tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

modutil.1 (36669B)


      1 '\" t
      2 .\"     Title: MODUTIL
      3 .\"    Author: [see the "Authors" section]
      4 .\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
      5 .\"      Date: 19 May 2021
      6 .\"    Manual: NSS Security Tools
      7 .\"    Source: nss-tools
      8 .\"  Language: English
      9 .\"
     10 .TH "MODUTIL" "1" "19 May 2021" "nss-tools" "NSS Security Tools"
     11 .\" -----------------------------------------------------------------
     12 .\" * Define some portability stuff
     13 .\" -----------------------------------------------------------------
     14 .\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     15 .\" http://bugs.debian.org/507673
     16 .\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html
     17 .\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     18 .ie \n(.g .ds Aq \(aq
     19 .el       .ds Aq '
     20 .\" -----------------------------------------------------------------
     21 .\" * set default formatting
     22 .\" -----------------------------------------------------------------
     23 .\" disable hyphenation
     24 .nh
     25 .\" disable justification (adjust text to left margin only)
     26 .ad l
     27 .\" -----------------------------------------------------------------
     28 .\" * MAIN CONTENT STARTS HERE *
     29 .\" -----------------------------------------------------------------
     30 .SH "NAME"
     31 modutil \- Manage PKCS #11 module information within the security module database\&.
     32 .SH "SYNOPSIS"
     33 .HP \w'\fBmodutil\fR\ 'u
     34 \fBmodutil\fR [\fIoptions\fR] [[\fIarguments\fR]]
     35 .SH "STATUS"
     36 .PP
     37 This documentation is still work in progress\&. Please contribute to the initial review in
     38 \m[blue]\fBMozilla NSS bug 836477\fR\m[]\&\s-2\u[1]\d\s+2
     39 .SH "DESCRIPTION"
     40 .PP
     41 The Security Module Database Tool,
     42 \fBmodutil\fR, is a command\-line utility for managing PKCS #11 module information both within
     43 secmod\&.db
     44 files and within hardware tokens\&.
     45 \fBmodutil\fR
     46 can add and delete PKCS #11 modules, change passwords on security databases, set defaults, list module contents, enable or disable slots, enable or disable FIPS 140\-2 compliance, and assign default providers for cryptographic operations\&. This tool can also create certificate, key, and module security database files\&.
     47 .PP
     48 The tasks associated with security module database management are part of a process that typically also involves managing key databases and certificate databases\&.
     49 .SH "OPTIONS"
     50 .PP
     51 Running
     52 \fBmodutil\fR
     53 always requires one (and only one) option to specify the type of module operation\&. Each option may take arguments, anywhere from none to multiple arguments\&.
     54 .PP
     55 \fBOptions\fR
     56 .PP
     57 \-add modulename
     58 .RS 4
     59 Add the named PKCS #11 module to the database\&. Use this option with the
     60 \fB\-libfile\fR,
     61 \fB\-ciphers\fR, and
     62 \fB\-mechanisms\fR
     63 arguments\&.
     64 .RE
     65 .PP
     66 \-changepw tokenname
     67 .RS 4
     68 Change the password on the named token\&. If the token has not been initialized, this option initializes the password\&. Use this option with the
     69 \fB\-pwfile\fR
     70 and
     71 \fB\-newpwfile\fR
     72 arguments\&. A
     73 \fIpassword\fR
     74 is equivalent to a personal identification number (PIN)\&.
     75 .RE
     76 .PP
     77 \-chkfips
     78 .RS 4
     79 Verify whether the module is in the given FIPS mode\&.
     80 \fBtrue\fR
     81 means to verify that the module is in FIPS mode, while
     82 \fBfalse\fR
     83 means to verify that the module is not in FIPS mode\&.
     84 .RE
     85 .PP
     86 \-create
     87 .RS 4
     88 Create new certificate, key, and module databases\&. Use the
     89 \fB\-dbdir\fR
     90 directory argument to specify a directory\&. If any of these databases already exist in a specified directory,
     91 \fBmodutil\fR
     92 returns an error message\&.
     93 .RE
     94 .PP
     95 \-default modulename
     96 .RS 4
     97 Specify the security mechanisms for which the named module will be a default provider\&. The security mechanisms are specified with the
     98 \fB\-mechanisms\fR
     99 argument\&.
    100 .RE
    101 .PP
    102 \-delete modulename
    103 .RS 4
    104 Delete the named module\&. The default NSS PKCS #11 module cannot be deleted\&.
    105 .RE
    106 .PP
    107 \-disable modulename
    108 .RS 4
    109 Disable all slots on the named module\&. Use the
    110 \fB\-slot\fR
    111 argument to disable a specific slot\&.
    112 .sp
    113 The internal NSS PKCS #11 module cannot be disabled\&.
    114 .RE
    115 .PP
    116 \-enable modulename
    117 .RS 4
    118 Enable all slots on the named module\&. Use the
    119 \fB\-slot\fR
    120 argument to enable a specific slot\&.
    121 .RE
    122 .PP
    123 \-fips [true | false]
    124 .RS 4
    125 Enable (true) or disable (false) FIPS 140\-2 compliance for the default NSS module\&.
    126 .RE
    127 .PP
    128 \-force
    129 .RS 4
    130 Disable
    131 \fBmodutil\fR\*(Aqs interactive prompts so it can be run from a script\&. Use this option only after manually testing each planned operation to check for warnings and to ensure that bypassing the prompts will cause no security lapses or loss of database integrity\&.
    132 .RE
    133 .PP
    134 \-jar JAR\-file
    135 .RS 4
    136 Add a new PKCS #11 module to the database using the named JAR file\&. Use this command with the
    137 \fB\-installdir\fR
    138 and
    139 \fB\-tempdir\fR
    140 arguments\&. The JAR file uses the NSS PKCS #11 JAR format to identify all the files to be installed, the module\*(Aqs name, the mechanism flags, and the cipher flags, as well as any files to be installed on the target machine, including the PKCS #11 module library file and other files such as documentation\&. This is covered in the JAR installation file section in the man page, which details the special script needed to perform an installation through a server or with
    141 \fBmodutil\fR\&.
    142 .RE
    143 .PP
    144 \-list [modulename]
    145 .RS 4
    146 Display basic information about the contents of the
    147 secmod\&.db
    148 file\&. Specifying a
    149 \fImodulename\fR
    150 displays detailed information about a particular module and its slots and tokens\&.
    151 .RE
    152 .PP
    153 \-rawadd
    154 .RS 4
    155 Add the module spec string to the
    156 secmod\&.db
    157 database\&.
    158 .RE
    159 .PP
    160 \-rawlist
    161 .RS 4
    162 Display the module specs for a specified module or for all loadable modules\&.
    163 .RE
    164 .PP
    165 \-undefault modulename
    166 .RS 4
    167 Specify the security mechanisms for which the named module will not be a default provider\&. The security mechanisms are specified with the
    168 \fB\-mechanisms\fR
    169 argument\&.
    170 .RE
    171 .PP
    172 \fBArguments\fR
    173 .PP
    174 MODULE
    175 .RS 4
    176 Give the security module to access\&.
    177 .RE
    178 .PP
    179 MODULESPEC
    180 .RS 4
    181 Give the security module spec to load into the security database\&.
    182 .RE
    183 .PP
    184 \-ciphers cipher\-enable\-list
    185 .RS 4
    186 Enable specific ciphers in a module that is being added to the database\&. The
    187 \fIcipher\-enable\-list\fR
    188 is a colon\-delimited list of cipher names\&. Enclose this list in quotation marks if it contains spaces\&.
    189 .RE
    190 .PP
    191 \-dbdir directory
    192 .RS 4
    193 Specify the database directory in which to access or create security module database files\&.
    194 .sp
    195 \fBmodutil\fR
    196 supports two types of databases: the legacy security databases (cert8\&.db,
    197 key3\&.db, and
    198 secmod\&.db) and SQLite databases (cert9\&.db,
    199 key4\&.db, and
    200 pkcs11\&.txt)\&. If the prefix
    201 \fBdbm:\fR
    202 is not used, then the tool assumes that the given databases are in SQLite format\&.
    203 .RE
    204 .PP
    205 \-\-dbprefix prefix
    206 .RS 4
    207 Specify the prefix used on the database files, such as
    208 my_
    209 for
    210 my_cert9\&.db\&. This option is provided as a special case\&. Changing the names of the certificate and key databases is not recommended\&.
    211 .RE
    212 .PP
    213 \-installdir root\-installation\-directory
    214 .RS 4
    215 Specify the root installation directory relative to which files will be installed by the
    216 \fB\-jar\fR
    217 option\&. This directory should be one below which it is appropriate to store dynamic library files, such as a server\*(Aqs root directory\&.
    218 .RE
    219 .PP
    220 \-libfile library\-file
    221 .RS 4
    222 Specify a path to a library file containing the implementation of the PKCS #11 interface module that is being added to the database\&.
    223 .RE
    224 .PP
    225 \-mechanisms mechanism\-list
    226 .RS 4
    227 Specify the security mechanisms for which a particular module will be flagged as a default provider\&. The
    228 \fImechanism\-list\fR
    229 is a colon\-delimited list of mechanism names\&. Enclose this list in quotation marks if it contains spaces\&.
    230 .sp
    231 The module becomes a default provider for the listed mechanisms when those mechanisms are enabled\&. If more than one module claims to be a particular mechanism\*(Aqs default provider, that mechanism\*(Aqs default provider is undefined\&.
    232 .sp
    233 \fBmodutil\fR
    234 supports several mechanisms: RSA, DSA, RC2, RC4, RC5, AES, DES, DH, SHA1, SHA256, SHA512, SSL, TLS, MD5, MD2, RANDOM (for random number generation), and FRIENDLY (meaning certificates are publicly readable)\&.
    235 .RE
    236 .PP
    237 \-newpwfile new\-password\-file
    238 .RS 4
    239 Specify a text file containing a token\*(Aqs new or replacement password so that a password can be entered automatically with the
    240 \fB\-changepw\fR
    241 option\&.
    242 .RE
    243 .PP
    244 \-nocertdb
    245 .RS 4
    246 Do not open the certificate or key databases\&. This has several effects:
    247 .sp
    248 .RS 4
    249 .ie n \{\
    250 \h'-04'\(bu\h'+03'\c
    251 .\}
    252 .el \{\
    253 .sp -1
    254 .IP \(bu 2.3
    255 .\}
    256 With the
    257 \fB\-create\fR
    258 command, only a module security file is created; certificate and key databases are not created\&.
    259 .RE
    260 .sp
    261 .RS 4
    262 .ie n \{\
    263 \h'-04'\(bu\h'+03'\c
    264 .\}
    265 .el \{\
    266 .sp -1
    267 .IP \(bu 2.3
    268 .\}
    269 With the
    270 \fB\-jar\fR
    271 command, signatures on the JAR file are not checked\&.
    272 .RE
    273 .sp
    274 .RS 4
    275 .ie n \{\
    276 \h'-04'\(bu\h'+03'\c
    277 .\}
    278 .el \{\
    279 .sp -1
    280 .IP \(bu 2.3
    281 .\}
    282 With the
    283 \fB\-changepw\fR
    284 command, the password on the NSS internal module cannot be set or changed, since this password is stored in the key database\&.
    285 .RE
    286 .RE
    287 .PP
    288 \-pwfile old\-password\-file
    289 .RS 4
    290 Specify a text file containing a token\*(Aqs existing password so that a password can be entered automatically when the
    291 \fB\-changepw\fR
    292 option is used to change passwords\&.
    293 .RE
    294 .PP
    295 \-secmod secmodname
    296 .RS 4
    297 Give the name of the security module database (like
    298 secmod\&.db) to load\&.
    299 .RE
    300 .PP
    301 \-slot slotname
    302 .RS 4
    303 Specify a particular slot to be enabled or disabled with the
    304 \fB\-enable\fR
    305 or
    306 \fB\-disable\fR
    307 options\&.
    308 .RE
    309 .PP
    310 \-string CONFIG_STRING
    311 .RS 4
    312 Pass a configuration string for the module being added to the database\&.
    313 .RE
    314 .PP
    315 \-tempdir temporary\-directory
    316 .RS 4
    317 Give a directory location where temporary files are created during the installation by the
    318 \fB\-jar\fR
    319 option\&. If no temporary directory is specified, the current directory is used\&.
    320 .RE
    321 .SH "USAGE AND EXAMPLES"
    322 .PP
    323 \fBCreating Database Files\fR
    324 .PP
    325 Before any operations can be performed, there must be a set of security databases available\&.
    326 \fBmodutil\fR
    327 can be used to create these files\&. The only required argument is the database that where the databases will be located\&.
    328 .sp
    329 .if n \{\
    330 .RS 4
    331 .\}
    332 .nf
    333 modutil \-create \-dbdir directory
    334 .fi
    335 .if n \{\
    336 .RE
    337 .\}
    338 .PP
    339 \fBAdding a Cryptographic Module\fR
    340 .PP
    341 Adding a PKCS #11 module means submitting a supporting library file, enabling its ciphers, and setting default provider status for various security mechanisms\&. This can be done by supplying all of the information through
    342 \fBmodutil\fR
    343 directly or by running a JAR file and install script\&. For the most basic case, simply upload the library:
    344 .sp
    345 .if n \{\
    346 .RS 4
    347 .\}
    348 .nf
    349 modutil \-add modulename \-libfile library\-file [\-ciphers cipher\-enable\-list] [\-mechanisms mechanism\-list] 
    350 .fi
    351 .if n \{\
    352 .RE
    353 .\}
    354 .PP
    355 For example:
    356 .sp
    357 .if n \{\
    358 .RS 4
    359 .\}
    360 .nf
    361 modutil \-dbdir /home/my/sharednssdb \-add "Example PKCS #11 Module" \-libfile "/tmp/crypto\&.so" \-mechanisms RSA:DSA:RC2:RANDOM 
    362 
    363 Using database directory \&.\&.\&. 
    364 Module "Example PKCS #11 Module" added to database\&.
    365 .fi
    366 .if n \{\
    367 .RE
    368 .\}
    369 .PP
    370 \fBInstalling a Cryptographic Module from a JAR File\fR
    371 .PP
    372 PKCS #11 modules can also be loaded using a JAR file, which contains all of the required libraries and an installation script that describes how to install the module\&. The JAR install script is described in more detail in
    373 the section called \(lqJAR INSTALLATION FILE FORMAT\(rq\&.
    374 .PP
    375 The JAR installation script defines the setup information for each platform that the module can be installed on\&. For example:
    376 .sp
    377 .if n \{\
    378 .RS 4
    379 .\}
    380 .nf
    381 Platforms { 
    382   Linux:5\&.4\&.08:x86 { 
    383      ModuleName { "Example PKCS #11 Module" } 
    384      ModuleFile { crypto\&.so } 
    385      DefaultMechanismFlags{0x0000} 
    386      CipherEnableFlags{0x0000} 
    387      Files { 
    388         crypto\&.so { 
    389            Path{ /tmp/crypto\&.so } 
    390         } 
    391         setup\&.sh { 
    392            Executable 
    393            Path{ /tmp/setup\&.sh } 
    394         } 
    395      } 
    396   } 
    397   Linux:6\&.0\&.0:x86 { 
    398      EquivalentPlatform { Linux:5\&.4\&.08:x86 } 
    399   } 
    400 } 
    401 .fi
    402 .if n \{\
    403 .RE
    404 .\}
    405 .PP
    406 Both the install script and the required libraries must be bundled in a JAR file, which is specified with the
    407 \fB\-jar\fR
    408 argument\&.
    409 .sp
    410 .if n \{\
    411 .RS 4
    412 .\}
    413 .nf
    414 modutil \-dbdir /home/mt"jar\-install\-filey/sharednssdb \-jar install\&.jar \-installdir /home/my/sharednssdb
    415 
    416 This installation JAR file was signed by: 
    417 \-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\- 
    418 
    419 **SUBJECT NAME** 
    420 
    421 C=US, ST=California, L=Mountain View, CN=Cryptorific Inc\&., OU=Digital ID
    422 Class 3 \- Netscape Object Signing, OU="www\&.verisign\&.com/repository/CPS
    423 Incorp\&. by Ref\&.,LIAB\&.LTD(c)9 6", OU=www\&.verisign\&.com/CPS Incorp\&.by Ref
    424 \&. LIABILITY LTD\&.(c)97 VeriSign, OU=VeriSign Object Signing CA \- Class 3
    425 Organization, OU="VeriSign, Inc\&.", O=VeriSign Trust Network **ISSUER
    426 NAME**, OU=www\&.verisign\&.com/CPS Incorp\&.by Ref\&. LIABILITY LTD\&.(c)97
    427 VeriSign, OU=VeriSign Object Signing CA \- Class 3 Organization,
    428 OU="VeriSign, Inc\&.", O=VeriSign Trust Network 
    429 \-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\- 
    430 
    431 Do you wish to continue this installation? (y/n) y 
    432 Using installer script "installer_script" 
    433 Successfully parsed installation script 
    434 Current platform is Linux:5\&.4\&.08:x86 
    435 Using installation parameters for platform Linux:5\&.4\&.08:x86 
    436 Installed file crypto\&.so to /tmp/crypto\&.so
    437 Installed file setup\&.sh to \&./pk11inst\&.dir/setup\&.sh 
    438 Executing "\&./pk11inst\&.dir/setup\&.sh"\&.\&.\&. 
    439 "\&./pk11inst\&.dir/setup\&.sh" executed successfully 
    440 Installed module "Example PKCS #11 Module" into module database 
    441 
    442 Installation completed successfully 
    443 .fi
    444 .if n \{\
    445 .RE
    446 .\}
    447 .PP
    448 \fBAdding Module Spec\fR
    449 .PP
    450 Each module has information stored in the security database about its configuration and parameters\&. These can be added or edited using the
    451 \fB\-rawadd\fR
    452 command\&. For the current settings or to see the format of the module spec in the database, use the
    453 \fB\-rawlist\fR
    454 option\&.
    455 .sp
    456 .if n \{\
    457 .RS 4
    458 .\}
    459 .nf
    460 modutil \-rawadd modulespec
    461 .fi
    462 .if n \{\
    463 .RE
    464 .\}
    465 .PP
    466 \fBDeleting a Module\fR
    467 .PP
    468 A specific PKCS #11 module can be deleted from the
    469 secmod\&.db
    470 database:
    471 .sp
    472 .if n \{\
    473 .RS 4
    474 .\}
    475 .nf
    476 modutil \-delete modulename \-dbdir directory 
    477 .fi
    478 .if n \{\
    479 .RE
    480 .\}
    481 .PP
    482 \fBDisplaying Module Information\fR
    483 .PP
    484 The
    485 secmod\&.db
    486 database contains information about the PKCS #11 modules that are available to an application or server to use\&. The list of all modules, information about specific modules, and database configuration specs for modules can all be viewed\&.
    487 .PP
    488 To simply get a list of modules in the database, use the
    489 \fB\-list\fR
    490 command\&.
    491 .sp
    492 .if n \{\
    493 .RS 4
    494 .\}
    495 .nf
    496 modutil \-list [modulename] \-dbdir directory 
    497 .fi
    498 .if n \{\
    499 .RE
    500 .\}
    501 .PP
    502 Listing the modules shows the module name, their status, and other associated security databases for certificates and keys\&. For example:
    503 .sp
    504 .if n \{\
    505 .RS 4
    506 .\}
    507 .nf
    508 modutil \-list \-dbdir /home/my/sharednssdb 
    509 
    510 Listing of PKCS #11 Modules
    511 \-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-
    512  1\&. NSS Internal PKCS #11 Module
    513         slots: 2 slots attached
    514        status: loaded
    515 
    516         slot: NSS Internal Cryptographic Services                            
    517        token: NSS Generic Crypto Services
    518   uri: pkcs11:token=NSS%20Generic%20Crypto%20Services;manufacturer=Mozilla%20Foundation;serial=0000000000000000;model=NSS%203
    519 
    520         slot: NSS User Private Key and Certificate Services                  
    521        token: NSS Certificate DB
    522   uri: pkcs11:token=NSS%20Certificate%20DB;manufacturer=Mozilla%20Foundation;serial=0000000000000000;model=NSS%203
    523 \-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-
    524 .fi
    525 .if n \{\
    526 .RE
    527 .\}
    528 .PP
    529 Passing a specific module name with the
    530 \fB\-list\fR
    531 returns details information about the module itself, like supported cipher mechanisms, version numbers, serial numbers, and other information about the module and the token it is loaded on\&. For example:
    532 .sp
    533 .if n \{\
    534 .RS 4
    535 .\}
    536 .nf
    537 modutil \-list "NSS Internal PKCS #11 Module" \-dbdir /home/my/sharednssdb
    538 
    539 \-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-
    540 Name: NSS Internal PKCS #11 Module
    541 Library file: **Internal ONLY module**
    542 Manufacturer: Mozilla Foundation              
    543 Description: NSS Internal Crypto Services    
    544 PKCS #11 Version 2\&.20
    545 Library Version: 3\&.11
    546 Cipher Enable Flags: None
    547 Default Mechanism Flags: RSA:RC2:RC4:DES:DH:SHA1:MD5:MD2:SSL:TLS:AES
    548 
    549  Slot: NSS Internal Cryptographic Services                            
    550  Slot Mechanism Flags: RSA:RC2:RC4:DES:DH:SHA1:MD5:MD2:SSL:TLS:AES
    551  Manufacturer: Mozilla Foundation              
    552  Type: Software
    553  Version Number: 3\&.11
    554  Firmware Version: 0\&.0
    555  Status: Enabled
    556  Token Name: NSS Generic Crypto Services     
    557  Token Manufacturer: Mozilla Foundation              
    558  Token Model: NSS 3           
    559  Token Serial Number: 0000000000000000
    560  Token Version: 4\&.0
    561  Token Firmware Version: 0\&.0
    562  Access: Write Protected
    563  Login Type: Public (no login required)
    564  User Pin: NOT Initialized
    565 
    566  Slot: NSS User Private Key and Certificate Services                  
    567  Slot Mechanism Flags: None
    568  Manufacturer: Mozilla Foundation              
    569  Type: Software
    570  Version Number: 3\&.11
    571  Firmware Version: 0\&.0
    572  Status: Enabled
    573  Token Name: NSS Certificate DB              
    574  Token Manufacturer: Mozilla Foundation              
    575  Token Model: NSS 3           
    576  Token Serial Number: 0000000000000000
    577  Token Version: 8\&.3
    578  Token Firmware Version: 0\&.0
    579  Access: NOT Write Protected
    580  Login Type: Login required
    581  User Pin: Initialized
    582 .fi
    583 .if n \{\
    584 .RE
    585 .\}
    586 .PP
    587 A related command,
    588 \fB\-rawlist\fR
    589 returns information about the database configuration for the modules\&. (This information can be edited by loading new specs using the
    590 \fB\-rawadd\fR
    591 command\&.)
    592 .sp
    593 .if n \{\
    594 .RS 4
    595 .\}
    596 .nf
    597 modutil \-rawlist \-dbdir /home/my/sharednssdb
    598 name="NSS Internal PKCS #11 Module" parameters="configdir=\&. certPrefix= keyPrefix= secmod=secmod\&.db flags=readOnly " NSS="trustOrder=75 cipherOrder=100 slotParams={0x00000001=[slotFlags=RSA,RC4,RC2,DES,DH,SHA1,MD5,MD2,SSL,TLS,AES,RANDOM askpw=any timeout=30 ] }  Flags=internal,critical"
    599 .fi
    600 .if n \{\
    601 .RE
    602 .\}
    603 .PP
    604 \fBSetting a Default Provider for Security Mechanisms\fR
    605 .PP
    606 Multiple security modules may provide support for the same security mechanisms\&. It is possible to set a specific security module as the default provider for a specific security mechanism (or, conversely, to prohibit a provider from supplying those mechanisms)\&.
    607 .sp
    608 .if n \{\
    609 .RS 4
    610 .\}
    611 .nf
    612 modutil \-default modulename \-mechanisms mechanism\-list 
    613 .fi
    614 .if n \{\
    615 .RE
    616 .\}
    617 .PP
    618 To set a module as the default provider for mechanisms, use the
    619 \fB\-default\fR
    620 command with a colon\-separated list of mechanisms\&. The available mechanisms depend on the module; NSS supplies almost all common mechanisms\&. For example:
    621 .sp
    622 .if n \{\
    623 .RS 4
    624 .\}
    625 .nf
    626 modutil \-default "NSS Internal PKCS #11 Module" \-dbdir \-mechanisms RSA:DSA:RC2 
    627 
    628 Using database directory c:\edatabases\&.\&.\&.
    629 
    630 Successfully changed defaults\&.
    631 .fi
    632 .if n \{\
    633 .RE
    634 .\}
    635 .PP
    636 Clearing the default provider has the same format:
    637 .sp
    638 .if n \{\
    639 .RS 4
    640 .\}
    641 .nf
    642 modutil \-undefault "NSS Internal PKCS #11 Module" \-dbdir \-mechanisms MD2:MD5
    643 .fi
    644 .if n \{\
    645 .RE
    646 .\}
    647 .PP
    648 \fBEnabling and Disabling Modules and Slots\fR
    649 .PP
    650 Modules, and specific slots on modules, can be selectively enabled or disabled using
    651 \fBmodutil\fR\&. Both commands have the same format:
    652 .sp
    653 .if n \{\
    654 .RS 4
    655 .\}
    656 .nf
    657 modutil \-enable|\-disable modulename [\-slot slotname] 
    658 .fi
    659 .if n \{\
    660 .RE
    661 .\}
    662 .PP
    663 For example:
    664 .sp
    665 .if n \{\
    666 .RS 4
    667 .\}
    668 .nf
    669 modutil \-enable "NSS Internal PKCS #11 Module" \-slot "NSS Internal Cryptographic Services                            " \-dbdir \&.
    670 
    671 Slot "NSS Internal Cryptographic Services                            " enabled\&.
    672 .fi
    673 .if n \{\
    674 .RE
    675 .\}
    676 .PP
    677 Be sure that the appropriate amount of trailing whitespace is after the slot name\&. Some slot names have a significant amount of whitespace that must be included, or the operation will fail\&.
    678 .PP
    679 \fBEnabling and Verifying FIPS Compliance\fR
    680 .PP
    681 The NSS modules can have FIPS 140\-2 compliance enabled or disabled using
    682 \fBmodutil\fR
    683 with the
    684 \fB\-fips\fR
    685 option\&. For example:
    686 .sp
    687 .if n \{\
    688 .RS 4
    689 .\}
    690 .nf
    691 modutil \-fips true \-dbdir /home/my/sharednssdb/
    692 
    693 FIPS mode enabled\&.
    694 .fi
    695 .if n \{\
    696 .RE
    697 .\}
    698 .PP
    699 To verify that status of FIPS mode, run the
    700 \fB\-chkfips\fR
    701 command with either a true or false flag (it doesn\*(Aqt matter which)\&. The tool returns the current FIPS setting\&.
    702 .sp
    703 .if n \{\
    704 .RS 4
    705 .\}
    706 .nf
    707 modutil \-chkfips false \-dbdir /home/my/sharednssdb/
    708 
    709 FIPS mode enabled\&.
    710 .fi
    711 .if n \{\
    712 .RE
    713 .\}
    714 .PP
    715 \fBChanging the Password on a Token\fR
    716 .PP
    717 Initializing or changing a token\*(Aqs password:
    718 .sp
    719 .if n \{\
    720 .RS 4
    721 .\}
    722 .nf
    723 modutil \-changepw tokenname [\-pwfile old\-password\-file] [\-newpwfile new\-password\-file] 
    724 .fi
    725 .if n \{\
    726 .RE
    727 .\}
    728 .sp
    729 .if n \{\
    730 .RS 4
    731 .\}
    732 .nf
    733 modutil \-dbdir /home/my/sharednssdb \-changepw "NSS Certificate DB" 
    734 
    735 Enter old password: 
    736 Incorrect password, try again\&.\&.\&. 
    737 Enter old password: 
    738 Enter new password: 
    739 Re\-enter new password: 
    740 Token "Communicator Certificate DB" password changed successfully\&.
    741 .fi
    742 .if n \{\
    743 .RE
    744 .\}
    745 .SH "JAR INSTALLATION FILE FORMAT"
    746 .PP
    747 When a JAR file is run by a server, by
    748 \fBmodutil\fR, or by any program that does not interpret JavaScript, a special information file must be included to install the libraries\&. There are several things to keep in mind with this file:
    749 .sp
    750 .RS 4
    751 .ie n \{\
    752 \h'-04'\(bu\h'+03'\c
    753 .\}
    754 .el \{\
    755 .sp -1
    756 .IP \(bu 2.3
    757 .\}
    758 It must be declared in the JAR archive\*(Aqs manifest file\&.
    759 .RE
    760 .sp
    761 .RS 4
    762 .ie n \{\
    763 \h'-04'\(bu\h'+03'\c
    764 .\}
    765 .el \{\
    766 .sp -1
    767 .IP \(bu 2.3
    768 .\}
    769 The script can have any name\&.
    770 .RE
    771 .sp
    772 .RS 4
    773 .ie n \{\
    774 \h'-04'\(bu\h'+03'\c
    775 .\}
    776 .el \{\
    777 .sp -1
    778 .IP \(bu 2.3
    779 .\}
    780 The metainfo tag for this is
    781 \fBPkcs11_install_script\fR\&. To declare meta\-information in the manifest file, put it in a file that is passed to
    782 \fBsigntool\fR\&.
    783 .RE
    784 .PP
    785 \fBSample Script\fR
    786 .PP
    787 For example, the PKCS #11 installer script could be in the file pk11install\&. If so, the metainfo file for
    788 \fBsigntool\fR
    789 includes a line such as this:
    790 .sp
    791 .if n \{\
    792 .RS 4
    793 .\}
    794 .nf
    795 + Pkcs11_install_script: pk11install
    796 .fi
    797 .if n \{\
    798 .RE
    799 .\}
    800 .PP
    801 The script must define the platform and version number, the module name and file, and any optional information like supported ciphers and mechanisms\&. Multiple platforms can be defined in a single install file\&.
    802 .sp
    803 .if n \{\
    804 .RS 4
    805 .\}
    806 .nf
    807 ForwardCompatible { IRIX:6\&.2:mips SUNOS:5\&.5\&.1:sparc }
    808 Platforms {
    809   WINNT::x86 {
    810      ModuleName { "Example Module" }
    811      ModuleFile { win32/fort32\&.dll }
    812      DefaultMechanismFlags{0x0001}
    813      DefaultCipherFlags{0x0001}
    814      Files {
    815         win32/setup\&.exe {
    816            Executable
    817            RelativePath { %temp%/setup\&.exe }
    818         }
    819         win32/setup\&.hlp {
    820            RelativePath { %temp%/setup\&.hlp }
    821         }
    822         win32/setup\&.cab {
    823            RelativePath { %temp%/setup\&.cab }
    824         }
    825      }
    826   }
    827   SUNOS:5\&.5\&.1:sparc {
    828      ModuleName { "Example UNIX Module" }
    829      ModuleFile { unix/fort\&.so }
    830      DefaultMechanismFlags{0x0001}
    831      CipherEnableFlags{0x0001}
    832      Files {
    833         unix/fort\&.so {
    834            RelativePath{%root%/lib/fort\&.so}
    835            AbsolutePath{/usr/local/netscape/lib/fort\&.so}
    836            FilePermissions{555}
    837         }
    838         xplat/instr\&.html {
    839            RelativePath{%root%/docs/inst\&.html}
    840            AbsolutePath{/usr/local/netscape/docs/inst\&.html}
    841            FilePermissions{555}
    842         }
    843      }
    844   }
    845   IRIX:6\&.2:mips {
    846      EquivalentPlatform { SUNOS:5\&.5\&.1:sparc }
    847   }
    848 }
    849 .fi
    850 .if n \{\
    851 .RE
    852 .\}
    853 .PP
    854 \fBScript Grammar\fR
    855 .PP
    856 The script is basic Java, allowing lists, key\-value pairs, strings, and combinations of all of them\&.
    857 .sp
    858 .if n \{\
    859 .RS 4
    860 .\}
    861 .nf
    862 \-\-> valuelist
    863 
    864 valuelist \-\-> value valuelist
    865               <null>
    866 
    867 value \-\-\-> key_value_pair
    868            string
    869 
    870 key_value_pair \-\-> key { valuelist }
    871 
    872 key \-\-> string
    873 
    874 string \-\-> simple_string
    875            "complex_string"
    876 
    877 simple_string \-\-> [^ \et\en\e""{""}"]+ 
    878 
    879 complex_string \-\-> ([^\e"\e\e\er\en]|(\e\e\e")|(\e\e\e\e))+ 
    880 .fi
    881 .if n \{\
    882 .RE
    883 .\}
    884 .PP
    885 Quotes and backslashes must be escaped with a backslash\&. A complex string must not include newlines or carriage returns\&.Outside of complex strings, all white space (for example, spaces, tabs, and carriage returns) is considered equal and is used only to delimit tokens\&.
    886 .PP
    887 \fBKeys\fR
    888 .PP
    889 The Java install file uses keys to define the platform and module information\&.
    890 .PP
    891 \fBForwardCompatible\fR
    892 gives a list of platforms that are forward compatible\&. If the current platform cannot be found in the list of supported platforms, then the
    893 \fBForwardCompatible\fR
    894 list is checked for any platforms that have the same OS and architecture in an earlier version\&. If one is found, its attributes are used for the current platform\&.
    895 .PP
    896 \fBPlatforms\fR
    897 (required) Gives a list of platforms\&. Each entry in the list is itself a key\-value pair: the key is the name of the platform and the value list contains various attributes of the platform\&. The platform string is in the format
    898 \fIsystem name:OS release:architecture\fR\&. The installer obtains these values from NSPR\&. OS release is an empty string on non\-Unix operating systems\&. NSPR supports these platforms:
    899 .sp
    900 .RS 4
    901 .ie n \{\
    902 \h'-04'\(bu\h'+03'\c
    903 .\}
    904 .el \{\
    905 .sp -1
    906 .IP \(bu 2.3
    907 .\}
    908 AIX (rs6000)
    909 .RE
    910 .sp
    911 .RS 4
    912 .ie n \{\
    913 \h'-04'\(bu\h'+03'\c
    914 .\}
    915 .el \{\
    916 .sp -1
    917 .IP \(bu 2.3
    918 .\}
    919 BSDI (x86)
    920 .RE
    921 .sp
    922 .RS 4
    923 .ie n \{\
    924 \h'-04'\(bu\h'+03'\c
    925 .\}
    926 .el \{\
    927 .sp -1
    928 .IP \(bu 2.3
    929 .\}
    930 FREEBSD (x86)
    931 .RE
    932 .sp
    933 .RS 4
    934 .ie n \{\
    935 \h'-04'\(bu\h'+03'\c
    936 .\}
    937 .el \{\
    938 .sp -1
    939 .IP \(bu 2.3
    940 .\}
    941 HPUX (hppa1\&.1)
    942 .RE
    943 .sp
    944 .RS 4
    945 .ie n \{\
    946 \h'-04'\(bu\h'+03'\c
    947 .\}
    948 .el \{\
    949 .sp -1
    950 .IP \(bu 2.3
    951 .\}
    952 IRIX (mips)
    953 .RE
    954 .sp
    955 .RS 4
    956 .ie n \{\
    957 \h'-04'\(bu\h'+03'\c
    958 .\}
    959 .el \{\
    960 .sp -1
    961 .IP \(bu 2.3
    962 .\}
    963 LINUX (ppc, alpha, x86)
    964 .RE
    965 .sp
    966 .RS 4
    967 .ie n \{\
    968 \h'-04'\(bu\h'+03'\c
    969 .\}
    970 .el \{\
    971 .sp -1
    972 .IP \(bu 2.3
    973 .\}
    974 MacOS (PowerPC)
    975 .RE
    976 .sp
    977 .RS 4
    978 .ie n \{\
    979 \h'-04'\(bu\h'+03'\c
    980 .\}
    981 .el \{\
    982 .sp -1
    983 .IP \(bu 2.3
    984 .\}
    985 NCR (x86)
    986 .RE
    987 .sp
    988 .RS 4
    989 .ie n \{\
    990 \h'-04'\(bu\h'+03'\c
    991 .\}
    992 .el \{\
    993 .sp -1
    994 .IP \(bu 2.3
    995 .\}
    996 NEC (mips)
    997 .RE
    998 .sp
    999 .RS 4
   1000 .ie n \{\
   1001 \h'-04'\(bu\h'+03'\c
   1002 .\}
   1003 .el \{\
   1004 .sp -1
   1005 .IP \(bu 2.3
   1006 .\}
   1007 OS2 (x86)
   1008 .RE
   1009 .sp
   1010 .RS 4
   1011 .ie n \{\
   1012 \h'-04'\(bu\h'+03'\c
   1013 .\}
   1014 .el \{\
   1015 .sp -1
   1016 .IP \(bu 2.3
   1017 .\}
   1018 OSF (alpha)
   1019 .RE
   1020 .sp
   1021 .RS 4
   1022 .ie n \{\
   1023 \h'-04'\(bu\h'+03'\c
   1024 .\}
   1025 .el \{\
   1026 .sp -1
   1027 .IP \(bu 2.3
   1028 .\}
   1029 ReliantUNIX (mips)
   1030 .RE
   1031 .sp
   1032 .RS 4
   1033 .ie n \{\
   1034 \h'-04'\(bu\h'+03'\c
   1035 .\}
   1036 .el \{\
   1037 .sp -1
   1038 .IP \(bu 2.3
   1039 .\}
   1040 SCO (x86)
   1041 .RE
   1042 .sp
   1043 .RS 4
   1044 .ie n \{\
   1045 \h'-04'\(bu\h'+03'\c
   1046 .\}
   1047 .el \{\
   1048 .sp -1
   1049 .IP \(bu 2.3
   1050 .\}
   1051 SOLARIS (sparc)
   1052 .RE
   1053 .sp
   1054 .RS 4
   1055 .ie n \{\
   1056 \h'-04'\(bu\h'+03'\c
   1057 .\}
   1058 .el \{\
   1059 .sp -1
   1060 .IP \(bu 2.3
   1061 .\}
   1062 SONY (mips)
   1063 .RE
   1064 .sp
   1065 .RS 4
   1066 .ie n \{\
   1067 \h'-04'\(bu\h'+03'\c
   1068 .\}
   1069 .el \{\
   1070 .sp -1
   1071 .IP \(bu 2.3
   1072 .\}
   1073 SUNOS (sparc)
   1074 .RE
   1075 .sp
   1076 .RS 4
   1077 .ie n \{\
   1078 \h'-04'\(bu\h'+03'\c
   1079 .\}
   1080 .el \{\
   1081 .sp -1
   1082 .IP \(bu 2.3
   1083 .\}
   1084 UnixWare (x86)
   1085 .RE
   1086 .sp
   1087 .RS 4
   1088 .ie n \{\
   1089 \h'-04'\(bu\h'+03'\c
   1090 .\}
   1091 .el \{\
   1092 .sp -1
   1093 .IP \(bu 2.3
   1094 .\}
   1095 WIN16 (x86)
   1096 .RE
   1097 .sp
   1098 .RS 4
   1099 .ie n \{\
   1100 \h'-04'\(bu\h'+03'\c
   1101 .\}
   1102 .el \{\
   1103 .sp -1
   1104 .IP \(bu 2.3
   1105 .\}
   1106 WIN95 (x86)
   1107 .RE
   1108 .sp
   1109 .RS 4
   1110 .ie n \{\
   1111 \h'-04'\(bu\h'+03'\c
   1112 .\}
   1113 .el \{\
   1114 .sp -1
   1115 .IP \(bu 2.3
   1116 .\}
   1117 WINNT (x86)
   1118 .RE
   1119 .PP
   1120 For example:
   1121 .sp
   1122 .if n \{\
   1123 .RS 4
   1124 .\}
   1125 .nf
   1126 IRIX:6\&.2:mips
   1127 SUNOS:5\&.5\&.1:sparc
   1128 Linux:2\&.0\&.32:x86
   1129 WIN95::x86
   1130 .fi
   1131 .if n \{\
   1132 .RE
   1133 .\}
   1134 .PP
   1135 The module information is defined independently for each platform in the
   1136 \fBModuleName\fR,
   1137 \fBModuleFile\fR, and
   1138 \fBFiles\fR
   1139 attributes\&. These attributes must be given unless an
   1140 \fBEquivalentPlatform\fR
   1141 attribute is specified\&.
   1142 .PP
   1143 \fBPer\-Platform Keys\fR
   1144 .PP
   1145 Per\-platform keys have meaning only within the value list of an entry in the
   1146 \fBPlatforms\fR
   1147 list\&.
   1148 .PP
   1149 \fBModuleName\fR
   1150 (required) gives the common name for the module\&. This name is used to reference the module by servers and by the
   1151 \fBmodutil\fR
   1152 tool\&.
   1153 .PP
   1154 \fBModuleFile\fR
   1155 (required) names the PKCS #11 module file for this platform\&. The name is given as the relative path of the file within the JAR archive\&.
   1156 .PP
   1157 \fBFiles\fR
   1158 (required) lists the files that need to be installed for this module\&. Each entry in the file list is a key\-value pair\&. The key is the path of the file in the JAR archive, and the value list contains attributes of the file\&. At least
   1159 \fBRelativePath\fR
   1160 or
   1161 \fBAbsolutePath\fR
   1162 must be specified for each file\&.
   1163 .PP
   1164 \fBDefaultMechanismFlags\fR
   1165 specifies mechanisms for which this module is the default provider; this is equivalent to the
   1166 \fB\-mechanism\fR
   1167 option with the
   1168 \fB\-add\fR
   1169 command\&. This key\-value pair is a bitstring specified in hexadecimal (0x) format\&. It is constructed as a bitwise OR\&. If the DefaultMechanismFlags entry is omitted, the value defaults to 0x0\&.
   1170 .sp
   1171 .if n \{\
   1172 .RS 4
   1173 .\}
   1174 .nf
   1175 RSA:                   0x00000001
   1176 DSA:                   0x00000002
   1177 RC2:                   0x00000004
   1178 RC4:                   0x00000008
   1179 DES:                   0x00000010
   1180 DH:                    0x00000020
   1181 FORTEZZA:              0x00000040
   1182 RC5:                   0x00000080
   1183 SHA1:                  0x00000100
   1184 MD5:                   0x00000200
   1185 MD2:                   0x00000400
   1186 RANDOM:                0x08000000
   1187 FRIENDLY:              0x10000000
   1188 OWN_PW_DEFAULTS:       0x20000000
   1189 DISABLE:               0x40000000
   1190 .fi
   1191 .if n \{\
   1192 .RE
   1193 .\}
   1194 .PP
   1195 \fBCipherEnableFlags\fR
   1196 specifies ciphers that this module provides that NSS does not provide (so that the module enables those ciphers for NSS)\&. This is equivalent to the
   1197 \fB\-cipher\fR
   1198 argument with the
   1199 \fB\-add\fR
   1200 command\&. This key is a bitstring specified in hexadecimal (0x) format\&. It is constructed as a bitwise OR\&. If the
   1201 \fBCipherEnableFlags\fR
   1202 entry is omitted, the value defaults to 0x0\&.
   1203 .PP
   1204 \fBEquivalentPlatform\fR
   1205 specifies that the attributes of the named platform should also be used for the current platform\&. This makes it easier when more than one platform uses the same settings\&.
   1206 .PP
   1207 \fBPer\-File Keys\fR
   1208 .PP
   1209 Some keys have meaning only within the value list of an entry in a
   1210 \fBFiles\fR
   1211 list\&.
   1212 .PP
   1213 Each file requires a path key the identifies where the file is\&. Either
   1214 \fBRelativePath\fR
   1215 or
   1216 \fBAbsolutePath\fR
   1217 must be specified\&. If both are specified, the relative path is tried first, and the absolute path is used only if no relative root directory is provided by the installer program\&.
   1218 .PP
   1219 \fBRelativePath\fR
   1220 specifies the destination directory of the file, relative to some directory decided at install time\&. Two variables can be used in the relative path:
   1221 \fB%root%\fR
   1222 and
   1223 \fB%temp%\fR\&.
   1224 \fB%root%\fR
   1225 is replaced at run time with the directory relative to which files should be installed; for example, it may be the server\*(Aqs root directory\&. The
   1226 \fB%temp%\fR
   1227 directory is created at the beginning of the installation and destroyed at the end\&. The purpose of
   1228 \fB%temp%\fR
   1229 is to hold executable files (such as setup programs) or files that are used by these programs\&. Files destined for the temporary directory are guaranteed to be in place before any executable file is run; they are not deleted until all executable files have finished\&.
   1230 .PP
   1231 \fBAbsolutePath\fR
   1232 specifies the destination directory of the file as an absolute path\&.
   1233 .PP
   1234 \fBExecutable\fR
   1235 specifies that the file is to be executed during the course of the installation\&. Typically, this string is used for a setup program provided by a module vendor, such as a self\-extracting setup executable\&. More than one file can be specified as executable, in which case the files are run in the order in which they are specified in the script file\&.
   1236 .PP
   1237 \fBFilePermissions\fR
   1238 sets permissions on any referenced files in a string of octal digits, according to the standard Unix format\&. This string is a bitwise OR\&.
   1239 .sp
   1240 .if n \{\
   1241 .RS 4
   1242 .\}
   1243 .nf
   1244 user read:                0400
   1245 user write:               0200
   1246 user execute:             0100
   1247 group read:               0040
   1248 group write:              0020
   1249 group execute:            0010
   1250 other read:               0004
   1251 other write:              0002
   1252 other execute:            0001
   1253 .fi
   1254 .if n \{\
   1255 .RE
   1256 .\}
   1257 .PP
   1258 Some platforms may not understand these permissions\&. They are applied only insofar as they make sense for the current platform\&. If this attribute is omitted, a default of 777 is assumed\&.
   1259 .SH "NSS DATABASE TYPES"
   1260 .PP
   1261 NSS originally used BerkeleyDB databases to store security information\&. The last versions of these
   1262 \fIlegacy\fR
   1263 databases are:
   1264 .sp
   1265 .RS 4
   1266 .ie n \{\
   1267 \h'-04'\(bu\h'+03'\c
   1268 .\}
   1269 .el \{\
   1270 .sp -1
   1271 .IP \(bu 2.3
   1272 .\}
   1273 cert8\&.db for certificates
   1274 .RE
   1275 .sp
   1276 .RS 4
   1277 .ie n \{\
   1278 \h'-04'\(bu\h'+03'\c
   1279 .\}
   1280 .el \{\
   1281 .sp -1
   1282 .IP \(bu 2.3
   1283 .\}
   1284 key3\&.db for keys
   1285 .RE
   1286 .sp
   1287 .RS 4
   1288 .ie n \{\
   1289 \h'-04'\(bu\h'+03'\c
   1290 .\}
   1291 .el \{\
   1292 .sp -1
   1293 .IP \(bu 2.3
   1294 .\}
   1295 secmod\&.db for PKCS #11 module information
   1296 .RE
   1297 .PP
   1298 BerkeleyDB has performance limitations, though, which prevent it from being easily used by multiple applications simultaneously\&. NSS has some flexibility that allows applications to use their own, independent database engine while keeping a shared database and working around the access issues\&. Still, NSS requires more flexibility to provide a truly shared security database\&.
   1299 .PP
   1300 In 2009, NSS introduced a new set of databases that are SQLite databases rather than BerkleyDB\&. These new databases provide more accessibility and performance:
   1301 .sp
   1302 .RS 4
   1303 .ie n \{\
   1304 \h'-04'\(bu\h'+03'\c
   1305 .\}
   1306 .el \{\
   1307 .sp -1
   1308 .IP \(bu 2.3
   1309 .\}
   1310 cert9\&.db for certificates
   1311 .RE
   1312 .sp
   1313 .RS 4
   1314 .ie n \{\
   1315 \h'-04'\(bu\h'+03'\c
   1316 .\}
   1317 .el \{\
   1318 .sp -1
   1319 .IP \(bu 2.3
   1320 .\}
   1321 key4\&.db for keys
   1322 .RE
   1323 .sp
   1324 .RS 4
   1325 .ie n \{\
   1326 \h'-04'\(bu\h'+03'\c
   1327 .\}
   1328 .el \{\
   1329 .sp -1
   1330 .IP \(bu 2.3
   1331 .\}
   1332 pkcs11\&.txt, which is listing of all of the PKCS #11 modules contained in a new subdirectory in the security databases directory
   1333 .RE
   1334 .PP
   1335 Because the SQLite databases are designed to be shared, these are the
   1336 \fIshared\fR
   1337 database type\&. The shared database type is preferred; the legacy format is included for backward compatibility\&.
   1338 .PP
   1339 By default, the tools (\fBcertutil\fR,
   1340 \fBpk12util\fR,
   1341 \fBmodutil\fR) assume that the given security databases use the SQLite type\&. Using the legacy databases must be manually specified by using the
   1342 \fBdbm:\fR
   1343 prefix with the given security directory\&. For example:
   1344 .sp
   1345 .if n \{\
   1346 .RS 4
   1347 .\}
   1348 .nf
   1349 modutil \-create \-dbdir dbm:/home/my/sharednssdb
   1350 .fi
   1351 .if n \{\
   1352 .RE
   1353 .\}
   1354 .PP
   1355 To set the legacy database type as the default type for the tools, set the
   1356 \fBNSS_DEFAULT_DB_TYPE\fR
   1357 environment variable to
   1358 \fBdbm\fR:
   1359 .sp
   1360 .if n \{\
   1361 .RS 4
   1362 .\}
   1363 .nf
   1364 export NSS_DEFAULT_DB_TYPE="dbm"
   1365 .fi
   1366 .if n \{\
   1367 .RE
   1368 .\}
   1369 .PP
   1370 This line can be added to the
   1371 ~/\&.bashrc
   1372 file to make the change permanent for the user\&.
   1373 .sp
   1374 .RS 4
   1375 .ie n \{\
   1376 \h'-04'\(bu\h'+03'\c
   1377 .\}
   1378 .el \{\
   1379 .sp -1
   1380 .IP \(bu 2.3
   1381 .\}
   1382 https://wiki\&.mozilla\&.org/NSS_Shared_DB_Howto
   1383 .RE
   1384 .PP
   1385 For an engineering draft on the changes in the shared NSS databases, see the NSS project wiki:
   1386 .sp
   1387 .RS 4
   1388 .ie n \{\
   1389 \h'-04'\(bu\h'+03'\c
   1390 .\}
   1391 .el \{\
   1392 .sp -1
   1393 .IP \(bu 2.3
   1394 .\}
   1395 https://wiki\&.mozilla\&.org/NSS_Shared_DB
   1396 .RE
   1397 .SH "SEE ALSO"
   1398 .PP
   1399 certutil (1)
   1400 .PP
   1401 pk12util (1)
   1402 .PP
   1403 signtool (1)
   1404 .PP
   1405 The NSS wiki has information on the new database design and how to configure applications to use it\&.
   1406 .sp
   1407 .RS 4
   1408 .ie n \{\
   1409 \h'-04'\(bu\h'+03'\c
   1410 .\}
   1411 .el \{\
   1412 .sp -1
   1413 .IP \(bu 2.3
   1414 .\}
   1415 https://wiki\&.mozilla\&.org/NSS_Shared_DB_Howto
   1416 .RE
   1417 .sp
   1418 .RS 4
   1419 .ie n \{\
   1420 \h'-04'\(bu\h'+03'\c
   1421 .\}
   1422 .el \{\
   1423 .sp -1
   1424 .IP \(bu 2.3
   1425 .\}
   1426 https://wiki\&.mozilla\&.org/NSS_Shared_DB
   1427 .RE
   1428 .SH "ADDITIONAL RESOURCES"
   1429 .PP
   1430 For information about NSS and other tools related to NSS (like JSS), check out the NSS project wiki at
   1431 \m[blue]\fBhttp://www\&.mozilla\&.org/projects/security/pki/nss/\fR\m[]\&. The NSS site relates directly to NSS code changes and releases\&.
   1432 .PP
   1433 Mailing lists: https://lists\&.mozilla\&.org/listinfo/dev\-tech\-crypto
   1434 .PP
   1435 IRC: Freenode at #dogtag\-pki
   1436 .SH "AUTHORS"
   1437 .PP
   1438 The NSS tools were written and maintained by developers with Netscape, Red Hat, Sun, Oracle, Mozilla, and Google\&.
   1439 .PP
   1440 Authors: Elio Maldonado <emaldona@redhat\&.com>, Deon Lackey <dlackey@redhat\&.com>\&.
   1441 .SH "LICENSE"
   1442 .PP
   1443 Licensed under the Mozilla Public License, v\&. 2\&.0\&. If a copy of the MPL was not distributed with this file, You can obtain one at http://mozilla\&.org/MPL/2\&.0/\&.
   1444 .SH "NOTES"
   1445 .IP " 1." 4
   1446 Mozilla NSS bug 836477
   1447 .RS 4
   1448 \%https://bugzilla.mozilla.org/show_bug.cgi?id=836477
   1449 .RE