wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-10 02:08:38 +09:00
Code Issues Projects Releases Packages Wiki Activity

Replace NSS with Pale Moon's

Browse source
This commit is contained in:
wuggy 2026-06-29 21:29:25 +01:00
commit 8c2e376f94
2870 changed files with 1762232 additions and 1374220 deletions
Download patch file Download diff file Expand all files Collapse all files

67
security/nss/doc/certutil.xml
View file

@ -208,7 +208,7 @@ If this option is not used, the validity check defaults to the current system ti
<listitem><para><command>sql:</command> requests the newer database</para></listitem>
<listitem><para><command>dbm:</command> requests the legacy database</para></listitem>
</itemizedlist>
<para>If no prefix is specified the default type is retrieved from NSS_DEFAULT_DB_TYPE. If NSS_DEFAULT_DB_TYPE is not set then <command>dbm:</command> is the default.</para>
<para>If no prefix is specified the default type is retrieved from NSS_DEFAULT_DB_TYPE. If NSS_DEFAULT_DB_TYPE is not set then <command>sql:</command> is the default.</para>
</listitem>
</varlistentry>
@ -848,13 +848,13 @@ Comma separated list of one or more of the following:
<para>
These databases must be created before certificates or keys can be generated.
</para>
<programlisting>certutil -N -d [sql:]directory</programlisting>
<programlisting>certutil -N -d directory</programlisting>
<para><command>Creating a Certificate Request</command></para>
<para>
A certificate request contains most or all of the information that is used to generate the final certificate. This request is submitted separately to a certificate authority and is then approved by some mechanism (automatically or by human review). Once the request is approved, then the certificate is generated.
</para>
<programlisting>$ certutil -R -k key-type-or-id [-q pqgfile|curve-name] -g key-size -s subject [-h tokenname] -d [sql:]directory [-p phone] [-o output-file] [-a]</programlisting>
<programlisting>$ certutil -R -k key-type-or-id [-q pqgfile|curve-name] -g key-size -s subject [-h tokenname] -d directory [-p phone] [-o output-file] [-a]</programlisting>
<para>
The <option>-R</option> command options requires four arguments:
</para>
@ -886,7 +886,7 @@ Comma separated list of one or more of the following:
<para>
For example:
</para>
<programlisting>$ certutil -R -k rsa -g 1024 -s "CN=John Smith,O=Example Corp,L=Mountain View,ST=California,C=US" -d sql:$HOME/nssdb -p 650-555-0123 -a -o cert.cer
<programlisting>$ certutil -R -k rsa -g 1024 -s "CN=John Smith,O=Example Corp,L=Mountain View,ST=California,C=US" -d $HOME/nssdb -p 650-555-0123 -a -o cert.cer
Generating key. This may take a few moments...
@ -896,7 +896,7 @@ Generating key. This may take a few moments...
<para>
A valid certificate must be issued by a trusted CA. This can be done by specifying a CA certificate (<option>-c</option>) that is stored in the certificate database. If a CA key pair is not available, you can create a self-signed certificate using the <option>-x</option> argument with the <option>-S</option> command option.
</para>
<programlisting>$ certutil -S -k rsa|dsa|ec -n certname -s subject [-c issuer |-x] -t trustargs -d [sql:]directory [-m serial-number] [-v valid-months] [-w offset-months] [-p phone] [-1] [-2] [-3] [-4] [-5 keyword] [-6 keyword] [-7 emailAddress] [-8 dns-names] [--extAIA] [--extSIA] [--extCP] [--extPM] [--extPC] [--extIA] [--extSKID]</programlisting>
<programlisting>$ certutil -S -k rsa|dsa|ec -n certname -s subject [-c issuer |-x] -t trustargs -d directory [-m serial-number] [-v valid-months] [-w offset-months] [-p phone] [-1] [-2] [-3] [-4] [-5 keyword] [-6 keyword] [-7 emailAddress] [-8 dns-names] [--extAIA] [--extSIA] [--extCP] [--extPM] [--extPC] [--extIA] [--extSKID]</programlisting>
<para>
The series of numbers and <option>--ext*</option> options set certificate extensions that can be added to the certificate when it is generated by the CA. Interactive prompts will result.
</para>
@ -916,17 +916,17 @@ The interative prompts for key usage and whether any extensions are critical and
<para>
When a certificate request is created, a certificate can be generated by using the request and then referencing a certificate authority signing certificate (the <emphasis>issuer</emphasis> specified in the <option>-c</option> argument). The issuing certificate must be in the certificate database in the specified directory.
</para>
<programlisting>certutil -C -c issuer -i cert-request-file -o output-file [-m serial-number] [-v valid-months] [-w offset-months] -d [sql:]directory [-1] [-2] [-3] [-4] [-5 keyword] [-6 keyword] [-7 emailAddress] [-8 dns-names]</programlisting>
<programlisting>certutil -C -c issuer -i cert-request-file -o output-file [-m serial-number] [-v valid-months] [-w offset-months] -d directory [-1] [-2] [-3] [-4] [-5 keyword] [-6 keyword] [-7 emailAddress] [-8 dns-names]</programlisting>
<para>
For example:
</para>
<programlisting>$ certutil -C -c "my-ca-cert" -i /home/certs/cert.req -o cert.cer -m 010 -v 12 -w 1 -d sql:$HOME/nssdb -1 nonRepudiation,dataEncipherment -5 sslClient -6 clientAuth -7 jsmith@example.com</programlisting>
<programlisting>$ certutil -C -c "my-ca-cert" -i /home/certs/cert.req -o cert.cer -m 010 -v 12 -w 1 -d $HOME/nssdb -1 nonRepudiation,dataEncipherment -5 sslClient -6 clientAuth -7 jsmith@example.com</programlisting>
<para><command>Listing Certificates</command></para>
<para>
The <option>-L</option> command option lists all of the certificates listed in the certificate database. The path to the directory (<option>-d</option>) is required.
</para>
<programlisting>$ certutil -L -d sql:/home/my/sharednssdb
<programlisting>$ certutil -L -d /home/my/sharednssdb
Certificate Nickname Trust Attributes
SSL,S/MIME,JAR/XPI
@ -939,7 +939,7 @@ Certificate Authority - Example Domain CT,C,C</programlist
Using additional arguments with <option>-L</option> can return and print the information for a single, specific certificate. For example, the <option>-n</option> argument passes the certificate name, while the <option>-a</option> argument prints the certificate in ASCII format:
</para>
<programlisting>
$ certutil -L -d sql:$HOME/nssdb -a -n my-ca-cert
$ certutil -L -d $HOME/nssdb -a -n my-ca-cert
-----BEGIN CERTIFICATE-----
MIIB1DCCAT2gAwIBAgICDkIwDQYJKoZIhvcNAQEFBQAwFTETMBEGA1UEAxMKRXhh
bXBsZSBDQTAeFw0xMzAzMTMxOTEwMjlaFw0xMzA2MTMxOTEwMjlaMBUxEzARBgNV
@ -954,7 +954,7 @@ ob2rb8XRVVJkzXdXxlk4uo3UtNvw8sAz7sWD71qxKaIHU5q49zijfg==
-----END CERTIFICATE-----
</programlisting>
<para>For a human-readable display</para>
<programlisting>$ certutil -L -d sql:$HOME/nssdb -n my-ca-cert
<programlisting>$ certutil -L -d $HOME/nssdb -n my-ca-cert
Certificate:
Data:
Version: 3 (0x2)
@ -1027,7 +1027,7 @@ Certificate:
<para>
To list all keys in the database, use the <option>-K</option> command option and the (required) <option>-d</option> argument to give the path to the directory.
</para>
<programlisting>$ certutil -K -d sql:$HOME/nssdb
<programlisting>$ certutil -K -d $HOME/nssdb
certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and Certificate Services "
&lt; 0> rsa 455a6673bde9375c2887ec8bf8016b3f9f35861d Thawte Freemail Member's Thawte Consulting (Pty) Ltd. ID
&lt; 1> rsa 40defeeb522ade11090eacebaaf1196a172127df Example Domain Administrator Cert
@ -1057,7 +1057,7 @@ certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and
<para>
The devices that can be used to store certificates -- both internal databases and external devices like smart cards -- are recognized and used by loading security modules. The <option>-U</option> command option lists all of the security modules listed in the <filename>secmod.db</filename> database. The path to the directory (<option>-d</option>) is required.
</para>
<programlisting>$ certutil -U -d sql:/home/my/sharednssdb
<programlisting>$ certutil -U -d /home/my/sharednssdb
slot: NSS User Private Key and Certificate Services
token: NSS Certificate DB
@ -1071,51 +1071,51 @@ certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and
<para>
Existing certificates or certificate requests can be added manually to the certificate database, even if they were generated elsewhere. This uses the <option>-A</option> command option.
</para>
<programlisting>certutil -A -n certname -t trustargs -d [sql:]directory [-a] [-i input-file]</programlisting>
<programlisting>certutil -A -n certname -t trustargs -d directory [-a] [-i input-file]</programlisting>
<para>
For example:
</para>
<programlisting>$ certutil -A -n "CN=My SSL Certificate" -t ",," -d sql:/home/my/sharednssdb -i /home/example-certs/cert.cer</programlisting>
<programlisting>$ certutil -A -n "CN=My SSL Certificate" -t ",," -d /home/my/sharednssdb -i /home/example-certs/cert.cer</programlisting>
<para>
A related command option, <option>-E</option>, is used specifically to add email certificates to the certificate database. The <option>-E</option> command has the same arguments as the <option>-A</option> command. The trust arguments for certificates have the format <emphasis>SSL,S/MIME,Code-signing</emphasis>, so the middle trust settings relate most to email certificates (though the others can be set). For example:
</para>
<programlisting>$ certutil -E -n "CN=John Smith Email Cert" -t ",P," -d sql:/home/my/sharednssdb -i /home/example-certs/email.cer</programlisting>
<programlisting>$ certutil -E -n "CN=John Smith Email Cert" -t ",P," -d /home/my/sharednssdb -i /home/example-certs/email.cer</programlisting>
<para><command>Deleting Certificates to the Database</command></para>
<para>
Certificates can be deleted from a database using the <option>-D</option> option. The only required options are to give the security database directory and to identify the certificate nickname.
</para>
<programlisting>certutil -D -d [sql:]directory -n "nickname"</programlisting>
<programlisting>certutil -D -d directory -n "nickname"</programlisting>
<para>
For example:
</para>
<programlisting>$ certutil -D -d sql:/home/my/sharednssdb -n "my-ssl-cert"</programlisting>
<programlisting>$ certutil -D -d /home/my/sharednssdb -n "my-ssl-cert"</programlisting>
<para><command>Validating Certificates</command></para>
<para>
A certificate contains an expiration date in itself, and expired certificates are easily rejected. However, certificates can also be revoked before they hit their expiration date. Checking whether a certificate has been revoked requires validating the certificate. Validation can also be used to ensure that the certificate is only used for the purposes it was initially issued for. Validation is carried out by the <option>-V</option> command option.
</para>
<programlisting>certutil -V -n certificate-name [-b time] [-e] [-u cert-usage] -d [sql:]directory</programlisting>
<programlisting>certutil -V -n certificate-name [-b time] [-e] [-u cert-usage] -d directory</programlisting>
<para>
For example, to validate an email certificate:
</para>
<programlisting>$ certutil -V -n "John Smith's Email Cert" -e -u S,R -d sql:/home/my/sharednssdb</programlisting>
<programlisting>$ certutil -V -n "John Smith's Email Cert" -e -u S,R -d /home/my/sharednssdb</programlisting>
<para><command>Modifying Certificate Trust Settings</command></para>
<para>
The trust settings (which relate to the operations that a certificate is allowed to be used for) can be changed after a certificate is created or added to the database. This is especially useful for CA certificates, but it can be performed for any type of certificate.
</para>
<programlisting>certutil -M -n certificate-name -t trust-args -d [sql:]directory</programlisting>
<programlisting>certutil -M -n certificate-name -t trust-args -d directory</programlisting>
<para>
For example:
</para>
<programlisting>$ certutil -M -n "My CA Certificate" -d sql:/home/my/sharednssdb -t "CT,CT,CT"</programlisting>
<programlisting>$ certutil -M -n "My CA Certificate" -d /home/my/sharednssdb -t "CT,CT,CT"</programlisting>
<para><command>Printing the Certificate Chain</command></para>
<para>
Certificates can be issued in <emphasis>chains</emphasis> because every certificate authority itself has a certificate; when a CA issues a certificate, it essentially stamps that certificate with its own fingerprint. The <option>-O</option> prints the full chain of a certificate, going from the initial CA (the root CA) through ever intermediary CA to the actual certificate. For example, for an email certificate with two CAs in the chain:
</para>
<programlisting>$ certutil -d sql:/home/my/sharednssdb -O -n "jsmith@example.com"
<programlisting>$ certutil -d /home/my/sharednssdb -O -n "jsmith@example.com"
"Builtin Object Token:Thawte Personal Freemail CA" [E=personal-freemail@thawte.com,CN=Thawte Personal Freemail CA,OU=Certification Services Division,O=Thawte Consulting,L=Cape Town,ST=Western Cape,C=ZA]
"Thawte Personal Freemail Issuing CA - Thawte Consulting" [CN=Thawte Personal Freemail Issuing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA]
@ -1126,11 +1126,11 @@ certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and
<para>
The device which stores certificates -- both external hardware devices and internal software databases -- can be blanked and reused. This operation is performed on the device which stores the data, not directly on the security databases, so the location must be referenced through the token name (<option>-h</option>) as well as any directory path. If there is no external token used, the default value is internal.
</para>
<programlisting>certutil -T -d [sql:]directory -h token-name -0 security-officer-password</programlisting>
<programlisting>certutil -T -d directory -h token-name -0 security-officer-password</programlisting>
<para>
Many networks have dedicated personnel who handle changes to security tokens (the security officer). This person must supply the password to access the specified token. For example:
</para>
<programlisting>$ certutil -T -d sql:/home/my/sharednssdb -h nethsm -0 secret</programlisting>
<programlisting>$ certutil -T -d /home/my/sharednssdb -h nethsm -0 secret</programlisting>
<para><command>Upgrading or Merging the Security Databases</command></para>
<para>
@ -1139,19 +1139,19 @@ certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and
<para>
The <option>--upgrade-merge</option> command must give information about the original database and then use the standard arguments (like <option>-d</option>) to give the information about the new databases. The command also requires information that the tool uses for the process to upgrade and write over the original database.
</para>
<programlisting>certutil --upgrade-merge -d [sql:]directory [-P dbprefix] --source-dir directory --source-prefix dbprefix --upgrade-id id --upgrade-token-name name [-@ password-file]</programlisting>
<programlisting>certutil --upgrade-merge -d directory [-P dbprefix] --source-dir directory --source-prefix dbprefix --upgrade-id id --upgrade-token-name name [-@ password-file]</programlisting>
<para>
For example:
</para>
<programlisting>$ certutil --upgrade-merge -d sql:/home/my/sharednssdb --source-dir /opt/my-app/alias/ --source-prefix serverapp- --upgrade-id 1 --upgrade-token-name internal</programlisting>
<programlisting>$ certutil --upgrade-merge -d /home/my/sharednssdb --source-dir /opt/my-app/alias/ --source-prefix serverapp- --upgrade-id 1 --upgrade-token-name internal</programlisting>
<para>
The <option>--merge</option> command only requires information about the location of the original database; since it doesn't change the format of the database, it can write over information without performing interim step.
</para>
<programlisting>certutil --merge -d [sql:]directory [-P dbprefix] --source-dir directory --source-prefix dbprefix [-@ password-file]</programlisting>
<programlisting>certutil --merge -d directory [-P dbprefix] --source-dir directory --source-prefix dbprefix [-@ password-file]</programlisting>
<para>
For example:
</para>
<programlisting>$ certutil --merge -d sql:/home/my/sharednssdb --source-dir /opt/my-app/alias/ --source-prefix serverapp-</programlisting>
<programlisting>$ certutil --merge -d /home/my/sharednssdb --source-dir /opt/my-app/alias/ --source-prefix serverapp-</programlisting>
<para><command>Running certutil Commands from a Batch File</command></para>
<para>
@ -1207,17 +1207,16 @@ BerkeleyDB. These new databases provide more accessibility and performance:</par
<para>Because the SQLite databases are designed to be shared, these are the <emphasis>shared</emphasis> database type. The shared database type is preferred; the legacy format is included for backward compatibility.</para>
<para>By default, the tools (<command>certutil</command>, <command>pk12util</command>, <command>modutil</command>) assume that the given security databases follow the more common legacy type.
Using the SQLite databases must be manually specified by using the <command>sql:</command> prefix with the given security directory. For example:</para>
<para>By default, the tools (<command>certutil</command>, <command>pk12util</command>, <command>modutil</command>) assume that the given security databases use the SQLite type.
Using the legacy databases must be manually specified by using the <command>dbm:</command> prefix with the given security directory. For example:</para>
<programlisting>$ certutil -L -d sql:/home/my/sharednssdb</programlisting>
<programlisting>$ certutil -L -d dbm:/home/my/sharednssdb</programlisting>
<para>To set the shared database type as the default type for the tools, set the <envar>NSS_DEFAULT_DB_TYPE</envar> environment variable to <envar>sql</envar>:</para>
<programlisting>export NSS_DEFAULT_DB_TYPE="sql"</programlisting>
<para>To set the legacy database type as the default type for the tools, set the <envar>NSS_DEFAULT_DB_TYPE</envar> environment variable to <envar>dbm</envar>:</para>
<programlisting>export NSS_DEFAULT_DB_TYPE="dbm"</programlisting>
<para>This line can be set added to the <filename>~/.bashrc</filename> file to make the change permanent.</para>
<para>Most applications do not use the shared database by default, but they can be configured to use them. For example, this how-to article covers how to configure Firefox and Thunderbird to use the new shared NSS databases:</para>
<itemizedlist>
<listitem>
<para>