TLS_Server_Name_Indication_for_servers
|
||||
|
||||
- | TLS Server Name Indication (SNI) for servers is almost fully implemented in NSS
|
||||
3.12.6.
|
||||
| See `bug 360421 <https://bugzilla.mozilla.org/show_bug.cgi?id=360421>`__ for
|
||||
details.
|
||||
|
||||
Note: The TLS Server Name Indication for clients is already fully implemented in NSS.
|
||||
|
||||
- New functions for SNI *(see ssl.h for more information)*:
|
||||
|
||||
- SSLSNISocketConfig
|
||||
|
||||
- Return values:
|
||||
|
||||
- SSL_SNI_CURRENT_CONFIG_IS_USED: libSSL must use the default cert and key.
|
||||
- SSL_SNI_SEND_ALERT: libSSL must send the "unrecognized_name" alert.
|
||||
|
||||
- SSL_SNISocketConfigHook
|
||||
- SSL_ReconfigFD
|
||||
- SSL_ConfigServerSessionIDCacheWithOpt
|
||||
- SSL_SetTrustAnchors
|
||||
- SSL_GetNegotiatedHostInfo
|
||||
|
||||
- New enum for SNI:
|
||||
|
||||
- SSLSniNameType *(see sslt.h)*
|
||||
|
||||
.. container::
|
||||
:name: section_6
|
||||
|
||||
.. rubric:: New functions
|
||||
:name: New_functions
|
||||
|
||||
- *in cert.h*
|
||||
|
||||
- CERTDistNames: Duplicate distinguished name array.
|
||||
- CERT_DistNamesFromCertList: Generate an array of Distinguished names from a list
|
||||
of certs.
|
||||
|
||||
*in ocsp.h*
|
||||
|
||||
- CERT_CacheOCSPResponseFromSideChannel:
|
||||
|
||||
- This function is intended for use when OCSP responses are provided via a
|
||||
side-channel, i.e. TLS OCSP stapling (a.k.a. the status_request extension).
|
||||
|
||||
*in ssl.h*
|
||||
|
||||
- SSL_GetImplementedCiphers
|
||||
- SSL_GetNumImplementedCiphers
|
||||
- SSL_HandshakeNegotiatedExtension
|
||||
|
||||
.. container::
|
||||
:name: section_7
|
||||
|
||||
.. rubric:: New error codes
|
||||
:name: New_error_codes
|
||||
|
||||
- *in sslerr.h*
|
||||
|
||||
- SSL_ERROR_UNSAFE_NEGOTIATION
|
||||
- SSL_ERROR_RX_UNEXPECTED_UNCOMPRESSED_RECORD
|
||||
|
||||
.. container::
|
||||
:name: section_8
|
||||
|
||||
.. rubric:: New types
|
||||
:name: New_types
|
||||
|
||||
- *in sslt.h*
|
||||
|
||||
- SSLExtensionType
|
||||
|
||||
.. container::
|
||||
:name: section_9
|
||||
|
||||
.. rubric:: New environment variables
|
||||
:name: New_environment_variables
|
||||
|
||||
- SQLITE_FORCE_PROXY_LOCKING
|
||||
|
||||
- 1 means force always use proxy, 0 means never use proxy, NULL means use proxy for
|
||||
non-local files only.
|
||||
|
||||
- SSLKEYLOGFILE
|
||||
|
||||
- Key log file. If set, NSS logs RSA pre-master secrets to this file. This allows
|
||||
packet sniffers to decrypt TLS connections.
|
||||
See `documentation <http://mdn.beonex.com/en/NSS_Key_Log_Format.html>`__.
|
||||
Note: The code must be built with TRACE defined to use this functionality.
|
||||
|
||||
.. container::
|
||||
:name: section_10
|
||||
|
||||
.. rubric:: Bugs Fixed
|
||||
:name: Bugs_Fixed
|
||||
|
||||
The following bugs have been fixed in NSS 3.12.6.
|
||||
|
||||
- `Bug 275744 <https://bugzilla.mozilla.org/show_bug.cgi?id=275744>`__: Support for TLS
|
||||
compression RFC 3749
|
||||
- `Bug 494603 <https://bugzilla.mozilla.org/show_bug.cgi?id=494603>`__: Update NSS's copy
|
||||
of sqlite3 to 3.6.22 to get numerous bug fixes
|
||||
- `Bug 496993 <https://bugzilla.mozilla.org/show_bug.cgi?id=496993>`__: Add accessor
|
||||
functions for SSL_ImplementedCiphers
|
||||
- `Bug 515279 <https://bugzilla.mozilla.org/show_bug.cgi?id=515279>`__:
|
||||
CERT_PKIXVerifyCert considers a certificate revoked if cert_ProcessOCSPResponse fails
|
||||
for any reason
|
||||
- `Bug 515870 <https://bugzilla.mozilla.org/show_bug.cgi?id=515870>`__: GCC compiler
|
||||
warnings in NSS 3.12.4
|
||||
- `Bug 518255 <https://bugzilla.mozilla.org/show_bug.cgi?id=518255>`__: The input buffer
|
||||
for SGN_Update should be declared const
|
||||
- `Bug 519550 <https://bugzilla.mozilla.org/show_bug.cgi?id=519550>`__: Allow the
|
||||
specification of an alternate library for SQLite
|
||||
- `Bug 524167 <https://bugzilla.mozilla.org/show_bug.cgi?id=524167>`__: Crash in [[@
|
||||
find_objects_by_template - nssToken_FindCertificateByIssuerAndSerialNumber]
|
||||
- `Bug 526910 <https://bugzilla.mozilla.org/show_bug.cgi?id=526910>`__: maxResponseLength
|
||||
(initialized to PKIX_DEFAULT_MAX_RESPONSE_LENGTH) is too small for downloading some
|
||||
CRLs.
|
||||
- `Bug 527759 <https://bugzilla.mozilla.org/show_bug.cgi?id=527759>`__: Add multiple roots
|
||||
to NSS (single patch)
|
||||
- `Bug 528741 <https://bugzilla.mozilla.org/show_bug.cgi?id=528741>`__: pkix_hash throws a
|
||||
null-argument exception on empty strings
|
||||
- `Bug 530907 <https://bugzilla.mozilla.org/show_bug.cgi?id=530907>`__: The peerID
|
||||
argument to SSL_SetSockPeerID should be declared const
|
||||
- `Bug 531188 <https://bugzilla.mozilla.org/show_bug.cgi?id=531188>`__: Decompression
|
||||
failure with https://livechat.merlin.pl/
|
||||
- `Bug 532417 <https://bugzilla.mozilla.org/show_bug.cgi?id=532417>`__: Build problem with
|
||||
spaces in path names
|
||||
- `Bug 534943 <https://bugzilla.mozilla.org/show_bug.cgi?id=534943>`__: Clean up the
|
||||
makefiles in lib/ckfw/builtins
|
||||
- `Bug 534945 <https://bugzilla.mozilla.org/show_bug.cgi?id=534945>`__: lib/dev does not
|
||||
need to include headers from lib/ckfw
|
||||
- `Bug 535669 <https://bugzilla.mozilla.org/show_bug.cgi?id=535669>`__: Move common
|
||||
makefile code in if and else to the outside
|
||||
- `Bug 536023 <https://bugzilla.mozilla.org/show_bug.cgi?id=536023>`__: DER_UTCTimeToTime
|
||||
and DER_GeneralizedTimeToTime ignore all bytes after an embedded null
|
||||
- `Bug 536474 <https://bugzilla.mozilla.org/show_bug.cgi?id=536474>`__: Add support for
|
||||
logging pre-master secrets
|
||||
- `Bug 537356 <https://bugzilla.mozilla.org/show_bug.cgi?id=537356>`__: Implement new safe
|
||||
SSL3 & TLS renegotiation
|
||||
- `Bug 537795 <https://bugzilla.mozilla.org/show_bug.cgi?id=537795>`__: NSS_InitContext
|
||||
does not work with NSS_RegisterShutdown
|
||||
- `Bug 537829 <https://bugzilla.mozilla.org/show_bug.cgi?id=537829>`__: Allow NSS to build
|
||||
for Android
|
||||
- `Bug 540304 <https://bugzilla.mozilla.org/show_bug.cgi?id=540304>`__: Implement
|
||||
SSL_HandshakeNegotiatedExtension
|
||||
- `Bug 541228 <https://bugzilla.mozilla.org/show_bug.cgi?id=541228>`__: Remove an obsolete
|
||||
NSPR version check in lib/util/secport.c
|
||||
- `Bug 541231 <https://bugzilla.mozilla.org/show_bug.cgi?id=541231>`__: nssinit.c doesn't
|
||||
need to include ssl.h and sslproto.h.
|
||||
- `Bug 542538 <https://bugzilla.mozilla.org/show_bug.cgi?id=542538>`__: NSS: Add function
|
||||
for recording OCSP stapled replies
|
||||
- `Bug 544191 <https://bugzilla.mozilla.org/show_bug.cgi?id=544191>`__: Use system zlib on
|
||||
Mac OS X
|
||||
- `Bug 544584 <https://bugzilla.mozilla.org/show_bug.cgi?id=544584>`__: segmentation fault
|
||||
when enumerating the nss database
|
||||
- `Bug 544586 <https://bugzilla.mozilla.org/show_bug.cgi?id=544586>`__: Various
|
||||
nss-sys-init patches from Fedora
|
||||
- `Bug 545273 <https://bugzilla.mozilla.org/show_bug.cgi?id=545273>`__: Remove unused
|
||||
function SEC_Init
|
||||
- `Bug 546389 <https://bugzilla.mozilla.org/show_bug.cgi?id=546389>`__: nsssysinit binary
|
||||
built inside source tree
|
||||
|
||||
.. container::
|
||||
:name: section_11
|
||||
|
||||
.. rubric:: Documentation
|
||||
:name: Documentation
|
||||
|
||||
For a list of the primary NSS documentation pages on mozilla.org, see `NSS
|
||||
Documentation <https://www.mozilla.org/projects/security/pki/nss/#documentation>`__. New
|
||||
and revised documents available since the release of NSS 3.11 include the following:
|
||||
|
||||
- `Build
|
||||
Instructions <http://mdn.beonex.com/en/NSS_reference/Building_and_installing_NSS/Build_instructions.html>`__
|
||||
- `NSS Shared DB <http://wiki.mozilla.org/NSS_Shared_DB>`__
|
||||
|
||||
.. container::
|
||||
:name: section_12
|
||||
|
||||
.. rubric:: Compatibility
|
||||
:name: Compatibility
|
||||
|
||||
NSS 3.12.6 shared libraries are backward compatible with all older NSS 3.x shared
|
||||
libraries. A program linked with older NSS 3.x shared libraries will work with NSS 3.12.6
|
||||
shared libraries without recompiling or relinking. Furthermore, applications that restrict
|
||||
their use of NSS APIs to the functions listed in `NSS Public
|
||||
Functions <https://www.mozilla.org/projects/security/pki/nss/ref/nssfunctions.html>`__ will
|
||||
remain compatible with future versions of the NSS shared libraries.
|
||||
|
||||
.. container::
|
||||
:name: section_13
|
||||
|
||||
.. rubric:: Feedback
|
||||
:name: Feedback
|
||||
|
||||
Bugs discovered should be reported by filing a bug report with `mozilla.org
|
||||
Bugzilla <https://bugzilla.mozilla.org/>`__ (product NSS).
|
||||
|
|
@ -1,144 +0,0 @@
|
|||
.. _:
|
||||
|
||||
NSS 3.12.9 release notes
|
||||
========================
|
||||
|
||||
.. _removed_functions:
|
||||
|
||||
`Removed functions <#removed_functions>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
2010-09-23
|
||||
*Newsgroup:*\ `mozilla.dev.tech.crypto <news://news.mozilla.org/mozilla.dev.tech.crypto>`__
|
||||
|
||||
.. container::
|
||||
:name: section_1
|
||||
|
||||
.. rubric:: Introduction
|
||||
:name: Introduction_2
|
||||
|
||||
Network Security Services (NSS) 3.12.9 is a patch release for NSS 3.12. The bug fixes in NSS
|
||||
3.12.9 are described in the "\ `Bugs Fixed <#bugsfixed>`__" section below.
|
||||
|
||||
NSS 3.12.9 is tri-licensed under the MPL 1.1/GPL 2.0/LGPL 2.1.
|
||||
|
||||
.. container::
|
||||
:name: section_2
|
||||
|
||||
.. rubric:: Distribution Information
|
||||
:name: Distribution_Information
|
||||
|
||||
| The CVS tag for the NSS 3.12.9 release is ``NSS_3.12.9_RTM``. NSS 3.12.9 requires `NSPR
|
||||
4.8.7 <https://www.mozilla.org/projects/nspr/release-notes/nspr486.html>`__.
|
||||
| See the `Documentation <#docs>`__ section for the build instructions.
|
||||
|
||||
NSS 3.12.9 source distribution is also available on ``ftp.mozilla.org`` for secure HTTPS
|
||||
download:
|
||||
|
||||
- Source tarballs:
|
||||
https://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3.12.9_RTM/src/.
|
||||
|
||||
You also need to download the NSPR 4.8.7 binary distributions to get the NSPR 4.8.7 header
|
||||
files and shared libraries, which NSS 3.12.9 requires. NSPR 4.8.7 binary distributions are in
|
||||
https://ftp.mozilla.org/pub/mozilla.org/nspr/releases/v4.8.7/.
|
||||
|
||||
.. container::
|
||||
:name: section_3
|
||||
|
||||
.. rubric:: New in NSS 3.12.9
|
||||
:name: New_in_NSS_3.12.9
|
||||
|
||||
.. container::
|
||||
:name: section_5
|
||||
|
||||
.. container::
|
||||
:name: section_6
|
||||
|
||||
.. rubric:: New SSL options
|
||||
:name: New_SSL_options
|
||||
|
||||
.. container::
|
||||
:name: section_7
|
||||
|
||||
.. rubric:: New error codes
|
||||
:name: New_error_codes
|
||||
|
||||
.. container::
|
||||
:name: section_8
|
||||
|
||||
.. rubric:: Bugs Fixed
|
||||
:name: Bugs_Fixed
|
||||
|
||||
The following bugs have been fixed in NSS 3.12.9.
|
||||
|
||||
- `Bug 609068 <https://bugzilla.mozilla.org/show_bug.cgi?id=609068>`__: Implement J-PAKE in
|
||||
FreeBL
|
||||
- `Bug 607058 <https://bugzilla.mozilla.org/show_bug.cgi?id=607058>`__: crash [@
|
||||
nss_cms_decoder_work_data]
|
||||
- `Bug 613394 <https://bugzilla.mozilla.org/show_bug.cgi?id=613394>`__: November/December
|
||||
2010 batch of NSS root CA changes
|
||||
- `Bug 610843 <https://bugzilla.mozilla.org/show_bug.cgi?id=610843>`__: Need way to recover
|
||||
softoken in child after fork()
|
||||
- `Bug 617492 <https://bugzilla.mozilla.org/show_bug.cgi?id=617492>`__: Add
|
||||
PK11_KeyGenWithTemplate function to pk11wrap (for Firefox Sync)
|
||||
- `Bug 610162 <https://bugzilla.mozilla.org/show_bug.cgi?id=610162>`__: SHA-512 and SHA-384
|
||||
hashes are incorrect for inputs of 512MB or larger when running under Windows and other
|
||||
32-bit platforms (Fx 3.6.12 and 4.0b6)
|
||||
- `Bug 518551 <https://bugzilla.mozilla.org/show_bug.cgi?id=518551>`__: Vfychain crashes in
|
||||
PKITS tests.
|
||||
- `Bug 536485 <https://bugzilla.mozilla.org/show_bug.cgi?id=536485>`__: crash during ssl
|
||||
handshake in [@ intel_aes_decrypt_cbc_256]
|
||||
- `Bug 444367 <https://bugzilla.mozilla.org/show_bug.cgi?id=444367>`__: NSS 3.12 softoken
|
||||
returns the certificate type of a certificate object as CKC_X_509_ATTR_CERT.
|
||||
- `Bug 620908 <https://bugzilla.mozilla.org/show_bug.cgi?id=620908>`__: certutil -T -d
|
||||
"sql:." dumps core
|
||||
- `Bug 584257 <https://bugzilla.mozilla.org/show_bug.cgi?id=584257>`__: Need a way to expand
|
||||
partial private keys.
|
||||
- `Bug 596798 <https://bugzilla.mozilla.org/show_bug.cgi?id=596798>`__: win_rand.c (among
|
||||
others) uses unsafe \_snwprintf
|
||||
- `Bug 597622 <https://bugzilla.mozilla.org/show_bug.cgi?id=597622>`__: Do not use the
|
||||
SEC_ERROR_BAD_INFO_ACCESS_LOCATION error code for bad CRL distribution point URLs
|
||||
- `Bug 619268 <https://bugzilla.mozilla.org/show_bug.cgi?id=619268>`__: Memory leaks in
|
||||
CERT_ChangeCertTrust and CERT_SaveSMimeProfile
|
||||
- `Bug 585518 <https://bugzilla.mozilla.org/show_bug.cgi?id=585518>`__: AddTrust Qualified CA
|
||||
Root serial wrong in certdata.txt trust entry
|
||||
- `Bug 337433 <https://bugzilla.mozilla.org/show_bug.cgi?id=337433>`__: Need
|
||||
CERT_FindCertByNicknameOrEmailAddrByUsage
|
||||
- `Bug 592939 <https://bugzilla.mozilla.org/show_bug.cgi?id=592939>`__: Expired CAs in
|
||||
certdata.txt
|
||||
|
||||
.. container::
|
||||
:name: section_9
|
||||
|
||||
.. rubric:: Documentation
|
||||
:name: Documentation
|
||||
|
||||
NSS Documentation. New and revised documents available since the release of NSS 3.11 include
|
||||
the following:
|
||||
|
||||
- `Build Instructions for NSS 3.11.4 and
|
||||
above <https://www-archive.mozilla.org/projects/security/pki/nss/nss-3.11.4/nss-3.11.4-build>`__
|
||||
- `NSS Shared DB <http://wiki.mozilla.org/NSS_Shared_DB>`__
|
||||
|
||||
.. container::
|
||||
:name: section_10
|
||||
|
||||
.. rubric:: Compatibility
|
||||
:name: Compatibility
|
||||
|
||||
NSS 3.12.9 shared libraries are backward compatible with all older NSS 3.x shared libraries. A
|
||||
program linked with older NSS 3.x shared libraries will work with NSS 3.12.9 shared libraries
|
||||
without recompiling or relinking. Furthermore, applications that restrict their use of NSS
|
||||
APIs to the functions listed in `NSS Public Functions </en-US/ref/nssfunctions.html>`__ will
|
||||
remain compatible with future versions of the NSS shared libraries.
|
||||
|
||||
.. container::
|
||||
:name: section_11
|
||||
|
||||
.. rubric:: Feedback
|
||||
:name: Feedback
|
||||
|
||||
Bugs discovered should be reported by filing a bug report with `mozilla.org
|
||||
Bugzilla <https://bugzilla.mozilla.org/>`__ (product NSS).
|
||||
|
|
@ -1,127 +0,0 @@
|
|||
.. _mozilla_projects_nss_nss_3_14_1_release_notes:
|
||||
|
||||
NSS 3.14.1 release notes
|
||||
========================
|
||||
|
||||
`Introduction <#introduction>`__
|
||||
--------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
Network Security Services (NSS) 3.14.1 is a patch release for NSS 3.14. The bug fixes in NSS
|
||||
3.14.1 are described in the "Bugs Fixed" section below.
|
||||
|
||||
NSS 3.14.1 is licensed under the MPL 2.0.
|
||||
|
||||
.. _distribution_information:
|
||||
|
||||
`Distribution Information <#distribution_information>`__
|
||||
--------------------------------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
The CVS tag is NSS_3_14_1_RTM. NSS 3.14.1 requires NSPR 4.9.4 or newer.
|
||||
|
||||
NSS 3.14.1 source distributions are also available on ftp.mozilla.org for secure HTTPS download:
|
||||
|
||||
- Source tarballs:
|
||||
https://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_14_1_RTM/src/
|
||||
|
||||
.. _new_in_nss_3.14.1:
|
||||
|
||||
`New in NSS 3.14.1 <#new_in_nss_3.14.1>`__
|
||||
------------------------------------------
|
||||
|
||||
.. _new_functionality:
|
||||
|
||||
`New Functionality <#new_functionality>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
- NSS now has the ability to create signed OCSP responses.
|
||||
|
||||
- The ability to create signed OCSP responses has been added in NSS 3.14.1. Note that this
|
||||
code is used primarily for purposes of testing.
|
||||
|
||||
.. rubric:: New Functions
|
||||
:name: new_functions
|
||||
|
||||
- *in ocspt.h*
|
||||
|
||||
- CERT_CreateOCSPSingleResponseGood
|
||||
- CERT_CreateOCSPSingleResponseUnknown
|
||||
- CERT_CreateOCSPSingleResponseRevoked
|
||||
- CERT_CreateEncodedOCSPSuccessResponse
|
||||
- CERT_CreateEncodedOCSPErrorResponse
|
||||
|
||||
.. rubric:: New Types
|
||||
:name: new_types
|
||||
|
||||
- *in ocspt.h*
|
||||
|
||||
- CERTOCSPResponderIDType
|
||||
|
||||
.. _notable_changes_in_nss_3.14.1:
|
||||
|
||||
`Notable Changes in NSS 3.14.1 <#notable_changes_in_nss_3.14.1>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
- Windows CE support has been removed from the code base.
|
||||
- `Bug 812399 <https://bugzilla.mozilla.org/show_bug.cgi?id=812399>`__ - In NSS 3.14, a
|
||||
regression caused `Bug 641052 <https://bugzilla.mozilla.org/show_bug.cgi?id=641052>`__ /
|
||||
CVE-2011-3640 to be re-introduced under certain situations. This regression only affected
|
||||
applications that initialize NSS via the NSS_NoDB_Init function. NSS 3.14.1 includes the
|
||||
complete fix for this issue.
|
||||
- `Bug 357025 <https://bugzilla.mozilla.org/show_bug.cgi?id=357025>`__ - NSS 3.14 added support
|
||||
for tokens that make use of CKA_ALWAYS_AUTHENTICATE. However, when authenticating with such
|
||||
tokens, it was possible for an internal lock to be acquired twice, causing a hang. This hang
|
||||
has been fixed in NSS 3.14.1.
|
||||
- `Bug 802429 <https://bugzilla.mozilla.org/show_bug.cgi?id=802429>`__ - In previous versions of
|
||||
NSS, the "cipherOrder" slot configuration flag was not respected, causing the most recently
|
||||
added slot that supported the requested PKCS#11 mechanism to be used instead. NSS now
|
||||
correctly respects the supplied cipherOrder.
|
||||
Applications which use multiple PKCS#11 modules, which do not indicate which tokens should be
|
||||
used by default for particular algorithms, and which do make use of cipherOrder may now find
|
||||
that cryptographic operations occur on a different PKCS#11 token.
|
||||
- `Bug 802429 <https://bugzilla.mozilla.org/show_bug.cgi?id=802429>`__ - The NSS softoken is now
|
||||
the default token for SHA-256 and SHA-512. In previous versions of NSS, these algorithms would
|
||||
be handled by the most recently added PKCS#11 token that supported them.
|
||||
- `Bug 611451 <https://bugzilla.mozilla.org/show_bug.cgi?id=611451>`__ - When built with the
|
||||
current version of Apple XCode on Mac OS X, the NSS shared libraries will now only export the
|
||||
public NSS functions.
|
||||
- `Bug 810582 <https://bugzilla.mozilla.org/show_bug.cgi?id=810582>`__ - TLS False Start is now
|
||||
only used with servers that negotiate a cipher suite that supports forward secrecy.
|
||||
**Note**: The criteria for False Start may change again in future NSS releases.
|
||||
|
||||
.. _bugs_fixed_in_nss_3.14.1:
|
||||
|
||||
`Bugs fixed in NSS 3.14.1 <#bugs_fixed_in_nss_3.14.1>`__
|
||||
--------------------------------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
The following Bugzilla query returns all of the bugs fixed in NSS 3.14.1:
|
||||
|
||||
https://bugzilla.mozilla.org/buglist.cgi?list_id=5216669;resolution=FIXED;query_format=advanced;bug_status=RESOLVED;bug_status=VERIFIED;target_milestone=3.14.1;product=NSS
|
||||
|
||||
`Compatability <#compatability>`__
|
||||
----------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
NSS 3.14.1 shared libraries are backward compatible with all older NSS 3.x shared libraries. A
|
||||
program linked with older NSS 3.x shared libraries will work with NSS 3.14.1 shared libraries
|
||||
without recompiling or relinking. Furthermore, applications that restrict their use of NSS APIs
|
||||
to the functions listed in NSS Public Functions will remain compatible with future versions of
|
||||
the NSS shared libraries.
|
||||
|
||||
`Feedback <#feedback>`__
|
||||
------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
Bugs discovered in this release should be reported by filing a bug report at
|
||||
https://bugzilla.mozilla.org with the Product of NSS.
|
||||
|
|
@ -1,103 +0,0 @@
|
|||
.. _mozilla_projects_nss_nss_3_14_2_release_notes:
|
||||
|
||||
NSS 3.14.2 release notes
|
||||
========================
|
||||
|
||||
.. container::
|
||||
|
||||
Network Security Services (NSS) 3.14.2 is a patch release for NSS 3.14. The bug fixes in NSS
|
||||
3.14.2 are described in the "Bugs Fixed" section below. NSS 3.14.2 should be used with NSPR 4.9.5
|
||||
or newer.
|
||||
|
||||
The release is available for download from
|
||||
https://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_14_2_RTM/src/
|
||||
|
||||
For the primary NSS documentation pages please visit :ref:`mozilla_projects_nss`
|
||||
|
||||
.. _new_in_nss_3.14.2:
|
||||
|
||||
`New in NSS 3.14.2 <#new_in_nss_3.14.2>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
- NSS will now make use of the Intel AES-NI and AVX instruction sets for hardware-accelerated
|
||||
AES-GCM on 64-bit Linux systems. Note: the new assembly code requires GNU as version 2.19 or
|
||||
newer. On Red Hat Enterprise Linux 5.x systems, install the binutils220 package and add
|
||||
/usr/libexec/binutils220 to the beginning of your PATH environment variable.
|
||||
- Initial manual pages for some NSS command line tools have been added. They are still under
|
||||
review, and contributions are welcome. The documentation is in the docbook format and can be
|
||||
rendered as HTML and UNIX-style manual pages using an optional build target.
|
||||
|
||||
.. rubric:: New Types:
|
||||
:name: new_types
|
||||
|
||||
- in certt.h
|
||||
|
||||
- ``cert_pi_useOnlyTrustAnchors``
|
||||
|
||||
- in secoidt.h
|
||||
|
||||
- ``SEC_OID_MS_EXT_KEY_USAGE_CTL_SIGNING``
|
||||
|
||||
.. _notable_changes_in_nss_3.14.2:
|
||||
|
||||
`Notable Changes in NSS 3.14.2 <#notable_changes_in_nss_3.14.2>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
- Bug 805604 - Support for AES-NI and AVX accelerated AES-GCM was contributed by Shay Gueron of
|
||||
Intel. If compiled on Linux systems in 64-bit mode, NSS will include runtime detection to
|
||||
check if the platform supports AES-NI and PCLMULQDQ. If so, NSS uses the optimized code path,
|
||||
reducing the CPU cycles per byte to 1/20 of what was required before the patch
|
||||
(https://bugzilla.mozilla.org/show_bug.cgi?id=805604 and
|
||||
https://crypto.stanford.edu/RealWorldCrypto/slides/gueron.pdf). Support for other platforms,
|
||||
such as Windows, will follow in a future NSS release.
|
||||
(https://bugzilla.mozilla.org/show_bug.cgi?id=540986)
|
||||
- SQLite has been updated to 3.7.15. Note: please apply the patch in
|
||||
https://bugzilla.mozilla.org/show_bug.cgi?id=837799 if you build NSS with the system SQLite
|
||||
library and your system SQLite library is older than 3.7.15.
|
||||
- Bug 816853 - When using libpkix for certificate validation, applications may now supply
|
||||
additional application-defined trust anchors to be used in addition to those from loaded
|
||||
security tokens, rather than as an alternative to.
|
||||
(https://bugzilla.mozilla.org/show_bug.cgi?id=816853)
|
||||
- Bug 772144 - Basic support for running NSS test suites on Android devices.This is currently
|
||||
limited to running tests from a Linux host machine using an SSH connection. Only the SSHDroid
|
||||
app has been tested.
|
||||
- Bug 373108 - Fixed a bug where, under certain circumstances, when applications supplied
|
||||
invalid/out-of-bounds parameters for AES encryption, a double free may occur.
|
||||
- Bug 813857 - Modification of certificate trust flags from multiple threads is now a
|
||||
thread-safe operation.
|
||||
- Bug 618418 - C_Decrypt/C_DecryptFinal now correctly validate the PKCS #7 padding when present.
|
||||
- Bug 807890 - Added support for Microsoft Trust List Signing EKU.
|
||||
- Bug 822433 - Fixed a crash in dtls_FreeHandshakeMessages.
|
||||
- Bug 823336 - Reject invalid LDAP AIA URIs sooner.
|
||||
|
||||
.. _bugs_fixed_in_nss_3.14.2:
|
||||
|
||||
`Bugs Fixed in NSS 3.14.2 <#bugs_fixed_in_nss_3.14.2>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
- https://bugzilla.mozilla.org/buglist.cgi?list_id=5502456;resolution=FIXED;classification=Components;query_format=advanced;target_milestone=3.14.2;product=NSS
|
||||
|
||||
`Compatibility <#compatibility>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
NSS 3.14.2 shared libraries are backward compatible with all older NSS 3.x shared libraries. A
|
||||
program linked with older NSS 3.x shared libraries will work with NSS 3.14.2 shared libraries
|
||||
without recompiling or relinking. Furthermore, applications that restrict their use of NSS APIs
|
||||
to the functions listed in NSS Public Functions will remain compatible with future versions of
|
||||
the NSS shared libraries.
|
||||
|
||||
`Feedback <#feedback>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
Bugs discovered should be reported by filing a bug report with
|
||||
`bugzilla.mozilla.org <http://bugzilla.mozilla.org/>`__ (product NSS).
|
||||
|
|
@ -1,132 +0,0 @@
|
|||
.. _mozilla_projects_nss_nss_3_14_3_release_notes:
|
||||
|
||||
NSS 3.14.3 release notes
|
||||
========================
|
||||
|
||||
`Introduction <#introduction>`__
|
||||
--------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
Network Security Services (NSS) 3.14.3 is a patch release for NSS 3.14. The bug fixes in NSS
|
||||
3.14.3 are described in the "Bugs Fixed" section below.
|
||||
|
||||
.. _distribution_information:
|
||||
|
||||
`Distribution Information <#distribution_information>`__
|
||||
--------------------------------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
The CVS tag is NSS_3_14_3_RTM. NSS 3.14.3 requires NSPR 4.9.5 or newer.
|
||||
|
||||
NSS 3.14.3 source distributions are also available on ftp.mozilla.org for secure HTTPS download:
|
||||
|
||||
- Source tarballs:
|
||||
https://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_14_3_RTM/src/
|
||||
|
||||
.. _new_in_nss_3.14.3:
|
||||
|
||||
`New in NSS 3.14.3 <#new_in_nss_3.14.3>`__
|
||||
------------------------------------------
|
||||
|
||||
.. _new_functionality:
|
||||
|
||||
`New Functionality <#new_functionality>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
- No new major functionality is introduced in this release. This release is a patch release to
|
||||
address `CVE-2013-1620 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1620>`__.
|
||||
|
||||
.. rubric:: New Functions
|
||||
:name: new_functions
|
||||
|
||||
- *in pk11pub.h*
|
||||
|
||||
- **PK11_SignWithSymKey** - Similar to PK11_Sign, performs a signing operation in a single
|
||||
operation. However, unlike PK11_Sign, which uses a *SECKEYPrivateKey*, PK11_SignWithSymKey
|
||||
performs the signature using a symmetric key, such as commonly used for generating MACs.
|
||||
|
||||
.. rubric:: New Types
|
||||
:name: new_types
|
||||
|
||||
- *CK_NSS_MAC_CONSTANT_TIME_PARAMS* - Parameters for use with *CKM_NSS_HMAC_CONSTANT_TIME* and
|
||||
*CKM_NSS_SSL3_MAC_CONSTANT_TIME*.
|
||||
|
||||
.. rubric:: New PKCS #11 Mechanisms
|
||||
:name: new_pkcs_11_mechanisms
|
||||
|
||||
- *CKM_NSS_HMAC_CONSTANT_TIME* - Constant-time HMAC operation for use when verifying a padded,
|
||||
MAC-then-encrypted block of data.
|
||||
- *CKM_NSS_SSL3_MAC_CONSTANT_TIME* - Constant-time MAC operation for use when verifying a
|
||||
padded, MAC-then-encrypted block of data using the SSLv3 MAC.
|
||||
|
||||
.. _notable_changes_in_nss_3.14.3:
|
||||
|
||||
`Notable Changes in NSS 3.14.3 <#notable_changes_in_nss_3.14.3>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
- `CVE-2013-1620 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1620>`__
|
||||
|
||||
Recent research by Nadhem AlFardan and Kenny Patterson has highlighted a weakness in the
|
||||
handling of CBC padding as used in SSL, TLS, and DTLS that allows an attacker to exploit
|
||||
timing differences in MAC processing. The details of their research and the attack can be
|
||||
found at http://www.isg.rhul.ac.uk/tls/, and has been referred to as "Lucky Thirteen".
|
||||
|
||||
NSS 3.14.3 includes changes to the *softoken* and *ssl* libraries to address and mitigate
|
||||
these attacks, contributed by Adam Langley of Google. This attack is mitigated when using NSS
|
||||
3.14.3 with an NSS Cryptographic Module ("softoken") version 3.14.3 or later. However, this
|
||||
attack is only partially mitigated if NSS 3.14.3 is used with the current FIPS validated `NSS
|
||||
Cryptographic
|
||||
Module <http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/1401val2012.htm#1837>`__, version
|
||||
3.12.9.1.
|
||||
|
||||
- `Bug 840714 <https://bugzilla.mozilla.org/show_bug.cgi?id=840714>`__ - "certutil -a" was not
|
||||
correctly producing ASCII output as requested.
|
||||
|
||||
- `Bug 837799 <https://bugzilla.mozilla.org/show_bug.cgi?id=837799>`__ - NSS 3.14.2 broke
|
||||
compilation with older versions of sqlite that lacked the SQLITE_FCNTL_TEMPFILENAME file
|
||||
control. NSS 3.14.3 now properly compiles when used with older versions of sqlite.
|
||||
|
||||
`Acknowledgements <#acknowledgements>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
The NSS development team would like to thank Nadhem AlFardan and Kenny Patterson (Royal Holloway,
|
||||
University of London) for responsibly disclosing the issue by providing advance copies of their
|
||||
research. In addition, thanks to Adam Langley (Google) for the development of a mitigation for
|
||||
the issues raised in the paper, along with Emilia Kasper and Bodo Möller (Google) for assisting
|
||||
in the review and improvements to the initial patches.
|
||||
|
||||
.. _bugs_fixed_in_nss_3.14.3:
|
||||
|
||||
`Bugs fixed in NSS 3.14.3 <#bugs_fixed_in_nss_3.14.3>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
- https://bugzilla.mozilla.org/buglist.cgi?list_id=5689256;resolution=FIXED;classification=Components;query_format=advanced;target_milestone=3.14.3;product=NSS
|
||||
|
||||
`Compatibility <#compatibility>`__
|
||||
----------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
NSS 3.14.3 shared libraries are backward compatible with all older NSS 3.x shared libraries. A
|
||||
program linked with older NSS 3.x shared libraries will work with NSS 3.14.3 shared libraries
|
||||
without recompiling or relinking. Furthermore, applications that restrict their use of NSS APIs
|
||||
to the functions listed in NSS Public Functions will remain compatible with future versions of
|
||||
the NSS shared libraries.
|
||||
|
||||
`Feedback <#feedback>`__
|
||||
------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
Bugs discovered should be reported by filing a bug report with
|
||||
`bugzilla.mozilla.org <https://bugzilla.mozilla.org/enter_bug.cgi?product=NSS>`__ (product NSS).
|
||||
|
|
@ -1,82 +0,0 @@
|
|||
.. _mozilla_projects_nss_nss_3_14_4_release_notes:
|
||||
|
||||
NSS 3.14.4 release notes
|
||||
========================
|
||||
|
||||
`Introduction <#introduction>`__
|
||||
--------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
Network Security Services (NSS) 3.14.4 is a patch release for NSS 3.14. The bug fixes in NSS
|
||||
3.14.4 are described in the "Bugs Fixed" section below.
|
||||
|
||||
.. _distribution_information:
|
||||
|
||||
`Distribution Information <#distribution_information>`__
|
||||
--------------------------------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
The CVS tag is NSS_3_14_4_RTM. NSS 3.14.4 requires NSPR 4.9.5 or newer.
|
||||
|
||||
NSS 3.14.4 source distributions are also available on ftp.mozilla.org for secure HTTPS download:
|
||||
|
||||
- Source tarballs:
|
||||
https://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_14_4_RTM/src/
|
||||
|
||||
.. _security_advisories:
|
||||
|
||||
`Security Advisories <#security_advisories>`__
|
||||
----------------------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
The following security-relevant bugs have been resolved in NSS 3.14.4. Users are encouraged to
|
||||
upgrade immediately.
|
||||
|
||||
- `Bug 894370 <https://bugzilla.mozilla.org/show_bug.cgi?id=894370>`__ - (CVE-2013-1739) Avoid
|
||||
uninitialized data read in the event of a decryption failure.
|
||||
|
||||
.. _new_in_nss_3.14.4:
|
||||
|
||||
`New in NSS 3.14.4 <#new_in_nss_3.14.4>`__
|
||||
------------------------------------------
|
||||
|
||||
.. _new_functionality:
|
||||
|
||||
`New Functionality <#new_functionality>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
- No new major functionality is introduced in this release. This release is a patch release to
|
||||
address `CVE-2013-1739 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1739>`__.
|
||||
|
||||
.. _bugs_fixed_in_nss_3.14.4:
|
||||
|
||||
`Bugs fixed in NSS 3.14.4 <#bugs_fixed_in_nss_3.14.4>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=894370%2C832942%2C863947&bug_id_type=anyexact&list_id=8338081&resolution=FIXED&classification=Components&query_format=advanced&product=NSS
|
||||
|
||||
`Compatibility <#compatibility>`__
|
||||
----------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
NSS 3.14.4 shared libraries are backward compatible with all older NSS 3.x shared libraries. A
|
||||
program linked with older NSS 3.x shared libraries will work with NSS 3.14.4 shared libraries
|
||||
without recompiling or relinking. Furthermore, applications that restrict their use of NSS APIs
|
||||
to the functions listed in NSS Public Functions will remain compatible with future versions of
|
||||
the NSS shared libraries.
|
||||
|
||||
`Feedback <#feedback>`__
|
||||
------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
Bugs discovered should be reported by filing a bug report with
|
||||
`bugzilla.mozilla.org <https://bugzilla.mozilla.org/enter_bug.cgi?product=NSS>`__ (product NSS).
|
||||
|
|
@ -1,82 +0,0 @@
|
|||
.. _mozilla_projects_nss_nss_3_14_5_release_notes:
|
||||
|
||||
NSS 3.14.5 release notes
|
||||
========================
|
||||
|
||||
`Introduction <#introduction>`__
|
||||
--------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
Network Security Services (NSS) 3.14.5 is a patch release for NSS 3.14. The bug fixes in NSS
|
||||
3.14.5 are described in the "Bugs Fixed" section below.
|
||||
|
||||
.. _distribution_information:
|
||||
|
||||
`Distribution Information <#distribution_information>`__
|
||||
--------------------------------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
The CVS tag is NSS_3_14_5_RTM. NSS 3.14.5 requires NSPR 4.9.5 or newer.
|
||||
|
||||
NSS 3.14.5 source distributions are also available on ftp.mozilla.org for secure HTTPS download:
|
||||
|
||||
- Source tarballs:
|
||||
https://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_14_5_RTM/src/
|
||||
|
||||
.. _security_advisories:
|
||||
|
||||
`Security Advisories <#security_advisories>`__
|
||||
----------------------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
The following security-relevant bugs have been resolved in NSS 3.14.5. Users are encouraged to
|
||||
upgrade immediately.
|
||||
|
||||
- `Bug 934016 <https://bugzilla.mozilla.org/show_bug.cgi?id=934016>`__ - (CVE-2013-5605) Handle
|
||||
invalid handshake packets
|
||||
|
||||
.. _new_in_nss_3.14.5:
|
||||
|
||||
`New in NSS 3.14.5 <#new_in_nss_3.14.5>`__
|
||||
------------------------------------------
|
||||
|
||||
.. _new_functionality:
|
||||
|
||||
`New Functionality <#new_functionality>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
- No new major functionality is introduced in this release. This release is a patch release to
|
||||
address `CVE-2013-5605 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5605>`__.
|
||||
|
||||
.. _bugs_fixed_in_nss_3.14.5:
|
||||
|
||||
`Bugs fixed in NSS 3.14.5 <#bugs_fixed_in_nss_3.14.5>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=934016&bug_id_type=anyexact&resolution=FIXED&classification=Components&query_format=advanced&product=NSS
|
||||
|
||||
`Compatibility <#compatibility>`__
|
||||
----------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
NSS 3.14.5 shared libraries are backward compatible with all older NSS 3.x shared libraries. A
|
||||
program linked with older NSS 3.x shared libraries will work with NSS 3.14.5 shared libraries
|
||||
without recompiling or relinking. Furthermore, applications that restrict their use of NSS APIs
|
||||
to the functions listed in NSS Public Functions will remain compatible with future versions of
|
||||
the NSS shared libraries.
|
||||
|
||||
`Feedback <#feedback>`__
|
||||
------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
Bugs discovered should be reported by filing a bug report with
|
||||
`bugzilla.mozilla.org <https://bugzilla.mozilla.org/enter_bug.cgi?product=NSS>`__ (product NSS).
|
||||
|
|
@ -1,174 +0,0 @@
|
|||
.. _mozilla_projects_nss_nss_3_14_release_notes:
|
||||
|
||||
NSS 3.14 release notes
|
||||
======================
|
||||
|
||||
`Introduction <#introduction>`__
|
||||
--------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
The NSS team has released Network Security Services (NSS) 3.14, which is a minor release with the
|
||||
following new features:
|
||||
|
||||
- Support for TLS 1.1 (RFC 4346)
|
||||
- Experimental support for DTLS 1.0 (RFC 4347) and DTLS-SRTP (RFC 5764)
|
||||
- Support for AES-CTR, AES-CTS, and AES-GCM
|
||||
- Support for Keying Material Exporters for TLS (RFC 5705)
|
||||
|
||||
In addition to the above new features, the following major changes have been introduced:
|
||||
|
||||
- Support for certificate signatures using the MD5 hash algorithm is now disabled by default.
|
||||
- The NSS license has changed to MPL 2.0. Previous releases were released under a MPL 1.1/GPL
|
||||
2.0/LGPL 2.1 tri-license. For more information about MPL 2.0, please see
|
||||
http://www.mozilla.org/MPL/2.0/FAQ.html. For an additional explantation on GPL/LGPL
|
||||
compatibility, see security/nss/COPYING in the source code.
|
||||
- Export and DES cipher suites are disabled by default. Non-ECC AES and Triple DES cipher suites
|
||||
are enabled by default.
|
||||
|
||||
NSS 3.14 source tarballs can be downloaded from
|
||||
https://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_14_RTM/src/. The CVS tag is
|
||||
NSS_3_14_RTM.
|
||||
|
||||
.. _new_in_nss_3.14:
|
||||
|
||||
`New in NSS 3.14 <#new_in_nss_3.14>`__
|
||||
--------------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
The sections that follow discuss specific changes in NSS 3.14 in more detail.
|
||||
|
||||
- Support for TLS 1.1 (RFC 4346) has been added
|
||||
(https://bugzilla.mozilla.org/show_bug.cgi?id=565047).
|
||||
|
||||
.. container::
|
||||
|
||||
To better support TLS 1.1 and future versions of TLS, a new version range API was
|
||||
introduced to allow applications to specify the desired minimum and maximum versions. These
|
||||
functions are intended to replace the now-deprecated use of the SSL_ENABLE_SSL3 and
|
||||
SSL_ENABLE_TLS socket options. The following functions have been added to the libssl
|
||||
library included in NSS 3.14
|
||||
|
||||
- SSL_VersionRangeGet (in ssl.h)
|
||||
- SSL_VersionRangeGetDefault (in ssl.h)
|
||||
- SSL_VersionRangeGetSupported (in ssl.h)
|
||||
- SSL_VersionRangeSet (in ssl.h)
|
||||
- SSL_VersionRangeSetDefault (in ssl.h)
|
||||
|
||||
- To better ensure interoperability with peers that support TLS 1.1, NSS has altered how it
|
||||
handles certain SSL protocol layer events. Such changes may present interoperability concerns
|
||||
when enabling TLS 1.1.
|
||||
|
||||
.. container::
|
||||
|
||||
- When connecting to a server, the record layer version of the initial ClientHello will be
|
||||
at most { 3, 1 } (TLS 1.0), even when attempting to negotiate TLS 1.1
|
||||
(https://bugzilla.mozilla.org/show_bug.cgi?id=774547)
|
||||
- The choice of client_version sent during renegotiations has changed. See the
|
||||
"`Changes <#changes>`__" section below.
|
||||
|
||||
- Experimental Support for DTLS (RFC 4347) and DTLS-SRTP (RFC 5764)
|
||||
|
||||
DTLS client and server support has been added in NSS 3.14. Because the test coverage and
|
||||
interoperability testing is not yet at the same level as other NSS code, this feature should
|
||||
be considered "experimental" and may contain bugs.
|
||||
|
||||
The following functions have been added to the libssl library included in NSS 3.14:
|
||||
|
||||
- DTLS_ImportFD (in ssl.h)
|
||||
- DTLS_GetHandshakeTimeout (in ssl.h)
|
||||
- SSL_GetSRTPCipher (in ssl.h)
|
||||
- SSL_SetRTPCiphers (in ssl.h)
|
||||
|
||||
- Support for AES-GCM
|
||||
|
||||
.. container::
|
||||
|
||||
Support for AES-GCM has been added to the NSS PKCS #11 module (softoken), based upon the
|
||||
draft 7 of PKCS #11 v2.30.
|
||||
|
||||
**WARNING**: Because of ambiguity in the current draft text, applications should ONLY use
|
||||
GCM in single-part mode (C_Encrypt/C_Decrypt). They should NOT use multi-part APIs
|
||||
(C_EncryptUpdate/C_DecryptUpdate).
|
||||
|
||||
- Support for application-defined certificate chain validation callback when using libpkix
|
||||
|
||||
.. container::
|
||||
|
||||
To better support per-application security policies, a new callback has been added for
|
||||
applications that use libpkix to verify certificates. Applications may use this callback to
|
||||
inform libpkix whether or not candidate certificate chains meet application-specific
|
||||
security policies, allowing libpkix to continue discovering certificate paths until it can
|
||||
find a chain that satisfies the policies.
|
||||
|
||||
The following types have been added in NSS 3.14
|
||||
|
||||
- CERTChainVerifyCallback (in certt.h)
|
||||
- CERTChainVerifyCallbackFunc (in certt.h)
|
||||
- cert_pi_chainVerifyCallback, a new option for CERTValParamInType (in certt.h)
|
||||
- A new error code: SEC_ERROR_APPLICATION_CALLBACK_ERROR (in secerr.h)
|
||||
|
||||
- New for PKCS #11
|
||||
|
||||
.. container::
|
||||
|
||||
PKCS #11 mechanisms:
|
||||
|
||||
- CKM_AES_CTS
|
||||
- CKM_AES_CTR
|
||||
- CKM_AES_GCM (see warnings against using C_EncryptUpdate/C_DecryptUpdate above)
|
||||
- CKM_SHA224_KEY_DERIVATION
|
||||
- CKM_SHA256_KEY_DERIVATION
|
||||
- CKM_SHA384_KEY_DERIVATION
|
||||
- CKM_SHA512_KEY_DERIVATION
|
||||
|
||||
Changes in NSS 3.14
|
||||
|
||||
.. _changes_in_nss_3.14:
|
||||
|
||||
`Changes in NSS 3.14 <#changes_in_nss_3.14>`__
|
||||
----------------------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
- `Bug 333601 <https://bugzilla.mozilla.org/show_bug.cgi?id=333601>`__ - Performance
|
||||
enhancements for Intel Macs
|
||||
|
||||
When building for Intel Macs, NSS will now take advantage of optimized assembly code for
|
||||
common operations. These changes have the observed effect of doubling RSA performance.
|
||||
|
||||
- `Bug 792681 <https://bugzilla.mozilla.org/show_bug.cgi?id=792681>`__ - New default cipher
|
||||
suites
|
||||
|
||||
The default cipher suites in NSS 3.14 have been changed to better reflect the current security
|
||||
landscape. The defaults now better match the set that most major Web browsers enable by
|
||||
default.
|
||||
|
||||
- `Bug 783448 <https://bugzilla.mozilla.org/show_bug.cgi?id=783448>`__ - When performing an SSL
|
||||
renegotiation, the client_version that is sent in the renegotiation ClientHello will be set to
|
||||
match the client_version that was sent in the initial ClientHello. This is needed for
|
||||
compatibility with IIS.
|
||||
|
||||
- Certificate signatures that make use of the MD5 hash algorithm will now be rejected by
|
||||
default. Support for MD5 may be manually enabled (but is discouraged) by setting the
|
||||
environment variable of "NSS_HASH_ALG_SUPPORT=+MD5" or by using the NSS_SetAlgorithmPolicy
|
||||
function. Note that SSL cipher suites with "MD5" in their names are NOT disabled by this
|
||||
change; those cipher suites use HMAC-MD5, not plain MD5, and are still considered safe.
|
||||
|
||||
- Maximum key sizes for RSA and Diffie-Hellman keys have been increased to 16K bits.
|
||||
|
||||
- Command line utilities tstclnt, strsclnt, and selfserv have changed. The old options to
|
||||
disable SSL 2, SSL 3 and TLS 1.0 have been removed and replaced with a new -V option that
|
||||
specifies the enabled range of protocol versions (see usage output of those tools).
|
||||
|
||||
.. _bugs_fixed_in_nss_3.14:
|
||||
|
||||
`Bugs fixed in NSS 3.14 <#bugs_fixed_in_nss_3.14>`__
|
||||
----------------------------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
This Bugzilla query returns all the bugs fixed in NSS 3.14:
|
||||
|
||||
https://bugzilla.mozilla.org/buglist.cgi?list_id=4643675;resolution=FIXED;classification=Components;query_format=advanced;product=NSS;target_milestone=3.14
|
||||
|
|
@ -1,131 +0,0 @@
|
|||
.. _mozilla_projects_nss_nss_3_15_1_release_notes:
|
||||
|
||||
NSS 3.15.1 release notes
|
||||
========================
|
||||
|
||||
`Introduction <#introduction>`__
|
||||
--------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
Network Security Services (NSS) 3.15.1 is a patch release for NSS 3.15. The bug fixes in NSS
|
||||
3.15.1 are described in the "Bugs Fixed" section below.
|
||||
|
||||
.. _distribution_information:
|
||||
|
||||
`Distribution Information <#distribution_information>`__
|
||||
--------------------------------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
NSS 3.15.1 source distributions are also available on ftp.mozilla.org for secure HTTPS download:
|
||||
|
||||
- Source tarballs:
|
||||
https://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_15_1_RTM/src/
|
||||
|
||||
.. _new_in_nss_3.15.1:
|
||||
|
||||
`New in NSS 3.15.1 <#new_in_nss_3.15.1>`__
|
||||
------------------------------------------
|
||||
|
||||
.. _new_functionality:
|
||||
|
||||
`New Functionality <#new_functionality>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
- TLS 1.2: TLS 1.2 (`RFC 5246 <https://datatracker.ietf.org/doc/html/rfc5246>`__) is supported.
|
||||
HMAC-SHA256 cipher suites (`RFC 5246 <https://datatracker.ietf.org/doc/html/rfc5246>`__ and
|
||||
`RFC 5289 <https://datatracker.ietf.org/doc/html/rfc5289>`__) are supported, allowing TLS to
|
||||
be used without MD5 and SHA-1. Note the following limitations.
|
||||
|
||||
- The hash function used in the signature for TLS 1.2 client authentication must be the hash
|
||||
function of the TLS 1.2 PRF, which is always SHA-256 in NSS 3.15.1.
|
||||
- AES GCM cipher suites are not yet supported.
|
||||
|
||||
.. rubric:: New Functions
|
||||
:name: new_functions
|
||||
|
||||
None.
|
||||
|
||||
.. rubric:: New Types
|
||||
:name: new_types
|
||||
|
||||
- *in sslprot.h*
|
||||
|
||||
- **SSL_LIBRARY_VERSION_TLS_1_2** - The protocol version of TLS 1.2 on the wire, value
|
||||
0x0303.
|
||||
- **TLS_DHE_RSA_WITH_AES_256_CBC_SHA256**, **TLS_RSA_WITH_AES_256_CBC_SHA256**,
|
||||
**TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256**, **TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256**,
|
||||
**TLS_DHE_RSA_WITH_AES_128_CBC_SHA256**, **TLS_RSA_WITH_AES_128_CBC_SHA256**,
|
||||
**TLS_RSA_WITH_NULL_SHA256** - New TLS 1.2 only HMAC-SHA256 cipher suites.
|
||||
|
||||
- *in sslerr.h*
|
||||
|
||||
- **SSL_ERROR_UNSUPPORTED_HASH_ALGORITHM**, **SSL_ERROR_DIGEST_FAILURE**,
|
||||
**SSL_ERROR_INCORRECT_SIGNATURE_ALGORITHM** - New error codes for TLS 1.2.
|
||||
|
||||
- *in sslt.h*
|
||||
|
||||
- **ssl_hmac_sha256** - A new value in the SSLMACAlgorithm enum type.
|
||||
- **ssl_signature_algorithms_xtn** - A new value in the SSLExtensionType enum type.
|
||||
|
||||
.. rubric:: New PKCS #11 Mechanisms
|
||||
:name: new_pkcs_11_mechanisms
|
||||
|
||||
None.
|
||||
|
||||
.. _notable_changes_in_nss_3.15.1:
|
||||
|
||||
`Notable Changes in NSS 3.15.1 <#notable_changes_in_nss_3.15.1>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
- `Bug 856060 <https://bugzilla.mozilla.org/show_bug.cgi?id=856060>`__ - Enforce name
|
||||
constraints on the common name in libpkix when no subjectAltName is present.
|
||||
- `Bug 875156 <https://bugzilla.mozilla.org/show_bug.cgi?id=875156>`__ - Add const to the
|
||||
function arguments of SEC_CertNicknameConflict.
|
||||
- `Bug 877798 <https://bugzilla.mozilla.org/show_bug.cgi?id=877798>`__ - Fix ssltap to print the
|
||||
certificate_status handshake message correctly.
|
||||
- `Bug 882829 <https://bugzilla.mozilla.org/show_bug.cgi?id=882829>`__ - On Windows, NSS
|
||||
initialization fails if NSS cannot call the RtlGenRandom function.
|
||||
- `Bug 875601 <https://bugzilla.mozilla.org/show_bug.cgi?id=875601>`__ -
|
||||
SECMOD_CloseUserDB/SECMOD_OpenUserDB fails to reset the token delay, leading to spurious
|
||||
failures.
|
||||
- `Bug 884072 <https://bugzilla.mozilla.org/show_bug.cgi?id=884072>`__ - Fix a typo in the
|
||||
header include guard macro of secmod.h.
|
||||
- `Bug 876352 <https://bugzilla.mozilla.org/show_bug.cgi?id=876352>`__ - certutil now warns if
|
||||
importing a PEM file that contains a private key.
|
||||
- `Bug 565296 <https://bugzilla.mozilla.org/show_bug.cgi?id=565296>`__ - Fix the bug that
|
||||
shlibsign exited with status 0 even though it failed.
|
||||
- The NSS_SURVIVE_DOUBLE_BYPASS_FAILURE build option is removed.
|
||||
|
||||
.. _bugs_fixed_in_nss_3.15.1:
|
||||
|
||||
`Bugs fixed in NSS 3.15.1 <#bugs_fixed_in_nss_3.15.1>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
- https://bugzilla.mozilla.org/buglist.cgi?list_id=5689256;resolution=FIXED;classification=Components;query_format=advanced;target_milestone=3.15.1;product=NSS
|
||||
|
||||
`Compatibility <#compatibility>`__
|
||||
----------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
NSS 3.15.1 shared libraries are backward compatible with all older NSS 3.x shared libraries. A
|
||||
program linked with older NSS 3.x shared libraries will work with NSS 3.15.1 shared libraries
|
||||
without recompiling or relinking. Furthermore, applications that restrict their use of NSS APIs
|
||||
to the functions listed in NSS Public Functions will remain compatible with future versions of
|
||||
the NSS shared libraries.
|
||||
|
||||
`Feedback <#feedback>`__
|
||||
------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
Bugs discovered should be reported by filing a bug report with
|
||||
`bugzilla.mozilla.org <https://bugzilla.mozilla.org/enter_bug.cgi?product=NSS>`__ (product NSS).
|
||||
|
|
@ -1,126 +0,0 @@
|
|||
.. _mozilla_projects_nss_nss_3_15_2_release_notes:
|
||||
|
||||
NSS 3.15.2 release notes
|
||||
========================
|
||||
|
||||
`Introduction <#introduction>`__
|
||||
--------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
Network Security Services (NSS) 3.15.2 is a patch release for NSS 3.15. The bug fixes in NSS
|
||||
3.15.2 are described in the "Bugs Fixed" section below.
|
||||
|
||||
.. _distribution_information:
|
||||
|
||||
`Distribution Information <#distribution_information>`__
|
||||
--------------------------------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
NSS 3.15.2 source distributions are also available on ftp.mozilla.org for secure HTTPS download:
|
||||
|
||||
- Source tarballs:
|
||||
https://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_15_2_RTM/src/
|
||||
|
||||
.. _security_advisories:
|
||||
|
||||
`Security Advisories <#security_advisories>`__
|
||||
----------------------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
The following security-relevant bugs have been resolved in NSS 3.15.2. Users are encouraged to
|
||||
upgrade immediately.
|
||||
|
||||
- `Bug 894370 <https://bugzilla.mozilla.org/show_bug.cgi?id=894370>`__ - (CVE-2013-1739) Avoid
|
||||
uninitialized data read in the event of a decryption failure.
|
||||
|
||||
.. _new_in_nss_3.15.2:
|
||||
|
||||
`New in NSS 3.15.2 <#new_in_nss_3.15.2>`__
|
||||
------------------------------------------
|
||||
|
||||
.. _new_functionality:
|
||||
|
||||
`New Functionality <#new_functionality>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
- AES-GCM Ciphersuites: AES-GCM cipher suite (RFC 5288 and RFC 5289) support has been added when
|
||||
TLS 1.2 is negotiated. Specifically, the following cipher suites are now supported:
|
||||
|
||||
- TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
|
||||
- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
||||
- TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
|
||||
- TLS_RSA_WITH_AES_128_GCM_SHA256
|
||||
|
||||
.. rubric:: New Functions
|
||||
:name: new_functions
|
||||
|
||||
PK11_CipherFinal has been introduced, which is a simple alias for PK11_DigestFinal.
|
||||
|
||||
.. rubric:: New Types
|
||||
:name: new_types
|
||||
|
||||
No new types have been introduced.
|
||||
|
||||
.. rubric:: New PKCS #11 Mechanisms
|
||||
:name: new_pkcs_11_mechanisms
|
||||
|
||||
No new PKCS#11 mechanisms have been introduced
|
||||
|
||||
.. _notable_changes_in_nss_3.15.2:
|
||||
|
||||
`Notable Changes in NSS 3.15.2 <#notable_changes_in_nss_3.15.2>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
- `Bug 880543 <https://bugzilla.mozilla.org/show_bug.cgi?id=880543>`__ - Support for AES-GCM
|
||||
ciphersuites that use the SHA-256 PRF
|
||||
- `Bug 663313 <https://bugzilla.mozilla.org/show_bug.cgi?id=663313>`__ - MD2, MD4, and MD5
|
||||
signatures are no longer accepted for OCSP or CRLs, consistent with their handling for general
|
||||
certificate signatures.
|
||||
- `Bug 884178 <https://bugzilla.mozilla.org/show_bug.cgi?id=884178>`__ - Add PK11_CipherFinal
|
||||
macro
|
||||
|
||||
.. _bugs_fixed_in_nss_3.15.2:
|
||||
|
||||
`Bugs fixed in NSS 3.15.2 <#bugs_fixed_in_nss_3.15.2>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
- `Bug 734007 <https://bugzilla.mozilla.org/show_bug.cgi?id=734007>`__ - sizeof() used
|
||||
incorrectly
|
||||
- `Bug 900971 <https://bugzilla.mozilla.org/show_bug.cgi?id=900971>`__ - nssutil_ReadSecmodDB()
|
||||
leaks memory
|
||||
- `Bug 681839 <https://bugzilla.mozilla.org/show_bug.cgi?id=681839>`__ - Allow
|
||||
SSL_HandshakeNegotiatedExtension to be called before the handshake is finished.
|
||||
- `Bug 848384 <https://bugzilla.mozilla.org/show_bug.cgi?id=848384>`__ - Deprecate the SSL
|
||||
cipher policy code, as it's no longer relevant. It is no longer necessary to call
|
||||
NSS_SetDomesticPolicy because all cipher suites are now allowed by default.
|
||||
|
||||
A complete list of all bugs resolved in this release can be obtained at
|
||||
https://bugzilla.mozilla.org/buglist.cgi?resolution=FIXED&classification=Components&query_format=advanced&target_milestone=3.15.2&product=NSS&list_id=7982238
|
||||
|
||||
`Compatibility <#compatibility>`__
|
||||
----------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
NSS 3.15.2 shared libraries are backward compatible with all older NSS 3.x shared libraries. A
|
||||
program linked with older NSS 3.x shared libraries will work with NSS 3.15.2 shared libraries
|
||||
without recompiling or relinking. Furthermore, applications that restrict their use of NSS APIs
|
||||
to the functions listed in NSS Public Functions will remain compatible with future versions of
|
||||
the NSS shared libraries.
|
||||
|
||||
`Feedback <#feedback>`__
|
||||
------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
Bugs discovered should be reported by filing a bug report with
|
||||
`bugzilla.mozilla.org <https://bugzilla.mozilla.org/enter_bug.cgi?product=NSS>`__ (product NSS).
|
||||
|
|
@ -1,89 +0,0 @@
|
|||
.. _mozilla_projects_nss_nss_3_15_3_1_release_notes:
|
||||
|
||||
NSS 3.15.3.1 release notes
|
||||
==========================
|
||||
|
||||
`Introduction <#introduction>`__
|
||||
--------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
Network Security Services (NSS) 3.15.3.1 is a patch release for NSS 3.15. The bug fixes in NSS
|
||||
3.15.3.1 are described in the "Bugs Fixed" section below.
|
||||
|
||||
.. _distribution_information:
|
||||
|
||||
`Distribution Information <#distribution_information>`__
|
||||
--------------------------------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
The HG tag is NSS_3_15_3_1_RTM. NSS 3.15.3.1 requires NSPR 4.10.2 or newer.
|
||||
|
||||
NSS 3.15.3.1 source distributions are also available on ftp.mozilla.org for secure HTTPS
|
||||
download:
|
||||
|
||||
- Source tarballs:
|
||||
https://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_15_3_1_RTM/src/
|
||||
|
||||
.. _security_advisories:
|
||||
|
||||
`Security Advisories <#security_advisories>`__
|
||||
----------------------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
The following security-relevant bugs have been resolved in NSS 3.15.3.1. Users are encouraged to
|
||||
upgrade immediately.
|
||||
|
||||
- `Bug 946351 <https://bugzilla.mozilla.org/show_bug.cgi?id=946351>`__ - Misissued Google
|
||||
certificates from DCSSI
|
||||
|
||||
.. _new_in_nss_3.15.3.1:
|
||||
|
||||
`New in NSS 3.15.3.1 <#new_in_nss_3.15.3.1>`__
|
||||
----------------------------------------------
|
||||
|
||||
.. _new_functionality:
|
||||
|
||||
`New Functionality <#new_functionality>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
No new major functionality is introduced in this release. This is a patch release to `revoke
|
||||
trust of a subordinate CA
|
||||
certificate <https://blog.mozilla.org/security/2013/12/09/revoking-trust-in-one-anssi-certificate/>`__
|
||||
that was mis-used to generate a certificate used by a network appliance.
|
||||
|
||||
.. _bugs_fixed_in_nss_3.15.3.1:
|
||||
|
||||
`Bugs fixed in NSS 3.15.3.1 <#bugs_fixed_in_nss_3.15.3.1>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
- `Bug 946351 <https://bugzilla.mozilla.org/show_bug.cgi?id=946351>`__ - Misissued Google
|
||||
certificates from DCSSI
|
||||
|
||||
A complete list of all bugs resolved in this release can be obtained at
|
||||
https://bugzilla.mozilla.org/buglist.cgi?resolution=FIXED&classification=Components&query_format=advanced&target_milestone=3.15.3.1&product=NSS
|
||||
|
||||
`Compatibility <#compatibility>`__
|
||||
----------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
NSS 3.15.3.1 shared libraries are backward compatible with all older NSS 3.x shared libraries. A
|
||||
program linked with older NSS 3.x shared libraries will work with NSS 3.15.3.1 shared libraries
|
||||
without recompiling or relinking. Furthermore, applications that restrict their use of NSS APIs
|
||||
to the functions listed in NSS Public Functions will remain compatible with future versions of
|
||||
the NSS shared libraries.
|
||||
|
||||
`Feedback <#feedback>`__
|
||||
------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
Bugs discovered should be reported by filing a bug report with
|
||||
`bugzilla.mozilla.org <https://bugzilla.mozilla.org/enter_bug.cgi?product=NSS>`__ (product NSS).
|
||||
|
|
@ -1,94 +0,0 @@
|
|||
.. _mozilla_projects_nss_nss_3_15_3_release_notes:
|
||||
|
||||
NSS 3.15.3 release notes
|
||||
========================
|
||||
|
||||
`Introduction <#introduction>`__
|
||||
--------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
Network Security Services (NSS) 3.15.3 is a patch release for NSS 3.15. The bug fixes in NSS
|
||||
3.15.3 are described in the "Bugs Fixed" section below.
|
||||
|
||||
.. _distribution_information:
|
||||
|
||||
`Distribution Information <#distribution_information>`__
|
||||
--------------------------------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
The HG tag is NSS_3_15_3_RTM. NSS 3.15.3 requires NSPR 4.10.2 or newer.
|
||||
|
||||
NSS 3.15.3 source distributions are also available on ftp.mozilla.org for secure HTTPS download:
|
||||
|
||||
- Source tarballs:
|
||||
https://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_15_3_RTM/src/
|
||||
|
||||
.. _security_advisories:
|
||||
|
||||
`Security Advisories <#security_advisories>`__
|
||||
----------------------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
The following security-relevant bugs have been resolved in NSS 3.15.3. Users are encouraged to
|
||||
upgrade immediately.
|
||||
|
||||
- `Bug 925100 <https://bugzilla.mozilla.org/show_bug.cgi?id=925100>`__ - (CVE-2013-1741) Ensure
|
||||
a size is <= half of the maximum PRUint32 value
|
||||
- `Bug 934016 <https://bugzilla.mozilla.org/show_bug.cgi?id=934016>`__ - (CVE-2013-5605) Handle
|
||||
invalid handshake packets
|
||||
- `Bug 910438 <https://bugzilla.mozilla.org/show_bug.cgi?id=910438>`__ - (CVE-2013-5606) Return
|
||||
the correct result in CERT_VerifyCert on failure, if a verifyLog isn't used
|
||||
|
||||
.. _new_in_nss_3.15.3:
|
||||
|
||||
`New in NSS 3.15.3 <#new_in_nss_3.15.3>`__
|
||||
------------------------------------------
|
||||
|
||||
.. _new_functionality:
|
||||
|
||||
`New Functionality <#new_functionality>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
No new major functionality is introduced in this release. This release is a patch release to
|
||||
address `CVE-2013-1741 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1741>`__,
|
||||
`CVE- <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5605>`__\ `2013-5605 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5605>`__
|
||||
and `CVE-2013-5606 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5606>`__.
|
||||
|
||||
.. _bugs_fixed_in_nss_3.15.3:
|
||||
|
||||
`Bugs fixed in NSS 3.15.3 <#bugs_fixed_in_nss_3.15.3>`__
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
.. container::
|
||||
|
||||
- `Bug 850478 <https://bugzilla.mozilla.org/show_bug.cgi?id=850478>`__ - List RC4_128 cipher
|
||||
suites after AES_128 cipher suites
|
||||
- `Bug 919677 <https://bugzilla.mozilla.org/show_bug.cgi?id=919677>`__ - Don't advertise TLS
|
||||
1.2-only ciphersuites in a TLS 1.1 ClientHello
|
||||
|
||||
A complete list of all bugs resolved in this release can be obtained at
|
||||
https://bugzilla.mozilla.org/buglist.cgi?resolution=FIXED&classification=Components&query_format=advanced&target_milestone=3.15.3&product=NSS
|
||||
|
||||
`Compatibility <#compatibility>`__
|
||||
----------------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
NSS 3.15.3 shared libraries are backward compatible with all older NSS 3.x shared libraries. A
|
||||
program linked with older NSS 3.x shared libraries will work with NSS 3.15.3 shared libraries
|
||||
without recompiling or relinking. Furthermore, applications that restrict their use of NSS APIs
|
||||
to the functions listed in NSS Public Functions will remain compatible with future versions of
|
||||
the NSS shared libraries.
|
||||
|
||||
`Feedback <#feedback>`__
|
||||
------------------------
|
||||
|
||||
.. container::
|
||||
|
||||
Bugs discovered should be reported by filing a bug report with
|
||||
`bugzilla.mozilla.org <https://bugzilla.mozilla.org/enter_bug.cgi?product=NSS>`__ (product NSS).
|
||||
Some files were not shown because too many files have changed in this diff Show more
Loading…
Add table
Add a link
Reference in a new issue