michael@0: '\" t
michael@0: .\"     Title: PK12UTIL
michael@0: .\"    Author: [see the "Authors" section]
michael@0: .\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>
michael@0: .\"      Date:  5 June 2014
michael@0: .\"    Manual: NSS Security Tools
michael@0: .\"    Source: nss-tools
michael@0: .\"  Language: English
michael@0: .\"
michael@0: .TH "PK12UTIL" "1" "5 June 2014" "nss-tools" "NSS Security Tools"
michael@0: .\" -----------------------------------------------------------------
michael@0: .\" * Define some portability stuff
michael@0: .\" -----------------------------------------------------------------
michael@0: .\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
michael@0: .\" http://bugs.debian.org/507673
michael@0: .\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html
michael@0: .\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
michael@0: .ie \n(.g .ds Aq \(aq
michael@0: .el       .ds Aq '
michael@0: .\" -----------------------------------------------------------------
michael@0: .\" * set default formatting
michael@0: .\" -----------------------------------------------------------------
michael@0: .\" disable hyphenation
michael@0: .nh
michael@0: .\" disable justification (adjust text to left margin only)
michael@0: .ad l
michael@0: .\" -----------------------------------------------------------------
michael@0: .\" * MAIN CONTENT STARTS HERE *
michael@0: .\" -----------------------------------------------------------------
michael@0: .SH "NAME"
michael@0: pk12util \- Export and import keys and certificate to or from a PKCS #12 file and the NSS database
michael@0: .SH "SYNOPSIS"
michael@0: .HP \w'\fBpk12util\fR\ 'u
michael@0: \fBpk12util\fR [\-i\ p12File|\-l\ p12File|\-o\ p12File] [\-d\ [sql:]directory] [\-h\ tokenname] [\-P\ dbprefix] [\-r] [\-v] [\-k\ slotPasswordFile|\-K\ slotPassword] [\-w\ p12filePasswordFile|\-W\ p12filePassword]
michael@0: .SH "STATUS"
michael@0: .PP
michael@0: This documentation is still work in progress\&. Please contribute to the initial review in
michael@0: \m[blue]\fBMozilla NSS bug 836477\fR\m[]\&\s-2\u[1]\d\s+2
michael@0: .SH "DESCRIPTION"
michael@0: .PP
michael@0: The PKCS #12 utility,
michael@0: \fBpk12util\fR, enables sharing certificates among any server that supports PKCS#12\&. The tool can import certificates and keys from PKCS#12 files into security databases, export certificates, and list certificates and keys\&.
michael@0: .SH "OPTIONS AND ARGUMENTS"
michael@0: .PP
michael@0: \fBOptions\fR
michael@0: .PP
michael@0: \-i p12file
michael@0: .RS 4
michael@0: Import keys and certificates from a PKCS#12 file into a security database\&.
michael@0: .RE
michael@0: .PP
michael@0: \-l p12file
michael@0: .RS 4
michael@0: List the keys and certificates in PKCS#12 file\&.
michael@0: .RE
michael@0: .PP
michael@0: \-o p12file
michael@0: .RS 4
michael@0: Export keys and certificates from the security database to a PKCS#12 file\&.
michael@0: .RE
michael@0: .PP
michael@0: \fBArguments\fR
michael@0: .PP
michael@0: \-c keyCipher
michael@0: .RS 4
michael@0: Specify the key encryption algorithm\&.
michael@0: .RE
michael@0: .PP
michael@0: \-C certCipher
michael@0: .RS 4
michael@0: Specify the key cert (overall package) encryption algorithm\&.
michael@0: .RE
michael@0: .PP
michael@0: \-d [sql:]directory
michael@0: .RS 4
michael@0: Specify the database directory into which to import to or export from certificates and keys\&.
michael@0: .sp
michael@0: \fBpk12util\fR
michael@0: supports two types of databases: the legacy security databases (cert8\&.db,
michael@0: key3\&.db, and
michael@0: secmod\&.db) and new SQLite databases (cert9\&.db,
michael@0: key4\&.db, and
michael@0: pkcs11\&.txt)\&. If the prefix
michael@0: \fBsql:\fR
michael@0: is not used, then the tool assumes that the given databases are in the old format\&.
michael@0: .RE
michael@0: .PP
michael@0: \-h tokenname
michael@0: .RS 4
michael@0: Specify the name of the token to import into or export from\&.
michael@0: .RE
michael@0: .PP
michael@0: \-k slotPasswordFile
michael@0: .RS 4
michael@0: Specify the text file containing the slot\*(Aqs password\&.
michael@0: .RE
michael@0: .PP
michael@0: \-K slotPassword
michael@0: .RS 4
michael@0: Specify the slot\*(Aqs password\&.
michael@0: .RE
michael@0: .PP
michael@0: \-m | \-\-key\-len keyLength
michael@0: .RS 4
michael@0: Specify the desired length of the symmetric key to be used to encrypt the private key\&.
michael@0: .RE
michael@0: .PP
michael@0: \-n | \-\-cert\-key\-len certKeyLength
michael@0: .RS 4
michael@0: Specify the desired length of the symmetric key to be used to encrypt the certificates and other meta\-data\&.
michael@0: .RE
michael@0: .PP
michael@0: \-n certname
michael@0: .RS 4
michael@0: Specify the nickname of the cert and private key to export\&.
michael@0: .RE
michael@0: .PP
michael@0: \-P prefix
michael@0: .RS 4
michael@0: Specify the prefix used on the certificate and key databases\&. This option is provided as a special case\&. Changing the names of the certificate and key databases is not recommended\&.
michael@0: .RE
michael@0: .PP
michael@0: \-r
michael@0: .RS 4
michael@0: Dumps all of the data in raw (binary) form\&. This must be saved as a DER file\&. The default is to return information in a pretty\-print ASCII format, which displays the information about the certificates and public keys in the p12 file\&.
michael@0: .RE
michael@0: .PP
michael@0: \-v
michael@0: .RS 4
michael@0: Enable debug logging when importing\&.
michael@0: .RE
michael@0: .PP
michael@0: \-w p12filePasswordFile
michael@0: .RS 4
michael@0: Specify the text file containing the pkcs #12 file password\&.
michael@0: .RE
michael@0: .PP
michael@0: \-W p12filePassword
michael@0: .RS 4
michael@0: Specify the pkcs #12 file password\&.
michael@0: .RE
michael@0: .SH "RETURN CODES"
michael@0: .sp
michael@0: .RS 4
michael@0: .ie n \{\
michael@0: \h'-04'\(bu\h'+03'\c
michael@0: .\}
michael@0: .el \{\
michael@0: .sp -1
michael@0: .IP \(bu 2.3
michael@0: .\}
michael@0: 0 \- No error
michael@0: .RE
michael@0: .sp
michael@0: .RS 4
michael@0: .ie n \{\
michael@0: \h'-04'\(bu\h'+03'\c
michael@0: .\}
michael@0: .el \{\
michael@0: .sp -1
michael@0: .IP \(bu 2.3
michael@0: .\}
michael@0: 1 \- User Cancelled
michael@0: .RE
michael@0: .sp
michael@0: .RS 4
michael@0: .ie n \{\
michael@0: \h'-04'\(bu\h'+03'\c
michael@0: .\}
michael@0: .el \{\
michael@0: .sp -1
michael@0: .IP \(bu 2.3
michael@0: .\}
michael@0: 2 \- Usage error
michael@0: .RE
michael@0: .sp
michael@0: .RS 4
michael@0: .ie n \{\
michael@0: \h'-04'\(bu\h'+03'\c
michael@0: .\}
michael@0: .el \{\
michael@0: .sp -1
michael@0: .IP \(bu 2.3
michael@0: .\}
michael@0: 6 \- NLS init error
michael@0: .RE
michael@0: .sp
michael@0: .RS 4
michael@0: .ie n \{\
michael@0: \h'-04'\(bu\h'+03'\c
michael@0: .\}
michael@0: .el \{\
michael@0: .sp -1
michael@0: .IP \(bu 2.3
michael@0: .\}
michael@0: 8 \- Certificate DB open error
michael@0: .RE
michael@0: .sp
michael@0: .RS 4
michael@0: .ie n \{\
michael@0: \h'-04'\(bu\h'+03'\c
michael@0: .\}
michael@0: .el \{\
michael@0: .sp -1
michael@0: .IP \(bu 2.3
michael@0: .\}
michael@0: 9 \- Key DB open error
michael@0: .RE
michael@0: .sp
michael@0: .RS 4
michael@0: .ie n \{\
michael@0: \h'-04'\(bu\h'+03'\c
michael@0: .\}
michael@0: .el \{\
michael@0: .sp -1
michael@0: .IP \(bu 2.3
michael@0: .\}
michael@0: 10 \- File initialization error
michael@0: .RE
michael@0: .sp
michael@0: .RS 4
michael@0: .ie n \{\
michael@0: \h'-04'\(bu\h'+03'\c
michael@0: .\}
michael@0: .el \{\
michael@0: .sp -1
michael@0: .IP \(bu 2.3
michael@0: .\}
michael@0: 11 \- Unicode conversion error
michael@0: .RE
michael@0: .sp
michael@0: .RS 4
michael@0: .ie n \{\
michael@0: \h'-04'\(bu\h'+03'\c
michael@0: .\}
michael@0: .el \{\
michael@0: .sp -1
michael@0: .IP \(bu 2.3
michael@0: .\}
michael@0: 12 \- Temporary file creation error
michael@0: .RE
michael@0: .sp
michael@0: .RS 4
michael@0: .ie n \{\
michael@0: \h'-04'\(bu\h'+03'\c
michael@0: .\}
michael@0: .el \{\
michael@0: .sp -1
michael@0: .IP \(bu 2.3
michael@0: .\}
michael@0: 13 \- PKCS11 get slot error
michael@0: .RE
michael@0: .sp
michael@0: .RS 4
michael@0: .ie n \{\
michael@0: \h'-04'\(bu\h'+03'\c
michael@0: .\}
michael@0: .el \{\
michael@0: .sp -1
michael@0: .IP \(bu 2.3
michael@0: .\}
michael@0: 14 \- PKCS12 decoder start error
michael@0: .RE
michael@0: .sp
michael@0: .RS 4
michael@0: .ie n \{\
michael@0: \h'-04'\(bu\h'+03'\c
michael@0: .\}
michael@0: .el \{\
michael@0: .sp -1
michael@0: .IP \(bu 2.3
michael@0: .\}
michael@0: 15 \- error read from import file
michael@0: .RE
michael@0: .sp
michael@0: .RS 4
michael@0: .ie n \{\
michael@0: \h'-04'\(bu\h'+03'\c
michael@0: .\}
michael@0: .el \{\
michael@0: .sp -1
michael@0: .IP \(bu 2.3
michael@0: .\}
michael@0: 16 \- pkcs12 decode error
michael@0: .RE
michael@0: .sp
michael@0: .RS 4
michael@0: .ie n \{\
michael@0: \h'-04'\(bu\h'+03'\c
michael@0: .\}
michael@0: .el \{\
michael@0: .sp -1
michael@0: .IP \(bu 2.3
michael@0: .\}
michael@0: 17 \- pkcs12 decoder verify error
michael@0: .RE
michael@0: .sp
michael@0: .RS 4
michael@0: .ie n \{\
michael@0: \h'-04'\(bu\h'+03'\c
michael@0: .\}
michael@0: .el \{\
michael@0: .sp -1
michael@0: .IP \(bu 2.3
michael@0: .\}
michael@0: 18 \- pkcs12 decoder validate bags error
michael@0: .RE
michael@0: .sp
michael@0: .RS 4
michael@0: .ie n \{\
michael@0: \h'-04'\(bu\h'+03'\c
michael@0: .\}
michael@0: .el \{\
michael@0: .sp -1
michael@0: .IP \(bu 2.3
michael@0: .\}
michael@0: 19 \- pkcs12 decoder import bags error
michael@0: .RE
michael@0: .sp
michael@0: .RS 4
michael@0: .ie n \{\
michael@0: \h'-04'\(bu\h'+03'\c
michael@0: .\}
michael@0: .el \{\
michael@0: .sp -1
michael@0: .IP \(bu 2.3
michael@0: .\}
michael@0: 20 \- key db conversion version 3 to version 2 error
michael@0: .RE
michael@0: .sp
michael@0: .RS 4
michael@0: .ie n \{\
michael@0: \h'-04'\(bu\h'+03'\c
michael@0: .\}
michael@0: .el \{\
michael@0: .sp -1
michael@0: .IP \(bu 2.3
michael@0: .\}
michael@0: 21 \- cert db conversion version 7 to version 5 error
michael@0: .RE
michael@0: .sp
michael@0: .RS 4
michael@0: .ie n \{\
michael@0: \h'-04'\(bu\h'+03'\c
michael@0: .\}
michael@0: .el \{\
michael@0: .sp -1
michael@0: .IP \(bu 2.3
michael@0: .\}
michael@0: 22 \- cert and key dbs patch error
michael@0: .RE
michael@0: .sp
michael@0: .RS 4
michael@0: .ie n \{\
michael@0: \h'-04'\(bu\h'+03'\c
michael@0: .\}
michael@0: .el \{\
michael@0: .sp -1
michael@0: .IP \(bu 2.3
michael@0: .\}
michael@0: 23 \- get default cert db error
michael@0: .RE
michael@0: .sp
michael@0: .RS 4
michael@0: .ie n \{\
michael@0: \h'-04'\(bu\h'+03'\c
michael@0: .\}
michael@0: .el \{\
michael@0: .sp -1
michael@0: .IP \(bu 2.3
michael@0: .\}
michael@0: 24 \- find cert by nickname error
michael@0: .RE
michael@0: .sp
michael@0: .RS 4
michael@0: .ie n \{\
michael@0: \h'-04'\(bu\h'+03'\c
michael@0: .\}
michael@0: .el \{\
michael@0: .sp -1
michael@0: .IP \(bu 2.3
michael@0: .\}
michael@0: 25 \- create export context error
michael@0: .RE
michael@0: .sp
michael@0: .RS 4
michael@0: .ie n \{\
michael@0: \h'-04'\(bu\h'+03'\c
michael@0: .\}
michael@0: .el \{\
michael@0: .sp -1
michael@0: .IP \(bu 2.3
michael@0: .\}
michael@0: 26 \- PKCS12 add password itegrity error
michael@0: .RE
michael@0: .sp
michael@0: .RS 4
michael@0: .ie n \{\
michael@0: \h'-04'\(bu\h'+03'\c
michael@0: .\}
michael@0: .el \{\
michael@0: .sp -1
michael@0: .IP \(bu 2.3
michael@0: .\}
michael@0: 27 \- cert and key Safes creation error
michael@0: .RE
michael@0: .sp
michael@0: .RS 4
michael@0: .ie n \{\
michael@0: \h'-04'\(bu\h'+03'\c
michael@0: .\}
michael@0: .el \{\
michael@0: .sp -1
michael@0: .IP \(bu 2.3
michael@0: .\}
michael@0: 28 \- PKCS12 add cert and key error
michael@0: .RE
michael@0: .sp
michael@0: .RS 4
michael@0: .ie n \{\
michael@0: \h'-04'\(bu\h'+03'\c
michael@0: .\}
michael@0: .el \{\
michael@0: .sp -1
michael@0: .IP \(bu 2.3
michael@0: .\}
michael@0: 29 \- PKCS12 encode error
michael@0: .RE
michael@0: .SH "EXAMPLES"
michael@0: .PP
michael@0: \fBImporting Keys and Certificates\fR
michael@0: .PP
michael@0: The most basic usage of
michael@0: \fBpk12util\fR
michael@0: for importing a certificate or key is the PKCS#12 input file (\fB\-i\fR) and some way to specify the security database being accessed (either
michael@0: \fB\-d\fR
michael@0: for a directory or
michael@0: \fB\-h\fR
michael@0: for a token)\&.
michael@0: .PP
michael@0: pk12util \-i p12File [\-h tokenname] [\-v] [\-d [sql:]directory] [\-P dbprefix] [\-k slotPasswordFile|\-K slotPassword] [\-w p12filePasswordFile|\-W p12filePassword]
michael@0: .PP
michael@0: For example:
michael@0: .PP
michael@0: 
michael@0: .sp
michael@0: .if n \{\
michael@0: .RS 4
michael@0: .\}
michael@0: .nf
michael@0: # pk12util \-i /tmp/cert\-files/users\&.p12 \-d sql:/home/my/sharednssdb
michael@0: 
michael@0: Enter a password which will be used to encrypt your keys\&.
michael@0: The password should be at least 8 characters long,
michael@0: and should contain at least one non\-alphabetic character\&.
michael@0: 
michael@0: Enter new password: 
michael@0: Re\-enter password: 
michael@0: Enter password for PKCS12 file: 
michael@0: pk12util: PKCS12 IMPORT SUCCESSFUL
michael@0: .fi
michael@0: .if n \{\
michael@0: .RE
michael@0: .\}
michael@0: .PP
michael@0: \fBExporting Keys and Certificates\fR
michael@0: .PP
michael@0: Using the
michael@0: \fBpk12util\fR
michael@0: command to export certificates and keys requires both the name of the certificate to extract from the database (\fB\-n\fR) and the PKCS#12\-formatted output file to write to\&. There are optional parameters that can be used to encrypt the file to protect the certificate material\&.
michael@0: .PP
michael@0: pk12util \-o p12File \-n certname [\-c keyCipher] [\-C certCipher] [\-m|\-\-key_len keyLen] [\-n|\-\-cert_key_len certKeyLen] [\-d [sql:]directory] [\-P dbprefix] [\-k slotPasswordFile|\-K slotPassword] [\-w p12filePasswordFile|\-W p12filePassword]
michael@0: .PP
michael@0: For example:
michael@0: .sp
michael@0: .if n \{\
michael@0: .RS 4
michael@0: .\}
michael@0: .nf
michael@0: # pk12util \-o certs\&.p12 \-n Server\-Cert \-d sql:/home/my/sharednssdb
michael@0: Enter password for PKCS12 file: 
michael@0: Re\-enter password: 
michael@0: .fi
michael@0: .if n \{\
michael@0: .RE
michael@0: .\}
michael@0: .PP
michael@0: \fBListing Keys and Certificates\fR
michael@0: .PP
michael@0: The information in a
michael@0: \&.p12
michael@0: file are not human\-readable\&. The certificates and keys in the file can be printed (listed) in a human\-readable pretty\-print format that shows information for every certificate and any public keys in the
michael@0: \&.p12
michael@0: file\&.
michael@0: .PP
michael@0: pk12util \-l p12File [\-h tokenname] [\-r] [\-d [sql:]directory] [\-P dbprefix] [\-k slotPasswordFile|\-K slotPassword] [\-w p12filePasswordFile|\-W p12filePassword]
michael@0: .PP
michael@0: For example, this prints the default ASCII output:
michael@0: .sp
michael@0: .if n \{\
michael@0: .RS 4
michael@0: .\}
michael@0: .nf
michael@0: # pk12util \-l certs\&.p12
michael@0: 
michael@0: Enter password for PKCS12 file: 
michael@0: Key(shrouded):
michael@0:     Friendly Name: Thawte Freemail Member\*(Aqs Thawte Consulting (Pty) Ltd\&. ID
michael@0: 
michael@0:     Encryption algorithm: PKCS #12 V2 PBE With SHA\-1 And 3KEY Triple DES\-CBC
michael@0:         Parameters:
michael@0:             Salt:
michael@0:                 45:2e:6a:a0:03:4d:7b:a1:63:3c:15:ea:67:37:62:1f
michael@0:             Iteration Count: 1 (0x1)
michael@0: Certificate:
michael@0:     Data:
michael@0:         Version: 3 (0x2)
michael@0:         Serial Number: 13 (0xd)
michael@0:         Signature Algorithm: PKCS #1 SHA\-1 With RSA Encryption
michael@0:         Issuer: "E=personal\-freemail@thawte\&.com,CN=Thawte Personal Freemail C
michael@0:             A,OU=Certification Services Division,O=Thawte Consulting,L=Cape T
michael@0:             own,ST=Western Cape,C=ZA"
michael@0:     
michael@0: .fi
michael@0: .if n \{\
michael@0: .RE
michael@0: .\}
michael@0: .PP
michael@0: Alternatively, the
michael@0: \fB\-r\fR
michael@0: prints the certificates and then exports them into separate DER binary files\&. This allows the certificates to be fed to another application that supports
michael@0: \&.p12
michael@0: files\&. Each certificate is written to a sequentially\-number file, beginning with
michael@0: file0001\&.der
michael@0: and continuing through
michael@0: file000N\&.der, incrementing the number for every certificate:
michael@0: .sp
michael@0: .if n \{\
michael@0: .RS 4
michael@0: .\}
michael@0: .nf
michael@0: pk12util \-l test\&.p12 \-r
michael@0: Enter password for PKCS12 file: 
michael@0: Key(shrouded):
michael@0:     Friendly Name: Thawte Freemail Member\*(Aqs Thawte Consulting (Pty) Ltd\&. ID
michael@0: 
michael@0:     Encryption algorithm: PKCS #12 V2 PBE With SHA\-1 And 3KEY Triple DES\-CBC
michael@0:         Parameters:
michael@0:             Salt:
michael@0:                 45:2e:6a:a0:03:4d:7b:a1:63:3c:15:ea:67:37:62:1f
michael@0:             Iteration Count: 1 (0x1)
michael@0: Certificate    Friendly Name: Thawte Personal Freemail Issuing CA \- Thawte Consulting
michael@0: 
michael@0: Certificate    Friendly Name: Thawte Freemail Member\*(Aqs Thawte Consulting (Pty) Ltd\&. ID
michael@0:     
michael@0: .fi
michael@0: .if n \{\
michael@0: .RE
michael@0: .\}
michael@0: .SH "PASSWORD ENCRYPTION"
michael@0: .PP
michael@0: PKCS#12 provides for not only the protection of the private keys but also the certificate and meta\-data associated with the keys\&. Password\-based encryption is used to protect private keys on export to a PKCS#12 file and, optionally, the entire package\&. If no algorithm is specified, the tool defaults to using
michael@0: \fBPKCS12 V2 PBE with SHA1 and 3KEY Triple DES\-cbc\fR
michael@0: for private key encryption\&.
michael@0: \fBPKCS12 V2 PBE with SHA1 and 40 Bit RC4\fR
michael@0: is the default for the overall package encryption when not in FIPS mode\&. When in FIPS mode, there is no package encryption\&.
michael@0: .PP
michael@0: The private key is always protected with strong encryption by default\&.
michael@0: .PP
michael@0: Several types of ciphers are supported\&.
michael@0: .PP
michael@0: Symmetric CBC ciphers for PKCS#5 V2
michael@0: .RS 4
michael@0: .sp
michael@0: .RS 4
michael@0: .ie n \{\
michael@0: \h'-04'\(bu\h'+03'\c
michael@0: .\}
michael@0: .el \{\
michael@0: .sp -1
michael@0: .IP \(bu 2.3
michael@0: .\}
michael@0: DES\-CBC
michael@0: .RE
michael@0: .sp
michael@0: .RS 4
michael@0: .ie n \{\
michael@0: \h'-04'\(bu\h'+03'\c
michael@0: .\}
michael@0: .el \{\
michael@0: .sp -1
michael@0: .IP \(bu 2.3
michael@0: .\}
michael@0: RC2\-CBC
michael@0: .RE
michael@0: .sp
michael@0: .RS 4
michael@0: .ie n \{\
michael@0: \h'-04'\(bu\h'+03'\c
michael@0: .\}
michael@0: .el \{\
michael@0: .sp -1
michael@0: .IP \(bu 2.3
michael@0: .\}
michael@0: RC5\-CBCPad
michael@0: .RE
michael@0: .sp
michael@0: .RS 4
michael@0: .ie n \{\
michael@0: \h'-04'\(bu\h'+03'\c
michael@0: .\}
michael@0: .el \{\
michael@0: .sp -1
michael@0: .IP \(bu 2.3
michael@0: .\}
michael@0: DES\-EDE3\-CBC (the default for key encryption)
michael@0: .RE
michael@0: .sp
michael@0: .RS 4
michael@0: .ie n \{\
michael@0: \h'-04'\(bu\h'+03'\c
michael@0: .\}
michael@0: .el \{\
michael@0: .sp -1
michael@0: .IP \(bu 2.3
michael@0: .\}
michael@0: AES\-128\-CBC
michael@0: .RE
michael@0: .sp
michael@0: .RS 4
michael@0: .ie n \{\
michael@0: \h'-04'\(bu\h'+03'\c
michael@0: .\}
michael@0: .el \{\
michael@0: .sp -1
michael@0: .IP \(bu 2.3
michael@0: .\}
michael@0: AES\-192\-CBC
michael@0: .RE
michael@0: .sp
michael@0: .RS 4
michael@0: .ie n \{\
michael@0: \h'-04'\(bu\h'+03'\c
michael@0: .\}
michael@0: .el \{\
michael@0: .sp -1
michael@0: .IP \(bu 2.3
michael@0: .\}
michael@0: AES\-256\-CBC
michael@0: .RE
michael@0: .sp
michael@0: .RS 4
michael@0: .ie n \{\
michael@0: \h'-04'\(bu\h'+03'\c
michael@0: .\}
michael@0: .el \{\
michael@0: .sp -1
michael@0: .IP \(bu 2.3
michael@0: .\}
michael@0: CAMELLIA\-128\-CBC
michael@0: .RE
michael@0: .sp
michael@0: .RS 4
michael@0: .ie n \{\
michael@0: \h'-04'\(bu\h'+03'\c
michael@0: .\}
michael@0: .el \{\
michael@0: .sp -1
michael@0: .IP \(bu 2.3
michael@0: .\}
michael@0: CAMELLIA\-192\-CBC
michael@0: .RE
michael@0: .sp
michael@0: .RS 4
michael@0: .ie n \{\
michael@0: \h'-04'\(bu\h'+03'\c
michael@0: .\}
michael@0: .el \{\
michael@0: .sp -1
michael@0: .IP \(bu 2.3
michael@0: .\}
michael@0: CAMELLIA\-256\-CBC
michael@0: .RE
michael@0: .RE
michael@0: .PP
michael@0: PKCS#12 PBE ciphers
michael@0: .RS 4
michael@0: .sp
michael@0: .RS 4
michael@0: .ie n \{\
michael@0: \h'-04'\(bu\h'+03'\c
michael@0: .\}
michael@0: .el \{\
michael@0: .sp -1
michael@0: .IP \(bu 2.3
michael@0: .\}
michael@0: PKCS #12 PBE with Sha1 and 128 Bit RC4
michael@0: .RE
michael@0: .sp
michael@0: .RS 4
michael@0: .ie n \{\
michael@0: \h'-04'\(bu\h'+03'\c
michael@0: .\}
michael@0: .el \{\
michael@0: .sp -1
michael@0: .IP \(bu 2.3
michael@0: .\}
michael@0: PKCS #12 PBE with Sha1 and 40 Bit RC4
michael@0: .RE
michael@0: .sp
michael@0: .RS 4
michael@0: .ie n \{\
michael@0: \h'-04'\(bu\h'+03'\c
michael@0: .\}
michael@0: .el \{\
michael@0: .sp -1
michael@0: .IP \(bu 2.3
michael@0: .\}
michael@0: PKCS #12 PBE with Sha1 and Triple DES CBC
michael@0: .RE
michael@0: .sp
michael@0: .RS 4
michael@0: .ie n \{\
michael@0: \h'-04'\(bu\h'+03'\c
michael@0: .\}
michael@0: .el \{\
michael@0: .sp -1
michael@0: .IP \(bu 2.3
michael@0: .\}
michael@0: PKCS #12 PBE with Sha1 and 128 Bit RC2 CBC
michael@0: .RE
michael@0: .sp
michael@0: .RS 4
michael@0: .ie n \{\
michael@0: \h'-04'\(bu\h'+03'\c
michael@0: .\}
michael@0: .el \{\
michael@0: .sp -1
michael@0: .IP \(bu 2.3
michael@0: .\}
michael@0: PKCS #12 PBE with Sha1 and 40 Bit RC2 CBC
michael@0: .RE
michael@0: .sp
michael@0: .RS 4
michael@0: .ie n \{\
michael@0: \h'-04'\(bu\h'+03'\c
michael@0: .\}
michael@0: .el \{\
michael@0: .sp -1
michael@0: .IP \(bu 2.3
michael@0: .\}
michael@0: PKCS12 V2 PBE with SHA1 and 128 Bit RC4
michael@0: .RE
michael@0: .sp
michael@0: .RS 4
michael@0: .ie n \{\
michael@0: \h'-04'\(bu\h'+03'\c
michael@0: .\}
michael@0: .el \{\
michael@0: .sp -1
michael@0: .IP \(bu 2.3
michael@0: .\}
michael@0: PKCS12 V2 PBE with SHA1 and 40 Bit RC4 (the default for non\-FIPS mode)
michael@0: .RE
michael@0: .sp
michael@0: .RS 4
michael@0: .ie n \{\
michael@0: \h'-04'\(bu\h'+03'\c
michael@0: .\}
michael@0: .el \{\
michael@0: .sp -1
michael@0: .IP \(bu 2.3
michael@0: .\}
michael@0: PKCS12 V2 PBE with SHA1 and 3KEY Triple DES\-cbc
michael@0: .RE
michael@0: .sp
michael@0: .RS 4
michael@0: .ie n \{\
michael@0: \h'-04'\(bu\h'+03'\c
michael@0: .\}
michael@0: .el \{\
michael@0: .sp -1
michael@0: .IP \(bu 2.3
michael@0: .\}
michael@0: PKCS12 V2 PBE with SHA1 and 2KEY Triple DES\-cbc
michael@0: .RE
michael@0: .sp
michael@0: .RS 4
michael@0: .ie n \{\
michael@0: \h'-04'\(bu\h'+03'\c
michael@0: .\}
michael@0: .el \{\
michael@0: .sp -1
michael@0: .IP \(bu 2.3
michael@0: .\}
michael@0: PKCS12 V2 PBE with SHA1 and 128 Bit RC2 CBC
michael@0: .RE
michael@0: .sp
michael@0: .RS 4
michael@0: .ie n \{\
michael@0: \h'-04'\(bu\h'+03'\c
michael@0: .\}
michael@0: .el \{\
michael@0: .sp -1
michael@0: .IP \(bu 2.3
michael@0: .\}
michael@0: PKCS12 V2 PBE with SHA1 and 40 Bit RC2 CBC
michael@0: .RE
michael@0: .RE
michael@0: .PP
michael@0: PKCS#5 PBE ciphers
michael@0: .RS 4
michael@0: .sp
michael@0: .RS 4
michael@0: .ie n \{\
michael@0: \h'-04'\(bu\h'+03'\c
michael@0: .\}
michael@0: .el \{\
michael@0: .sp -1
michael@0: .IP \(bu 2.3
michael@0: .\}
michael@0: PKCS #5 Password Based Encryption with MD2 and DES CBC
michael@0: .RE
michael@0: .sp
michael@0: .RS 4
michael@0: .ie n \{\
michael@0: \h'-04'\(bu\h'+03'\c
michael@0: .\}
michael@0: .el \{\
michael@0: .sp -1
michael@0: .IP \(bu 2.3
michael@0: .\}
michael@0: PKCS #5 Password Based Encryption with MD5 and DES CBC
michael@0: .RE
michael@0: .sp
michael@0: .RS 4
michael@0: .ie n \{\
michael@0: \h'-04'\(bu\h'+03'\c
michael@0: .\}
michael@0: .el \{\
michael@0: .sp -1
michael@0: .IP \(bu 2.3
michael@0: .\}
michael@0: PKCS #5 Password Based Encryption with SHA1 and DES CBC
michael@0: .RE
michael@0: .RE
michael@0: .PP
michael@0: With PKCS#12, the crypto provider may be the soft token module or an external hardware module\&. If the cryptographic module does not support the requested algorithm, then the next best fit will be selected (usually the default)\&. If no suitable replacement for the desired algorithm can be found, the tool returns the error
michael@0: \fIno security module can perform the requested operation\fR\&.
michael@0: .SH "NSS DATABASE TYPES"
michael@0: .PP
michael@0: NSS originally used BerkeleyDB databases to store security information\&. The last versions of these
michael@0: \fIlegacy\fR
michael@0: databases are:
michael@0: .sp
michael@0: .RS 4
michael@0: .ie n \{\
michael@0: \h'-04'\(bu\h'+03'\c
michael@0: .\}
michael@0: .el \{\
michael@0: .sp -1
michael@0: .IP \(bu 2.3
michael@0: .\}
michael@0: cert8\&.db for certificates
michael@0: .RE
michael@0: .sp
michael@0: .RS 4
michael@0: .ie n \{\
michael@0: \h'-04'\(bu\h'+03'\c
michael@0: .\}
michael@0: .el \{\
michael@0: .sp -1
michael@0: .IP \(bu 2.3
michael@0: .\}
michael@0: key3\&.db for keys
michael@0: .RE
michael@0: .sp
michael@0: .RS 4
michael@0: .ie n \{\
michael@0: \h'-04'\(bu\h'+03'\c
michael@0: .\}
michael@0: .el \{\
michael@0: .sp -1
michael@0: .IP \(bu 2.3
michael@0: .\}
michael@0: secmod\&.db for PKCS #11 module information
michael@0: .RE
michael@0: .PP
michael@0: BerkeleyDB has performance limitations, though, which prevent it from being easily used by multiple applications simultaneously\&. NSS has some flexibility that allows applications to use their own, independent database engine while keeping a shared database and working around the access issues\&. Still, NSS requires more flexibility to provide a truly shared security database\&.
michael@0: .PP
michael@0: In 2009, NSS introduced a new set of databases that are SQLite databases rather than BerkleyDB\&. These new databases provide more accessibility and performance:
michael@0: .sp
michael@0: .RS 4
michael@0: .ie n \{\
michael@0: \h'-04'\(bu\h'+03'\c
michael@0: .\}
michael@0: .el \{\
michael@0: .sp -1
michael@0: .IP \(bu 2.3
michael@0: .\}
michael@0: cert9\&.db for certificates
michael@0: .RE
michael@0: .sp
michael@0: .RS 4
michael@0: .ie n \{\
michael@0: \h'-04'\(bu\h'+03'\c
michael@0: .\}
michael@0: .el \{\
michael@0: .sp -1
michael@0: .IP \(bu 2.3
michael@0: .\}
michael@0: key4\&.db for keys
michael@0: .RE
michael@0: .sp
michael@0: .RS 4
michael@0: .ie n \{\
michael@0: \h'-04'\(bu\h'+03'\c
michael@0: .\}
michael@0: .el \{\
michael@0: .sp -1
michael@0: .IP \(bu 2.3
michael@0: .\}
michael@0: pkcs11\&.txt, which is listing of all of the PKCS #11 modules contained in a new subdirectory in the security databases directory
michael@0: .RE
michael@0: .PP
michael@0: Because the SQLite databases are designed to be shared, these are the
michael@0: \fIshared\fR
michael@0: database type\&. The shared database type is preferred; the legacy format is included for backward compatibility\&.
michael@0: .PP
michael@0: By default, the tools (\fBcertutil\fR,
michael@0: \fBpk12util\fR,
michael@0: \fBmodutil\fR) assume that the given security databases follow the more common legacy type\&. Using the SQLite databases must be manually specified by using the
michael@0: \fBsql:\fR
michael@0: prefix with the given security directory\&. For example:
michael@0: .sp
michael@0: .if n \{\
michael@0: .RS 4
michael@0: .\}
michael@0: .nf
michael@0: # pk12util \-i /tmp/cert\-files/users\&.p12 \-d sql:/home/my/sharednssdb
michael@0: .fi
michael@0: .if n \{\
michael@0: .RE
michael@0: .\}
michael@0: .PP
michael@0: To set the shared database type as the default type for the tools, set the
michael@0: \fBNSS_DEFAULT_DB_TYPE\fR
michael@0: environment variable to
michael@0: \fBsql\fR:
michael@0: .sp
michael@0: .if n \{\
michael@0: .RS 4
michael@0: .\}
michael@0: .nf
michael@0: export NSS_DEFAULT_DB_TYPE="sql"
michael@0: .fi
michael@0: .if n \{\
michael@0: .RE
michael@0: .\}
michael@0: .PP
michael@0: This line can be set added to the
michael@0: ~/\&.bashrc
michael@0: file to make the change permanent\&.
michael@0: .PP
michael@0: Most applications do not use the shared database by default, but they can be configured to use them\&. For example, this how\-to article covers how to configure Firefox and Thunderbird to use the new shared NSS databases:
michael@0: .sp
michael@0: .RS 4
michael@0: .ie n \{\
michael@0: \h'-04'\(bu\h'+03'\c
michael@0: .\}
michael@0: .el \{\
michael@0: .sp -1
michael@0: .IP \(bu 2.3
michael@0: .\}
michael@0: https://wiki\&.mozilla\&.org/NSS_Shared_DB_Howto
michael@0: .RE
michael@0: .PP
michael@0: For an engineering draft on the changes in the shared NSS databases, see the NSS project wiki:
michael@0: .sp
michael@0: .RS 4
michael@0: .ie n \{\
michael@0: \h'-04'\(bu\h'+03'\c
michael@0: .\}
michael@0: .el \{\
michael@0: .sp -1
michael@0: .IP \(bu 2.3
michael@0: .\}
michael@0: https://wiki\&.mozilla\&.org/NSS_Shared_DB
michael@0: .RE
michael@0: .SH "SEE ALSO"
michael@0: .PP
michael@0: certutil (1)
michael@0: .PP
michael@0: modutil (1)
michael@0: .PP
michael@0: The NSS wiki has information on the new database design and how to configure applications to use it\&.
michael@0: .sp
michael@0: .RS 4
michael@0: .ie n \{\
michael@0: \h'-04'\(bu\h'+03'\c
michael@0: .\}
michael@0: .el \{\
michael@0: .sp -1
michael@0: .IP \(bu 2.3
michael@0: .\}
michael@0: https://wiki\&.mozilla\&.org/NSS_Shared_DB_Howto
michael@0: .RE
michael@0: .sp
michael@0: .RS 4
michael@0: .ie n \{\
michael@0: \h'-04'\(bu\h'+03'\c
michael@0: .\}
michael@0: .el \{\
michael@0: .sp -1
michael@0: .IP \(bu 2.3
michael@0: .\}
michael@0: https://wiki\&.mozilla\&.org/NSS_Shared_DB
michael@0: .RE
michael@0: .SH "ADDITIONAL RESOURCES"
michael@0: .PP
michael@0: For information about NSS and other tools related to NSS (like JSS), check out the NSS project wiki at
michael@0: \m[blue]\fBhttp://www\&.mozilla\&.org/projects/security/pki/nss/\fR\m[]\&. The NSS site relates directly to NSS code changes and releases\&.
michael@0: .PP
michael@0: Mailing lists: https://lists\&.mozilla\&.org/listinfo/dev\-tech\-crypto
michael@0: .PP
michael@0: IRC: Freenode at #dogtag\-pki
michael@0: .SH "AUTHORS"
michael@0: .PP
michael@0: The NSS tools were written and maintained by developers with Netscape, Red Hat, Sun, Oracle, Mozilla, and Google\&.
michael@0: .PP
michael@0: Authors: Elio Maldonado <emaldona@redhat\&.com>, Deon Lackey <dlackey@redhat\&.com>\&.
michael@0: .SH "LICENSE"
michael@0: .PP
michael@0: Licensed under the Mozilla Public License, v\&. 2\&.0\&. If a copy of the MPL was not distributed with this file, You can obtain one at http://mozilla\&.org/MPL/2\&.0/\&.
michael@0: .SH "NOTES"
michael@0: .IP " 1." 4
michael@0: Mozilla NSS bug 836477
michael@0: .RS 4
michael@0: \%https://bugzilla.mozilla.org/show_bug.cgi?id=836477
michael@0: .RE