security/nss/doc/html/crlutil.html@b8a032363ba2
security/nss/doc/html/crlutil.html
Thu, 22 Jan 2015 13:21:57 +0100
- author
- Michael Schloh von Bennewitz <michael@schloh.com>
- date
- Thu, 22 Jan 2015 13:21:57 +0100
- branch
- TOR_BUG_9701
- changeset 15
- b8a032363ba2
- permissions
- -rw-r--r--
Incorporate requested changes from Mozilla in review:
https://bugzilla.mozilla.org/show_bug.cgi?id=1123480#c6
1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><title>CRLUTIL</title><meta name="generator" content="DocBook XSL Stylesheets V1.78.1"><link rel="home" href="index.html" title="CRLUTIL"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">CRLUTIL</th></tr></table><hr></div><div class="refentry"><a name="crlutil"></a><div class="titlepage"></div><div class="refnamediv"><h2>Name</h2><p>crlutil —
2 List, generate, modify, or delete CRLs within the NSS security database file(s) and list, create, modify or delete certificates entries in a particular CRL.
3 </p></div><div class="refsynopsisdiv"><h2>Synopsis</h2><div class="cmdsynopsis"><p><code class="command">crlutil</code> [<em class="replaceable"><code>options</code></em>] [[<em class="replaceable"><code>arguments</code></em>]]</p></div></div><div class="refsection"><a name="idm233261315520"></a><h2>STATUS</h2><p>This documentation is still work in progress. Please contribute to the initial review in <a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=836477" target="_top">Mozilla NSS bug 836477</a>
4 </p></div><div class="refsection"><a name="description"></a><h2>Description</h2><p>The Certificate Revocation List (CRL) Management Tool, <span class="command"><strong>crlutil</strong></span>, is a command-line utility that can list, generate, modify, or delete CRLs within the NSS security database file(s) and list, create, modify or delete certificates entries in a particular CRL.
5 </p><p>
6 The key and certificate management process generally begins with creating keys in the key database, then generating and managing certificates in the certificate database(see certutil tool) and continues with certificates expiration or revocation.
7 </p><p>
8 This document discusses certificate revocation list management. For information on security module database management, see Using the Security Module Database Tool. For information on certificate and key database management, see Using the Certificate Database Tool.
9 </p><p>
10 To run the Certificate Revocation List Management Tool, type the command
11 </p><p>
12 crlutil option [arguments]
13 </p><p>
14 where options and arguments are combinations of the options and arguments listed in the following section. Each command takes one option. Each option may take zero or more arguments. To see a usage string, issue the command without options, or with the -H option.
15 </p></div><div class="refsection"><a name="options"></a><h2>Options and Arguments</h2><p>
16 </p><p><span class="command"><strong>Options</strong></span></p><p>
17 Options specify an action. Option arguments modify an action.
18 The options and arguments for the crlutil command are defined as follows:
19 </p><div class="variablelist"><dl class="variablelist"><dt><span class="term">-D </span></dt><dd><p>
20 Delete Certificate Revocation List from cert database.
21 </p></dd><dt><span class="term">-E </span></dt><dd><p>
22 Erase all CRLs of specified type from the cert database
23 </p></dd><dt><span class="term">-G </span></dt><dd><p>
24 Create new Certificate Revocation List (CRL).
25 </p></dd><dt><span class="term">-I </span></dt><dd><p>
26 Import a CRL to the cert database
27 </p></dd><dt><span class="term">-L </span></dt><dd><p>
28 List existing CRL located in cert database file.
29 </p></dd><dt><span class="term">-M </span></dt><dd><p>
30 Modify existing CRL which can be located in cert db or in arbitrary file. If located in file it should be encoded in ASN.1 encode format.
31 </p></dd><dt><span class="term">-S </span></dt><dd><p>
32 Show contents of a CRL file which isn't stored in the database.
33 </p></dd></dl></div><p><span class="command"><strong>Arguments</strong></span></p><p>Option arguments modify an action.</p><div class="variablelist"><dl class="variablelist"><dt><span class="term">-a </span></dt><dd><p>
34 Use ASCII format or allow the use of ASCII format for input and output. This formatting follows RFC #1113.
35 </p></dd><dt><span class="term">-B </span></dt><dd><p>
36 Bypass CA signature checks.
37 </p></dd><dt><span class="term">-c crl-gen-file </span></dt><dd><p>
38 Specify script file that will be used to control crl generation/modification. See crl-cript-file format below. If options -M|-G is used and -c crl-script-file is not specified, crlutil will read script data from standard input.
39 </p></dd><dt><span class="term">-d directory </span></dt><dd><p>
40 Specify the database directory containing the certificate and key database files. On Unix the Certificate Database Tool defaults to $HOME/.netscape (that is, ~/.netscape). On Windows NT the default is the current directory.
41 </p><p>
42 The NSS database files must reside in the same directory.
43 </p></dd><dt><span class="term">-f password-file </span></dt><dd><p>
44 Specify a file that will automatically supply the password to include in a certificate or to access a certificate database. This is a plain-text file containing one password. Be sure to prevent unauthorized access to this file.
45 </p></dd><dt><span class="term">-i crl-file </span></dt><dd><p>
46 Specify the file which contains the CRL to import or show.
47 </p></dd><dt><span class="term">-l algorithm-name </span></dt><dd><p>
48 Specify a specific signature algorithm. List of possible algorithms: MD2 | MD4 | MD5 | SHA1 | SHA256 | SHA384 | SHA512
49 </p></dd><dt><span class="term">-n nickname </span></dt><dd><p>
50 Specify the nickname of a certificate or key to list, create, add to a database, modify, or validate. Bracket the nickname string with quotation marks if it contains spaces.
51 </p></dd><dt><span class="term">-o output-file </span></dt><dd><p>
52 Specify the output file name for new CRL. Bracket the output-file string with quotation marks if it contains spaces. If this argument is not used the output destination defaults to standard output.
53 </p></dd><dt><span class="term">-P dbprefix </span></dt><dd><p>
54 Specify the prefix used on the NSS security database files (for example, my_cert8.db and my_key3.db). This option is provided as a special case. Changing the names of the certificate and key databases is not recommended.
55 </p></dd><dt><span class="term">-t crl-type </span></dt><dd><p>
56 Specify type of CRL. possible types are: 0 - SEC_KRL_TYPE, 1 - SEC_CRL_TYPE. This option is obsolete
57 </p></dd><dt><span class="term">-u url </span></dt><dd><p>
58 Specify the url.
59 </p></dd><dt><span class="term">-w pwd-string</span></dt><dd><p>Provide db password in command line.</p></dd><dt><span class="term">-Z algorithm</span></dt><dd><p>Specify the hash algorithm to use for signing the CRL.</p></dd></dl></div></div><div class="refsection"><a name="syntax"></a><h2>CRL Generation script syntax</h2><p>CRL generation script file has the following syntax:</p><p>
60 * Line with comments should have # as a first symbol of a line</p><p>
61 * Set "this update" or "next update" CRL fields:
62 </p><p>
63 update=YYYYMMDDhhmmssZ
64 nextupdate=YYYYMMDDhhmmssZ
65 </p><p>
66 Field "next update" is optional. Time should be in GeneralizedTime format (YYYYMMDDhhmmssZ).
67 For example: 20050204153000Z
68 </p><p>* Add an extension to a CRL or a crl certificate entry:</p><p>addext extension-name critical/non-critical [arg1[arg2 ...]]</p><p>Where:</p><p>
69 extension-name: string value of a name of known extensions.
70 critical/non-critical: is 1 when extension is critical and 0 otherwise.
71 arg1, arg2: specific to extension type extension parameters
72 </p><p>
73 addext uses the range that was set earlier by addcert and will install an extension to every cert entries within the range.
74 </p><p>
75 * Add certificate entries(s) to CRL:
76 </p><p>
77 addcert range date
78 </p><p>
79 range: two integer values separated by dash: range of certificates that will be added by this command. dash is used as a delimiter. Only one cert will be added if there is no delimiter.
80 date: revocation date of a cert. Date should be represented in GeneralizedTime format (YYYYMMDDhhmmssZ).
81 </p><p>
82 * Remove certificate entry(s) from CRL
83 </p><p>
84 rmcert range
85 </p><p>
86 Where:
87 </p><p>
88 range: two integer values separated by dash: range of certificates that will be added by this command. dash is used as a delimiter. Only one cert will be added if there is no delimiter.
89 </p><p>
90 * Change range of certificate entry(s) in CRL
91 </p><p>
92 range new-range
93 </p><p>
94 Where:
95 </p><p>
96 new-range: two integer values separated by dash: range of certificates that will be added by this command. dash is used as a delimiter. Only one cert will be added if there is no delimiter.
97 </p><p>
98 Implemented Extensions
99 </p><p>
100 The extensions defined for CRL provide methods for associating additional attributes with CRLs of theirs entries. For more information see RFC #3280
101 </p><p>
102 * Add The Authority Key Identifier extension:
103 </p><p>
104 The authority key identifier extension provides a means of identifying the public key corresponding to the private key used to sign a CRL.
105 </p><p>
106 authKeyId critical [key-id | dn cert-serial]
107 </p><p>
108 Where:
109 </p><p>
110 authKeyIdent: identifies the name of an extension
111 critical: value of 1 of 0. Should be set to 1 if this extension is critical or 0 otherwise.
112 key-id: key identifier represented in octet string. dn:: is a CA distinguished name cert-serial: authority certificate serial number.
113 </p><p>
114 * Add Issuer Alternative Name extension:
115 </p><p>
116 The issuer alternative names extension allows additional identities to be associated with the issuer of the CRL. Defined options include an rfc822 name (electronic mail address), a DNS name, an IP address, and a URI.
117 </p><p>
118 issuerAltNames non-critical name-list
119 </p><p>
120 Where:
121 </p><p>
122 subjAltNames: identifies the name of an extension
123 should be set to 0 since this is non-critical extension
124 name-list: comma separated list of names
125 </p><p>
126 * Add CRL Number extension:
127 </p><p>
128 The CRL number is a non-critical CRL extension which conveys a monotonically increasing sequence number for a given CRL scope and CRL issuer. This extension allows users to easily determine when a particular CRL supersedes another CRL
129 </p><p>
130 crlNumber non-critical number
131 </p><p>
132 Where:
133 </p><p>
134 crlNumber: identifies the name of an extension
135 critical: should be set to 0 since this is non-critical extension
136 number: value of long which identifies the sequential number of a CRL.
137 </p><p>
138 * Add Revocation Reason Code extension:
139 </p><p>
140 The reasonCode is a non-critical CRL entry extension that identifies the reason for the certificate revocation.
141 </p><p>
142 reasonCode non-critical code
143 </p><p>
144 Where:
145 </p><p>
146 reasonCode: identifies the name of an extension
147 non-critical: should be set to 0 since this is non-critical extension
148 code: the following codes are available:
149 </p><p>
150 unspecified (0),
151 keyCompromise (1),
152 cACompromise (2),
153 affiliationChanged (3),
154 superseded (4),
155 cessationOfOperation (5),
156 certificateHold (6),
157 removeFromCRL (8),
158 privilegeWithdrawn (9),
159 aACompromise (10)
160 </p><p>
161 * Add Invalidity Date extension:
162 </p><p>
163 The invalidity date is a non-critical CRL entry extension that provides the date on which it is known or suspected that the private key was compromised or that the certificate otherwise became invalid.
164 </p><p>
165 invalidityDate non-critical date
166 </p><p>
167 Where:
168 </p><p>
169 crlNumber: identifies the name of an extension
170 non-critical: should be set to 0 since this is non-critical extension date: invalidity date of a cert. Date should be represented in GeneralizedTime format (YYYYMMDDhhmmssZ).
171 </p></div><div class="refsection"><a name="usage"></a><h2>Usage</h2><p>
172 The Certificate Revocation List Management Tool's capabilities are grouped as follows, using these combinations of options and arguments. Options and arguments in square brackets are optional, those without square brackets are required.
173 </p><p>See "Implemented extensions" for more information regarding extensions and their parameters.</p><p>
174 * Creating or modifying a CRL:
175 </p><pre class="programlisting">
176 crlutil -G|-M -c crl-gen-file -n nickname [-i crl] [-u url] [-d keydir] [-P dbprefix] [-l alg] [-a] [-B]
177 </pre><p>
178 * Listing all CRls or a named CRL:
179 </p><pre class="programlisting">
180 crlutil -L [-n crl-name] [-d krydir]
181 </pre><p>
182 * Deleting CRL from db:
183 </p><pre class="programlisting">
184 crlutil -D -n nickname [-d keydir] [-P dbprefix]
185 </pre><p>
186 * Erasing CRLs from db:
187 </p><pre class="programlisting">
188 crlutil -E [-d keydir] [-P dbprefix]
189 </pre><p>
190 * Deleting CRL from db:
191 </p><pre class="programlisting">
192 crlutil -D -n nickname [-d keydir] [-P dbprefix]
193 </pre><p>
194 * Erasing CRLs from db:
195 </p><pre class="programlisting">
196 crlutil -E [-d keydir] [-P dbprefix]
197 </pre><p>
198 * Import CRL from file:
199 </p><pre class="programlisting">
200 crlutil -I -i crl [-t crlType] [-u url] [-d keydir] [-P dbprefix] [-B]
201 </pre></div><div class="refsection"><a name="seealso"></a><h2>See Also</h2><p>certutil(1)</p></div><div class="refsection"><a name="resources"></a><h2>Additional Resources</h2><p>For information about NSS and other tools related to NSS (like JSS), check out the NSS project wiki at <a class="ulink" href="http://www.mozilla.org/projects/security/pki/nss/" target="_top">http://www.mozilla.org/projects/security/pki/nss/</a>. The NSS site relates directly to NSS code changes and releases.</p><p>Mailing lists: https://lists.mozilla.org/listinfo/dev-tech-crypto</p><p>IRC: Freenode at #dogtag-pki</p></div><div class="refsection"><a name="authors"></a><h2>Authors</h2><p>The NSS tools were written and maintained by developers with Netscape, Red Hat, Sun, Oracle, Mozilla, and Google.</p><p>
202 Authors: Elio Maldonado <emaldona@redhat.com>, Deon Lackey <dlackey@redhat.com>.
203 </p></div><div class="refsection"><a name="license"></a><h2>LICENSE</h2><p>Licensed under the Mozilla Public License, v. 2.0. If a copy of the MPL was not distributed with this file, You can obtain one at http://mozilla.org/MPL/2.0/.
204 </p></div></div><div class="navfooter"><hr></div></body></html>
