The Tor Browser / file comparison
comparison: security/nss/lib/ckfw/builtins/README
security/nss/lib/ckfw/builtins/README
- changeset 0
- 6474c204b198
equal
deleted
inserted
replaced
| -1:000000000000 | 0:9a840a4e396b |
|---|---|
| 1 This README file explains how to add a builtin root CA certificate to NSS | |
| 2 or remove a builtin root CA certificate from NSS. | |
| 3 | |
| 4 The builtin root CA certificates in NSS are stored in the nssckbi PKCS #11 | |
| 5 module. The sources to the nssckbi module are in this directory. | |
| 6 | |
| 7 I. Adding a Builtin Root CA Certificate | |
| 8 | |
| 9 You need to use the addbuiltin command-line tool to add a root CA certificate | |
| 10 to the nssckbi module. In the procedure described below, we assume that the | |
| 11 new root CA certificate is distributed in DER format in the file newroot.der. | |
| 12 | |
| 13 1. Add the directory where the addbuiltin executable resides to your PATH | |
| 14 environment variable. Then, add the directory where the NSPR and NSS shared | |
| 15 libraries (DLLs) reside to the platform-specific environment variable that | |
| 16 specifies your shared library search path: LD_LIBRARY_PATH (most Unix | |
| 17 variants), SHLIB_PATH (32-bit HP-UX), LIBPATH (AIX), or PATH (Windows). | |
| 18 | |
| 19 2. Copy newroot.der to this directory. | |
| 20 | |
| 21 3. In this directory, run addbuiltin to add the new root certificate. The | |
| 22 argument to the -n option should be replaced by the nickname of the root | |
| 23 certificate. | |
| 24 | |
| 25 % addbuiltin -n "Nickname of the Root Certificate" -t C,C,C < newroot.der >> certdata.txt | |
| 26 | |
| 27 4. Edit nssckbi.h to bump the version of the module. | |
| 28 | |
| 29 5. Run gmake in this directory to build the nssckbi module. | |
| 30 | |
| 31 6. After you verify that the new nssckbi module is correct, check in | |
| 32 certdata.txt and nssckbi.h. | |
| 33 | |
| 34 II. Removing a Builtin Root CA Certificate | |
| 35 | |
| 36 1. Change directory to this directory. | |
| 37 | |
| 38 2. Edit certdata.txt and remove the root CA certificate. | |
| 39 | |
| 40 3. Edit nssckbi.h to bump the version of the module. | |
| 41 | |
| 42 4. Run gmake in this directory to build the nssckbi module. | |
| 43 | |
| 44 5. After you verify that the new nssckbi module is correct, check in | |
| 45 certdata.txt and nssckbi.h. |
