modutil.1 (36669B)
1 '\" t 2 .\" Title: MODUTIL 3 .\" Author: [see the "Authors" section] 4 .\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/> 5 .\" Date: 19 May 2021 6 .\" Manual: NSS Security Tools 7 .\" Source: nss-tools 8 .\" Language: English 9 .\" 10 .TH "MODUTIL" "1" "19 May 2021" "nss-tools" "NSS Security Tools" 11 .\" ----------------------------------------------------------------- 12 .\" * Define some portability stuff 13 .\" ----------------------------------------------------------------- 14 .\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 15 .\" http://bugs.debian.org/507673 16 .\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html 17 .\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 18 .ie \n(.g .ds Aq \(aq 19 .el .ds Aq ' 20 .\" ----------------------------------------------------------------- 21 .\" * set default formatting 22 .\" ----------------------------------------------------------------- 23 .\" disable hyphenation 24 .nh 25 .\" disable justification (adjust text to left margin only) 26 .ad l 27 .\" ----------------------------------------------------------------- 28 .\" * MAIN CONTENT STARTS HERE * 29 .\" ----------------------------------------------------------------- 30 .SH "NAME" 31 modutil \- Manage PKCS #11 module information within the security module database\&. 32 .SH "SYNOPSIS" 33 .HP \w'\fBmodutil\fR\ 'u 34 \fBmodutil\fR [\fIoptions\fR] [[\fIarguments\fR]] 35 .SH "STATUS" 36 .PP 37 This documentation is still work in progress\&. Please contribute to the initial review in 38 \m[blue]\fBMozilla NSS bug 836477\fR\m[]\&\s-2\u[1]\d\s+2 39 .SH "DESCRIPTION" 40 .PP 41 The Security Module Database Tool, 42 \fBmodutil\fR, is a command\-line utility for managing PKCS #11 module information both within 43 secmod\&.db 44 files and within hardware tokens\&. 45 \fBmodutil\fR 46 can add and delete PKCS #11 modules, change passwords on security databases, set defaults, list module contents, enable or disable slots, enable or disable FIPS 140\-2 compliance, and assign default providers for cryptographic operations\&. This tool can also create certificate, key, and module security database files\&. 47 .PP 48 The tasks associated with security module database management are part of a process that typically also involves managing key databases and certificate databases\&. 49 .SH "OPTIONS" 50 .PP 51 Running 52 \fBmodutil\fR 53 always requires one (and only one) option to specify the type of module operation\&. Each option may take arguments, anywhere from none to multiple arguments\&. 54 .PP 55 \fBOptions\fR 56 .PP 57 \-add modulename 58 .RS 4 59 Add the named PKCS #11 module to the database\&. Use this option with the 60 \fB\-libfile\fR, 61 \fB\-ciphers\fR, and 62 \fB\-mechanisms\fR 63 arguments\&. 64 .RE 65 .PP 66 \-changepw tokenname 67 .RS 4 68 Change the password on the named token\&. If the token has not been initialized, this option initializes the password\&. Use this option with the 69 \fB\-pwfile\fR 70 and 71 \fB\-newpwfile\fR 72 arguments\&. A 73 \fIpassword\fR 74 is equivalent to a personal identification number (PIN)\&. 75 .RE 76 .PP 77 \-chkfips 78 .RS 4 79 Verify whether the module is in the given FIPS mode\&. 80 \fBtrue\fR 81 means to verify that the module is in FIPS mode, while 82 \fBfalse\fR 83 means to verify that the module is not in FIPS mode\&. 84 .RE 85 .PP 86 \-create 87 .RS 4 88 Create new certificate, key, and module databases\&. Use the 89 \fB\-dbdir\fR 90 directory argument to specify a directory\&. If any of these databases already exist in a specified directory, 91 \fBmodutil\fR 92 returns an error message\&. 93 .RE 94 .PP 95 \-default modulename 96 .RS 4 97 Specify the security mechanisms for which the named module will be a default provider\&. The security mechanisms are specified with the 98 \fB\-mechanisms\fR 99 argument\&. 100 .RE 101 .PP 102 \-delete modulename 103 .RS 4 104 Delete the named module\&. The default NSS PKCS #11 module cannot be deleted\&. 105 .RE 106 .PP 107 \-disable modulename 108 .RS 4 109 Disable all slots on the named module\&. Use the 110 \fB\-slot\fR 111 argument to disable a specific slot\&. 112 .sp 113 The internal NSS PKCS #11 module cannot be disabled\&. 114 .RE 115 .PP 116 \-enable modulename 117 .RS 4 118 Enable all slots on the named module\&. Use the 119 \fB\-slot\fR 120 argument to enable a specific slot\&. 121 .RE 122 .PP 123 \-fips [true | false] 124 .RS 4 125 Enable (true) or disable (false) FIPS 140\-2 compliance for the default NSS module\&. 126 .RE 127 .PP 128 \-force 129 .RS 4 130 Disable 131 \fBmodutil\fR\*(Aqs interactive prompts so it can be run from a script\&. Use this option only after manually testing each planned operation to check for warnings and to ensure that bypassing the prompts will cause no security lapses or loss of database integrity\&. 132 .RE 133 .PP 134 \-jar JAR\-file 135 .RS 4 136 Add a new PKCS #11 module to the database using the named JAR file\&. Use this command with the 137 \fB\-installdir\fR 138 and 139 \fB\-tempdir\fR 140 arguments\&. The JAR file uses the NSS PKCS #11 JAR format to identify all the files to be installed, the module\*(Aqs name, the mechanism flags, and the cipher flags, as well as any files to be installed on the target machine, including the PKCS #11 module library file and other files such as documentation\&. This is covered in the JAR installation file section in the man page, which details the special script needed to perform an installation through a server or with 141 \fBmodutil\fR\&. 142 .RE 143 .PP 144 \-list [modulename] 145 .RS 4 146 Display basic information about the contents of the 147 secmod\&.db 148 file\&. Specifying a 149 \fImodulename\fR 150 displays detailed information about a particular module and its slots and tokens\&. 151 .RE 152 .PP 153 \-rawadd 154 .RS 4 155 Add the module spec string to the 156 secmod\&.db 157 database\&. 158 .RE 159 .PP 160 \-rawlist 161 .RS 4 162 Display the module specs for a specified module or for all loadable modules\&. 163 .RE 164 .PP 165 \-undefault modulename 166 .RS 4 167 Specify the security mechanisms for which the named module will not be a default provider\&. The security mechanisms are specified with the 168 \fB\-mechanisms\fR 169 argument\&. 170 .RE 171 .PP 172 \fBArguments\fR 173 .PP 174 MODULE 175 .RS 4 176 Give the security module to access\&. 177 .RE 178 .PP 179 MODULESPEC 180 .RS 4 181 Give the security module spec to load into the security database\&. 182 .RE 183 .PP 184 \-ciphers cipher\-enable\-list 185 .RS 4 186 Enable specific ciphers in a module that is being added to the database\&. The 187 \fIcipher\-enable\-list\fR 188 is a colon\-delimited list of cipher names\&. Enclose this list in quotation marks if it contains spaces\&. 189 .RE 190 .PP 191 \-dbdir directory 192 .RS 4 193 Specify the database directory in which to access or create security module database files\&. 194 .sp 195 \fBmodutil\fR 196 supports two types of databases: the legacy security databases (cert8\&.db, 197 key3\&.db, and 198 secmod\&.db) and SQLite databases (cert9\&.db, 199 key4\&.db, and 200 pkcs11\&.txt)\&. If the prefix 201 \fBdbm:\fR 202 is not used, then the tool assumes that the given databases are in SQLite format\&. 203 .RE 204 .PP 205 \-\-dbprefix prefix 206 .RS 4 207 Specify the prefix used on the database files, such as 208 my_ 209 for 210 my_cert9\&.db\&. This option is provided as a special case\&. Changing the names of the certificate and key databases is not recommended\&. 211 .RE 212 .PP 213 \-installdir root\-installation\-directory 214 .RS 4 215 Specify the root installation directory relative to which files will be installed by the 216 \fB\-jar\fR 217 option\&. This directory should be one below which it is appropriate to store dynamic library files, such as a server\*(Aqs root directory\&. 218 .RE 219 .PP 220 \-libfile library\-file 221 .RS 4 222 Specify a path to a library file containing the implementation of the PKCS #11 interface module that is being added to the database\&. 223 .RE 224 .PP 225 \-mechanisms mechanism\-list 226 .RS 4 227 Specify the security mechanisms for which a particular module will be flagged as a default provider\&. The 228 \fImechanism\-list\fR 229 is a colon\-delimited list of mechanism names\&. Enclose this list in quotation marks if it contains spaces\&. 230 .sp 231 The module becomes a default provider for the listed mechanisms when those mechanisms are enabled\&. If more than one module claims to be a particular mechanism\*(Aqs default provider, that mechanism\*(Aqs default provider is undefined\&. 232 .sp 233 \fBmodutil\fR 234 supports several mechanisms: RSA, DSA, RC2, RC4, RC5, AES, DES, DH, SHA1, SHA256, SHA512, SSL, TLS, MD5, MD2, RANDOM (for random number generation), and FRIENDLY (meaning certificates are publicly readable)\&. 235 .RE 236 .PP 237 \-newpwfile new\-password\-file 238 .RS 4 239 Specify a text file containing a token\*(Aqs new or replacement password so that a password can be entered automatically with the 240 \fB\-changepw\fR 241 option\&. 242 .RE 243 .PP 244 \-nocertdb 245 .RS 4 246 Do not open the certificate or key databases\&. This has several effects: 247 .sp 248 .RS 4 249 .ie n \{\ 250 \h'-04'\(bu\h'+03'\c 251 .\} 252 .el \{\ 253 .sp -1 254 .IP \(bu 2.3 255 .\} 256 With the 257 \fB\-create\fR 258 command, only a module security file is created; certificate and key databases are not created\&. 259 .RE 260 .sp 261 .RS 4 262 .ie n \{\ 263 \h'-04'\(bu\h'+03'\c 264 .\} 265 .el \{\ 266 .sp -1 267 .IP \(bu 2.3 268 .\} 269 With the 270 \fB\-jar\fR 271 command, signatures on the JAR file are not checked\&. 272 .RE 273 .sp 274 .RS 4 275 .ie n \{\ 276 \h'-04'\(bu\h'+03'\c 277 .\} 278 .el \{\ 279 .sp -1 280 .IP \(bu 2.3 281 .\} 282 With the 283 \fB\-changepw\fR 284 command, the password on the NSS internal module cannot be set or changed, since this password is stored in the key database\&. 285 .RE 286 .RE 287 .PP 288 \-pwfile old\-password\-file 289 .RS 4 290 Specify a text file containing a token\*(Aqs existing password so that a password can be entered automatically when the 291 \fB\-changepw\fR 292 option is used to change passwords\&. 293 .RE 294 .PP 295 \-secmod secmodname 296 .RS 4 297 Give the name of the security module database (like 298 secmod\&.db) to load\&. 299 .RE 300 .PP 301 \-slot slotname 302 .RS 4 303 Specify a particular slot to be enabled or disabled with the 304 \fB\-enable\fR 305 or 306 \fB\-disable\fR 307 options\&. 308 .RE 309 .PP 310 \-string CONFIG_STRING 311 .RS 4 312 Pass a configuration string for the module being added to the database\&. 313 .RE 314 .PP 315 \-tempdir temporary\-directory 316 .RS 4 317 Give a directory location where temporary files are created during the installation by the 318 \fB\-jar\fR 319 option\&. If no temporary directory is specified, the current directory is used\&. 320 .RE 321 .SH "USAGE AND EXAMPLES" 322 .PP 323 \fBCreating Database Files\fR 324 .PP 325 Before any operations can be performed, there must be a set of security databases available\&. 326 \fBmodutil\fR 327 can be used to create these files\&. The only required argument is the database that where the databases will be located\&. 328 .sp 329 .if n \{\ 330 .RS 4 331 .\} 332 .nf 333 modutil \-create \-dbdir directory 334 .fi 335 .if n \{\ 336 .RE 337 .\} 338 .PP 339 \fBAdding a Cryptographic Module\fR 340 .PP 341 Adding a PKCS #11 module means submitting a supporting library file, enabling its ciphers, and setting default provider status for various security mechanisms\&. This can be done by supplying all of the information through 342 \fBmodutil\fR 343 directly or by running a JAR file and install script\&. For the most basic case, simply upload the library: 344 .sp 345 .if n \{\ 346 .RS 4 347 .\} 348 .nf 349 modutil \-add modulename \-libfile library\-file [\-ciphers cipher\-enable\-list] [\-mechanisms mechanism\-list] 350 .fi 351 .if n \{\ 352 .RE 353 .\} 354 .PP 355 For example: 356 .sp 357 .if n \{\ 358 .RS 4 359 .\} 360 .nf 361 modutil \-dbdir /home/my/sharednssdb \-add "Example PKCS #11 Module" \-libfile "/tmp/crypto\&.so" \-mechanisms RSA:DSA:RC2:RANDOM 362 363 Using database directory \&.\&.\&. 364 Module "Example PKCS #11 Module" added to database\&. 365 .fi 366 .if n \{\ 367 .RE 368 .\} 369 .PP 370 \fBInstalling a Cryptographic Module from a JAR File\fR 371 .PP 372 PKCS #11 modules can also be loaded using a JAR file, which contains all of the required libraries and an installation script that describes how to install the module\&. The JAR install script is described in more detail in 373 the section called \(lqJAR INSTALLATION FILE FORMAT\(rq\&. 374 .PP 375 The JAR installation script defines the setup information for each platform that the module can be installed on\&. For example: 376 .sp 377 .if n \{\ 378 .RS 4 379 .\} 380 .nf 381 Platforms { 382 Linux:5\&.4\&.08:x86 { 383 ModuleName { "Example PKCS #11 Module" } 384 ModuleFile { crypto\&.so } 385 DefaultMechanismFlags{0x0000} 386 CipherEnableFlags{0x0000} 387 Files { 388 crypto\&.so { 389 Path{ /tmp/crypto\&.so } 390 } 391 setup\&.sh { 392 Executable 393 Path{ /tmp/setup\&.sh } 394 } 395 } 396 } 397 Linux:6\&.0\&.0:x86 { 398 EquivalentPlatform { Linux:5\&.4\&.08:x86 } 399 } 400 } 401 .fi 402 .if n \{\ 403 .RE 404 .\} 405 .PP 406 Both the install script and the required libraries must be bundled in a JAR file, which is specified with the 407 \fB\-jar\fR 408 argument\&. 409 .sp 410 .if n \{\ 411 .RS 4 412 .\} 413 .nf 414 modutil \-dbdir /home/mt"jar\-install\-filey/sharednssdb \-jar install\&.jar \-installdir /home/my/sharednssdb 415 416 This installation JAR file was signed by: 417 \-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\- 418 419 **SUBJECT NAME** 420 421 C=US, ST=California, L=Mountain View, CN=Cryptorific Inc\&., OU=Digital ID 422 Class 3 \- Netscape Object Signing, OU="www\&.verisign\&.com/repository/CPS 423 Incorp\&. by Ref\&.,LIAB\&.LTD(c)9 6", OU=www\&.verisign\&.com/CPS Incorp\&.by Ref 424 \&. LIABILITY LTD\&.(c)97 VeriSign, OU=VeriSign Object Signing CA \- Class 3 425 Organization, OU="VeriSign, Inc\&.", O=VeriSign Trust Network **ISSUER 426 NAME**, OU=www\&.verisign\&.com/CPS Incorp\&.by Ref\&. LIABILITY LTD\&.(c)97 427 VeriSign, OU=VeriSign Object Signing CA \- Class 3 Organization, 428 OU="VeriSign, Inc\&.", O=VeriSign Trust Network 429 \-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\- 430 431 Do you wish to continue this installation? (y/n) y 432 Using installer script "installer_script" 433 Successfully parsed installation script 434 Current platform is Linux:5\&.4\&.08:x86 435 Using installation parameters for platform Linux:5\&.4\&.08:x86 436 Installed file crypto\&.so to /tmp/crypto\&.so 437 Installed file setup\&.sh to \&./pk11inst\&.dir/setup\&.sh 438 Executing "\&./pk11inst\&.dir/setup\&.sh"\&.\&.\&. 439 "\&./pk11inst\&.dir/setup\&.sh" executed successfully 440 Installed module "Example PKCS #11 Module" into module database 441 442 Installation completed successfully 443 .fi 444 .if n \{\ 445 .RE 446 .\} 447 .PP 448 \fBAdding Module Spec\fR 449 .PP 450 Each module has information stored in the security database about its configuration and parameters\&. These can be added or edited using the 451 \fB\-rawadd\fR 452 command\&. For the current settings or to see the format of the module spec in the database, use the 453 \fB\-rawlist\fR 454 option\&. 455 .sp 456 .if n \{\ 457 .RS 4 458 .\} 459 .nf 460 modutil \-rawadd modulespec 461 .fi 462 .if n \{\ 463 .RE 464 .\} 465 .PP 466 \fBDeleting a Module\fR 467 .PP 468 A specific PKCS #11 module can be deleted from the 469 secmod\&.db 470 database: 471 .sp 472 .if n \{\ 473 .RS 4 474 .\} 475 .nf 476 modutil \-delete modulename \-dbdir directory 477 .fi 478 .if n \{\ 479 .RE 480 .\} 481 .PP 482 \fBDisplaying Module Information\fR 483 .PP 484 The 485 secmod\&.db 486 database contains information about the PKCS #11 modules that are available to an application or server to use\&. The list of all modules, information about specific modules, and database configuration specs for modules can all be viewed\&. 487 .PP 488 To simply get a list of modules in the database, use the 489 \fB\-list\fR 490 command\&. 491 .sp 492 .if n \{\ 493 .RS 4 494 .\} 495 .nf 496 modutil \-list [modulename] \-dbdir directory 497 .fi 498 .if n \{\ 499 .RE 500 .\} 501 .PP 502 Listing the modules shows the module name, their status, and other associated security databases for certificates and keys\&. For example: 503 .sp 504 .if n \{\ 505 .RS 4 506 .\} 507 .nf 508 modutil \-list \-dbdir /home/my/sharednssdb 509 510 Listing of PKCS #11 Modules 511 \-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\- 512 1\&. NSS Internal PKCS #11 Module 513 slots: 2 slots attached 514 status: loaded 515 516 slot: NSS Internal Cryptographic Services 517 token: NSS Generic Crypto Services 518 uri: pkcs11:token=NSS%20Generic%20Crypto%20Services;manufacturer=Mozilla%20Foundation;serial=0000000000000000;model=NSS%203 519 520 slot: NSS User Private Key and Certificate Services 521 token: NSS Certificate DB 522 uri: pkcs11:token=NSS%20Certificate%20DB;manufacturer=Mozilla%20Foundation;serial=0000000000000000;model=NSS%203 523 \-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\- 524 .fi 525 .if n \{\ 526 .RE 527 .\} 528 .PP 529 Passing a specific module name with the 530 \fB\-list\fR 531 returns details information about the module itself, like supported cipher mechanisms, version numbers, serial numbers, and other information about the module and the token it is loaded on\&. For example: 532 .sp 533 .if n \{\ 534 .RS 4 535 .\} 536 .nf 537 modutil \-list "NSS Internal PKCS #11 Module" \-dbdir /home/my/sharednssdb 538 539 \-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\- 540 Name: NSS Internal PKCS #11 Module 541 Library file: **Internal ONLY module** 542 Manufacturer: Mozilla Foundation 543 Description: NSS Internal Crypto Services 544 PKCS #11 Version 2\&.20 545 Library Version: 3\&.11 546 Cipher Enable Flags: None 547 Default Mechanism Flags: RSA:RC2:RC4:DES:DH:SHA1:MD5:MD2:SSL:TLS:AES 548 549 Slot: NSS Internal Cryptographic Services 550 Slot Mechanism Flags: RSA:RC2:RC4:DES:DH:SHA1:MD5:MD2:SSL:TLS:AES 551 Manufacturer: Mozilla Foundation 552 Type: Software 553 Version Number: 3\&.11 554 Firmware Version: 0\&.0 555 Status: Enabled 556 Token Name: NSS Generic Crypto Services 557 Token Manufacturer: Mozilla Foundation 558 Token Model: NSS 3 559 Token Serial Number: 0000000000000000 560 Token Version: 4\&.0 561 Token Firmware Version: 0\&.0 562 Access: Write Protected 563 Login Type: Public (no login required) 564 User Pin: NOT Initialized 565 566 Slot: NSS User Private Key and Certificate Services 567 Slot Mechanism Flags: None 568 Manufacturer: Mozilla Foundation 569 Type: Software 570 Version Number: 3\&.11 571 Firmware Version: 0\&.0 572 Status: Enabled 573 Token Name: NSS Certificate DB 574 Token Manufacturer: Mozilla Foundation 575 Token Model: NSS 3 576 Token Serial Number: 0000000000000000 577 Token Version: 8\&.3 578 Token Firmware Version: 0\&.0 579 Access: NOT Write Protected 580 Login Type: Login required 581 User Pin: Initialized 582 .fi 583 .if n \{\ 584 .RE 585 .\} 586 .PP 587 A related command, 588 \fB\-rawlist\fR 589 returns information about the database configuration for the modules\&. (This information can be edited by loading new specs using the 590 \fB\-rawadd\fR 591 command\&.) 592 .sp 593 .if n \{\ 594 .RS 4 595 .\} 596 .nf 597 modutil \-rawlist \-dbdir /home/my/sharednssdb 598 name="NSS Internal PKCS #11 Module" parameters="configdir=\&. certPrefix= keyPrefix= secmod=secmod\&.db flags=readOnly " NSS="trustOrder=75 cipherOrder=100 slotParams={0x00000001=[slotFlags=RSA,RC4,RC2,DES,DH,SHA1,MD5,MD2,SSL,TLS,AES,RANDOM askpw=any timeout=30 ] } Flags=internal,critical" 599 .fi 600 .if n \{\ 601 .RE 602 .\} 603 .PP 604 \fBSetting a Default Provider for Security Mechanisms\fR 605 .PP 606 Multiple security modules may provide support for the same security mechanisms\&. It is possible to set a specific security module as the default provider for a specific security mechanism (or, conversely, to prohibit a provider from supplying those mechanisms)\&. 607 .sp 608 .if n \{\ 609 .RS 4 610 .\} 611 .nf 612 modutil \-default modulename \-mechanisms mechanism\-list 613 .fi 614 .if n \{\ 615 .RE 616 .\} 617 .PP 618 To set a module as the default provider for mechanisms, use the 619 \fB\-default\fR 620 command with a colon\-separated list of mechanisms\&. The available mechanisms depend on the module; NSS supplies almost all common mechanisms\&. For example: 621 .sp 622 .if n \{\ 623 .RS 4 624 .\} 625 .nf 626 modutil \-default "NSS Internal PKCS #11 Module" \-dbdir \-mechanisms RSA:DSA:RC2 627 628 Using database directory c:\edatabases\&.\&.\&. 629 630 Successfully changed defaults\&. 631 .fi 632 .if n \{\ 633 .RE 634 .\} 635 .PP 636 Clearing the default provider has the same format: 637 .sp 638 .if n \{\ 639 .RS 4 640 .\} 641 .nf 642 modutil \-undefault "NSS Internal PKCS #11 Module" \-dbdir \-mechanisms MD2:MD5 643 .fi 644 .if n \{\ 645 .RE 646 .\} 647 .PP 648 \fBEnabling and Disabling Modules and Slots\fR 649 .PP 650 Modules, and specific slots on modules, can be selectively enabled or disabled using 651 \fBmodutil\fR\&. Both commands have the same format: 652 .sp 653 .if n \{\ 654 .RS 4 655 .\} 656 .nf 657 modutil \-enable|\-disable modulename [\-slot slotname] 658 .fi 659 .if n \{\ 660 .RE 661 .\} 662 .PP 663 For example: 664 .sp 665 .if n \{\ 666 .RS 4 667 .\} 668 .nf 669 modutil \-enable "NSS Internal PKCS #11 Module" \-slot "NSS Internal Cryptographic Services " \-dbdir \&. 670 671 Slot "NSS Internal Cryptographic Services " enabled\&. 672 .fi 673 .if n \{\ 674 .RE 675 .\} 676 .PP 677 Be sure that the appropriate amount of trailing whitespace is after the slot name\&. Some slot names have a significant amount of whitespace that must be included, or the operation will fail\&. 678 .PP 679 \fBEnabling and Verifying FIPS Compliance\fR 680 .PP 681 The NSS modules can have FIPS 140\-2 compliance enabled or disabled using 682 \fBmodutil\fR 683 with the 684 \fB\-fips\fR 685 option\&. For example: 686 .sp 687 .if n \{\ 688 .RS 4 689 .\} 690 .nf 691 modutil \-fips true \-dbdir /home/my/sharednssdb/ 692 693 FIPS mode enabled\&. 694 .fi 695 .if n \{\ 696 .RE 697 .\} 698 .PP 699 To verify that status of FIPS mode, run the 700 \fB\-chkfips\fR 701 command with either a true or false flag (it doesn\*(Aqt matter which)\&. The tool returns the current FIPS setting\&. 702 .sp 703 .if n \{\ 704 .RS 4 705 .\} 706 .nf 707 modutil \-chkfips false \-dbdir /home/my/sharednssdb/ 708 709 FIPS mode enabled\&. 710 .fi 711 .if n \{\ 712 .RE 713 .\} 714 .PP 715 \fBChanging the Password on a Token\fR 716 .PP 717 Initializing or changing a token\*(Aqs password: 718 .sp 719 .if n \{\ 720 .RS 4 721 .\} 722 .nf 723 modutil \-changepw tokenname [\-pwfile old\-password\-file] [\-newpwfile new\-password\-file] 724 .fi 725 .if n \{\ 726 .RE 727 .\} 728 .sp 729 .if n \{\ 730 .RS 4 731 .\} 732 .nf 733 modutil \-dbdir /home/my/sharednssdb \-changepw "NSS Certificate DB" 734 735 Enter old password: 736 Incorrect password, try again\&.\&.\&. 737 Enter old password: 738 Enter new password: 739 Re\-enter new password: 740 Token "Communicator Certificate DB" password changed successfully\&. 741 .fi 742 .if n \{\ 743 .RE 744 .\} 745 .SH "JAR INSTALLATION FILE FORMAT" 746 .PP 747 When a JAR file is run by a server, by 748 \fBmodutil\fR, or by any program that does not interpret JavaScript, a special information file must be included to install the libraries\&. There are several things to keep in mind with this file: 749 .sp 750 .RS 4 751 .ie n \{\ 752 \h'-04'\(bu\h'+03'\c 753 .\} 754 .el \{\ 755 .sp -1 756 .IP \(bu 2.3 757 .\} 758 It must be declared in the JAR archive\*(Aqs manifest file\&. 759 .RE 760 .sp 761 .RS 4 762 .ie n \{\ 763 \h'-04'\(bu\h'+03'\c 764 .\} 765 .el \{\ 766 .sp -1 767 .IP \(bu 2.3 768 .\} 769 The script can have any name\&. 770 .RE 771 .sp 772 .RS 4 773 .ie n \{\ 774 \h'-04'\(bu\h'+03'\c 775 .\} 776 .el \{\ 777 .sp -1 778 .IP \(bu 2.3 779 .\} 780 The metainfo tag for this is 781 \fBPkcs11_install_script\fR\&. To declare meta\-information in the manifest file, put it in a file that is passed to 782 \fBsigntool\fR\&. 783 .RE 784 .PP 785 \fBSample Script\fR 786 .PP 787 For example, the PKCS #11 installer script could be in the file pk11install\&. If so, the metainfo file for 788 \fBsigntool\fR 789 includes a line such as this: 790 .sp 791 .if n \{\ 792 .RS 4 793 .\} 794 .nf 795 + Pkcs11_install_script: pk11install 796 .fi 797 .if n \{\ 798 .RE 799 .\} 800 .PP 801 The script must define the platform and version number, the module name and file, and any optional information like supported ciphers and mechanisms\&. Multiple platforms can be defined in a single install file\&. 802 .sp 803 .if n \{\ 804 .RS 4 805 .\} 806 .nf 807 ForwardCompatible { IRIX:6\&.2:mips SUNOS:5\&.5\&.1:sparc } 808 Platforms { 809 WINNT::x86 { 810 ModuleName { "Example Module" } 811 ModuleFile { win32/fort32\&.dll } 812 DefaultMechanismFlags{0x0001} 813 DefaultCipherFlags{0x0001} 814 Files { 815 win32/setup\&.exe { 816 Executable 817 RelativePath { %temp%/setup\&.exe } 818 } 819 win32/setup\&.hlp { 820 RelativePath { %temp%/setup\&.hlp } 821 } 822 win32/setup\&.cab { 823 RelativePath { %temp%/setup\&.cab } 824 } 825 } 826 } 827 SUNOS:5\&.5\&.1:sparc { 828 ModuleName { "Example UNIX Module" } 829 ModuleFile { unix/fort\&.so } 830 DefaultMechanismFlags{0x0001} 831 CipherEnableFlags{0x0001} 832 Files { 833 unix/fort\&.so { 834 RelativePath{%root%/lib/fort\&.so} 835 AbsolutePath{/usr/local/netscape/lib/fort\&.so} 836 FilePermissions{555} 837 } 838 xplat/instr\&.html { 839 RelativePath{%root%/docs/inst\&.html} 840 AbsolutePath{/usr/local/netscape/docs/inst\&.html} 841 FilePermissions{555} 842 } 843 } 844 } 845 IRIX:6\&.2:mips { 846 EquivalentPlatform { SUNOS:5\&.5\&.1:sparc } 847 } 848 } 849 .fi 850 .if n \{\ 851 .RE 852 .\} 853 .PP 854 \fBScript Grammar\fR 855 .PP 856 The script is basic Java, allowing lists, key\-value pairs, strings, and combinations of all of them\&. 857 .sp 858 .if n \{\ 859 .RS 4 860 .\} 861 .nf 862 \-\-> valuelist 863 864 valuelist \-\-> value valuelist 865 <null> 866 867 value \-\-\-> key_value_pair 868 string 869 870 key_value_pair \-\-> key { valuelist } 871 872 key \-\-> string 873 874 string \-\-> simple_string 875 "complex_string" 876 877 simple_string \-\-> [^ \et\en\e""{""}"]+ 878 879 complex_string \-\-> ([^\e"\e\e\er\en]|(\e\e\e")|(\e\e\e\e))+ 880 .fi 881 .if n \{\ 882 .RE 883 .\} 884 .PP 885 Quotes and backslashes must be escaped with a backslash\&. A complex string must not include newlines or carriage returns\&.Outside of complex strings, all white space (for example, spaces, tabs, and carriage returns) is considered equal and is used only to delimit tokens\&. 886 .PP 887 \fBKeys\fR 888 .PP 889 The Java install file uses keys to define the platform and module information\&. 890 .PP 891 \fBForwardCompatible\fR 892 gives a list of platforms that are forward compatible\&. If the current platform cannot be found in the list of supported platforms, then the 893 \fBForwardCompatible\fR 894 list is checked for any platforms that have the same OS and architecture in an earlier version\&. If one is found, its attributes are used for the current platform\&. 895 .PP 896 \fBPlatforms\fR 897 (required) Gives a list of platforms\&. Each entry in the list is itself a key\-value pair: the key is the name of the platform and the value list contains various attributes of the platform\&. The platform string is in the format 898 \fIsystem name:OS release:architecture\fR\&. The installer obtains these values from NSPR\&. OS release is an empty string on non\-Unix operating systems\&. NSPR supports these platforms: 899 .sp 900 .RS 4 901 .ie n \{\ 902 \h'-04'\(bu\h'+03'\c 903 .\} 904 .el \{\ 905 .sp -1 906 .IP \(bu 2.3 907 .\} 908 AIX (rs6000) 909 .RE 910 .sp 911 .RS 4 912 .ie n \{\ 913 \h'-04'\(bu\h'+03'\c 914 .\} 915 .el \{\ 916 .sp -1 917 .IP \(bu 2.3 918 .\} 919 BSDI (x86) 920 .RE 921 .sp 922 .RS 4 923 .ie n \{\ 924 \h'-04'\(bu\h'+03'\c 925 .\} 926 .el \{\ 927 .sp -1 928 .IP \(bu 2.3 929 .\} 930 FREEBSD (x86) 931 .RE 932 .sp 933 .RS 4 934 .ie n \{\ 935 \h'-04'\(bu\h'+03'\c 936 .\} 937 .el \{\ 938 .sp -1 939 .IP \(bu 2.3 940 .\} 941 HPUX (hppa1\&.1) 942 .RE 943 .sp 944 .RS 4 945 .ie n \{\ 946 \h'-04'\(bu\h'+03'\c 947 .\} 948 .el \{\ 949 .sp -1 950 .IP \(bu 2.3 951 .\} 952 IRIX (mips) 953 .RE 954 .sp 955 .RS 4 956 .ie n \{\ 957 \h'-04'\(bu\h'+03'\c 958 .\} 959 .el \{\ 960 .sp -1 961 .IP \(bu 2.3 962 .\} 963 LINUX (ppc, alpha, x86) 964 .RE 965 .sp 966 .RS 4 967 .ie n \{\ 968 \h'-04'\(bu\h'+03'\c 969 .\} 970 .el \{\ 971 .sp -1 972 .IP \(bu 2.3 973 .\} 974 MacOS (PowerPC) 975 .RE 976 .sp 977 .RS 4 978 .ie n \{\ 979 \h'-04'\(bu\h'+03'\c 980 .\} 981 .el \{\ 982 .sp -1 983 .IP \(bu 2.3 984 .\} 985 NCR (x86) 986 .RE 987 .sp 988 .RS 4 989 .ie n \{\ 990 \h'-04'\(bu\h'+03'\c 991 .\} 992 .el \{\ 993 .sp -1 994 .IP \(bu 2.3 995 .\} 996 NEC (mips) 997 .RE 998 .sp 999 .RS 4 1000 .ie n \{\ 1001 \h'-04'\(bu\h'+03'\c 1002 .\} 1003 .el \{\ 1004 .sp -1 1005 .IP \(bu 2.3 1006 .\} 1007 OS2 (x86) 1008 .RE 1009 .sp 1010 .RS 4 1011 .ie n \{\ 1012 \h'-04'\(bu\h'+03'\c 1013 .\} 1014 .el \{\ 1015 .sp -1 1016 .IP \(bu 2.3 1017 .\} 1018 OSF (alpha) 1019 .RE 1020 .sp 1021 .RS 4 1022 .ie n \{\ 1023 \h'-04'\(bu\h'+03'\c 1024 .\} 1025 .el \{\ 1026 .sp -1 1027 .IP \(bu 2.3 1028 .\} 1029 ReliantUNIX (mips) 1030 .RE 1031 .sp 1032 .RS 4 1033 .ie n \{\ 1034 \h'-04'\(bu\h'+03'\c 1035 .\} 1036 .el \{\ 1037 .sp -1 1038 .IP \(bu 2.3 1039 .\} 1040 SCO (x86) 1041 .RE 1042 .sp 1043 .RS 4 1044 .ie n \{\ 1045 \h'-04'\(bu\h'+03'\c 1046 .\} 1047 .el \{\ 1048 .sp -1 1049 .IP \(bu 2.3 1050 .\} 1051 SOLARIS (sparc) 1052 .RE 1053 .sp 1054 .RS 4 1055 .ie n \{\ 1056 \h'-04'\(bu\h'+03'\c 1057 .\} 1058 .el \{\ 1059 .sp -1 1060 .IP \(bu 2.3 1061 .\} 1062 SONY (mips) 1063 .RE 1064 .sp 1065 .RS 4 1066 .ie n \{\ 1067 \h'-04'\(bu\h'+03'\c 1068 .\} 1069 .el \{\ 1070 .sp -1 1071 .IP \(bu 2.3 1072 .\} 1073 SUNOS (sparc) 1074 .RE 1075 .sp 1076 .RS 4 1077 .ie n \{\ 1078 \h'-04'\(bu\h'+03'\c 1079 .\} 1080 .el \{\ 1081 .sp -1 1082 .IP \(bu 2.3 1083 .\} 1084 UnixWare (x86) 1085 .RE 1086 .sp 1087 .RS 4 1088 .ie n \{\ 1089 \h'-04'\(bu\h'+03'\c 1090 .\} 1091 .el \{\ 1092 .sp -1 1093 .IP \(bu 2.3 1094 .\} 1095 WIN16 (x86) 1096 .RE 1097 .sp 1098 .RS 4 1099 .ie n \{\ 1100 \h'-04'\(bu\h'+03'\c 1101 .\} 1102 .el \{\ 1103 .sp -1 1104 .IP \(bu 2.3 1105 .\} 1106 WIN95 (x86) 1107 .RE 1108 .sp 1109 .RS 4 1110 .ie n \{\ 1111 \h'-04'\(bu\h'+03'\c 1112 .\} 1113 .el \{\ 1114 .sp -1 1115 .IP \(bu 2.3 1116 .\} 1117 WINNT (x86) 1118 .RE 1119 .PP 1120 For example: 1121 .sp 1122 .if n \{\ 1123 .RS 4 1124 .\} 1125 .nf 1126 IRIX:6\&.2:mips 1127 SUNOS:5\&.5\&.1:sparc 1128 Linux:2\&.0\&.32:x86 1129 WIN95::x86 1130 .fi 1131 .if n \{\ 1132 .RE 1133 .\} 1134 .PP 1135 The module information is defined independently for each platform in the 1136 \fBModuleName\fR, 1137 \fBModuleFile\fR, and 1138 \fBFiles\fR 1139 attributes\&. These attributes must be given unless an 1140 \fBEquivalentPlatform\fR 1141 attribute is specified\&. 1142 .PP 1143 \fBPer\-Platform Keys\fR 1144 .PP 1145 Per\-platform keys have meaning only within the value list of an entry in the 1146 \fBPlatforms\fR 1147 list\&. 1148 .PP 1149 \fBModuleName\fR 1150 (required) gives the common name for the module\&. This name is used to reference the module by servers and by the 1151 \fBmodutil\fR 1152 tool\&. 1153 .PP 1154 \fBModuleFile\fR 1155 (required) names the PKCS #11 module file for this platform\&. The name is given as the relative path of the file within the JAR archive\&. 1156 .PP 1157 \fBFiles\fR 1158 (required) lists the files that need to be installed for this module\&. Each entry in the file list is a key\-value pair\&. The key is the path of the file in the JAR archive, and the value list contains attributes of the file\&. At least 1159 \fBRelativePath\fR 1160 or 1161 \fBAbsolutePath\fR 1162 must be specified for each file\&. 1163 .PP 1164 \fBDefaultMechanismFlags\fR 1165 specifies mechanisms for which this module is the default provider; this is equivalent to the 1166 \fB\-mechanism\fR 1167 option with the 1168 \fB\-add\fR 1169 command\&. This key\-value pair is a bitstring specified in hexadecimal (0x) format\&. It is constructed as a bitwise OR\&. If the DefaultMechanismFlags entry is omitted, the value defaults to 0x0\&. 1170 .sp 1171 .if n \{\ 1172 .RS 4 1173 .\} 1174 .nf 1175 RSA: 0x00000001 1176 DSA: 0x00000002 1177 RC2: 0x00000004 1178 RC4: 0x00000008 1179 DES: 0x00000010 1180 DH: 0x00000020 1181 FORTEZZA: 0x00000040 1182 RC5: 0x00000080 1183 SHA1: 0x00000100 1184 MD5: 0x00000200 1185 MD2: 0x00000400 1186 RANDOM: 0x08000000 1187 FRIENDLY: 0x10000000 1188 OWN_PW_DEFAULTS: 0x20000000 1189 DISABLE: 0x40000000 1190 .fi 1191 .if n \{\ 1192 .RE 1193 .\} 1194 .PP 1195 \fBCipherEnableFlags\fR 1196 specifies ciphers that this module provides that NSS does not provide (so that the module enables those ciphers for NSS)\&. This is equivalent to the 1197 \fB\-cipher\fR 1198 argument with the 1199 \fB\-add\fR 1200 command\&. This key is a bitstring specified in hexadecimal (0x) format\&. It is constructed as a bitwise OR\&. If the 1201 \fBCipherEnableFlags\fR 1202 entry is omitted, the value defaults to 0x0\&. 1203 .PP 1204 \fBEquivalentPlatform\fR 1205 specifies that the attributes of the named platform should also be used for the current platform\&. This makes it easier when more than one platform uses the same settings\&. 1206 .PP 1207 \fBPer\-File Keys\fR 1208 .PP 1209 Some keys have meaning only within the value list of an entry in a 1210 \fBFiles\fR 1211 list\&. 1212 .PP 1213 Each file requires a path key the identifies where the file is\&. Either 1214 \fBRelativePath\fR 1215 or 1216 \fBAbsolutePath\fR 1217 must be specified\&. If both are specified, the relative path is tried first, and the absolute path is used only if no relative root directory is provided by the installer program\&. 1218 .PP 1219 \fBRelativePath\fR 1220 specifies the destination directory of the file, relative to some directory decided at install time\&. Two variables can be used in the relative path: 1221 \fB%root%\fR 1222 and 1223 \fB%temp%\fR\&. 1224 \fB%root%\fR 1225 is replaced at run time with the directory relative to which files should be installed; for example, it may be the server\*(Aqs root directory\&. The 1226 \fB%temp%\fR 1227 directory is created at the beginning of the installation and destroyed at the end\&. The purpose of 1228 \fB%temp%\fR 1229 is to hold executable files (such as setup programs) or files that are used by these programs\&. Files destined for the temporary directory are guaranteed to be in place before any executable file is run; they are not deleted until all executable files have finished\&. 1230 .PP 1231 \fBAbsolutePath\fR 1232 specifies the destination directory of the file as an absolute path\&. 1233 .PP 1234 \fBExecutable\fR 1235 specifies that the file is to be executed during the course of the installation\&. Typically, this string is used for a setup program provided by a module vendor, such as a self\-extracting setup executable\&. More than one file can be specified as executable, in which case the files are run in the order in which they are specified in the script file\&. 1236 .PP 1237 \fBFilePermissions\fR 1238 sets permissions on any referenced files in a string of octal digits, according to the standard Unix format\&. This string is a bitwise OR\&. 1239 .sp 1240 .if n \{\ 1241 .RS 4 1242 .\} 1243 .nf 1244 user read: 0400 1245 user write: 0200 1246 user execute: 0100 1247 group read: 0040 1248 group write: 0020 1249 group execute: 0010 1250 other read: 0004 1251 other write: 0002 1252 other execute: 0001 1253 .fi 1254 .if n \{\ 1255 .RE 1256 .\} 1257 .PP 1258 Some platforms may not understand these permissions\&. They are applied only insofar as they make sense for the current platform\&. If this attribute is omitted, a default of 777 is assumed\&. 1259 .SH "NSS DATABASE TYPES" 1260 .PP 1261 NSS originally used BerkeleyDB databases to store security information\&. The last versions of these 1262 \fIlegacy\fR 1263 databases are: 1264 .sp 1265 .RS 4 1266 .ie n \{\ 1267 \h'-04'\(bu\h'+03'\c 1268 .\} 1269 .el \{\ 1270 .sp -1 1271 .IP \(bu 2.3 1272 .\} 1273 cert8\&.db for certificates 1274 .RE 1275 .sp 1276 .RS 4 1277 .ie n \{\ 1278 \h'-04'\(bu\h'+03'\c 1279 .\} 1280 .el \{\ 1281 .sp -1 1282 .IP \(bu 2.3 1283 .\} 1284 key3\&.db for keys 1285 .RE 1286 .sp 1287 .RS 4 1288 .ie n \{\ 1289 \h'-04'\(bu\h'+03'\c 1290 .\} 1291 .el \{\ 1292 .sp -1 1293 .IP \(bu 2.3 1294 .\} 1295 secmod\&.db for PKCS #11 module information 1296 .RE 1297 .PP 1298 BerkeleyDB has performance limitations, though, which prevent it from being easily used by multiple applications simultaneously\&. NSS has some flexibility that allows applications to use their own, independent database engine while keeping a shared database and working around the access issues\&. Still, NSS requires more flexibility to provide a truly shared security database\&. 1299 .PP 1300 In 2009, NSS introduced a new set of databases that are SQLite databases rather than BerkleyDB\&. These new databases provide more accessibility and performance: 1301 .sp 1302 .RS 4 1303 .ie n \{\ 1304 \h'-04'\(bu\h'+03'\c 1305 .\} 1306 .el \{\ 1307 .sp -1 1308 .IP \(bu 2.3 1309 .\} 1310 cert9\&.db for certificates 1311 .RE 1312 .sp 1313 .RS 4 1314 .ie n \{\ 1315 \h'-04'\(bu\h'+03'\c 1316 .\} 1317 .el \{\ 1318 .sp -1 1319 .IP \(bu 2.3 1320 .\} 1321 key4\&.db for keys 1322 .RE 1323 .sp 1324 .RS 4 1325 .ie n \{\ 1326 \h'-04'\(bu\h'+03'\c 1327 .\} 1328 .el \{\ 1329 .sp -1 1330 .IP \(bu 2.3 1331 .\} 1332 pkcs11\&.txt, which is listing of all of the PKCS #11 modules contained in a new subdirectory in the security databases directory 1333 .RE 1334 .PP 1335 Because the SQLite databases are designed to be shared, these are the 1336 \fIshared\fR 1337 database type\&. The shared database type is preferred; the legacy format is included for backward compatibility\&. 1338 .PP 1339 By default, the tools (\fBcertutil\fR, 1340 \fBpk12util\fR, 1341 \fBmodutil\fR) assume that the given security databases use the SQLite type\&. Using the legacy databases must be manually specified by using the 1342 \fBdbm:\fR 1343 prefix with the given security directory\&. For example: 1344 .sp 1345 .if n \{\ 1346 .RS 4 1347 .\} 1348 .nf 1349 modutil \-create \-dbdir dbm:/home/my/sharednssdb 1350 .fi 1351 .if n \{\ 1352 .RE 1353 .\} 1354 .PP 1355 To set the legacy database type as the default type for the tools, set the 1356 \fBNSS_DEFAULT_DB_TYPE\fR 1357 environment variable to 1358 \fBdbm\fR: 1359 .sp 1360 .if n \{\ 1361 .RS 4 1362 .\} 1363 .nf 1364 export NSS_DEFAULT_DB_TYPE="dbm" 1365 .fi 1366 .if n \{\ 1367 .RE 1368 .\} 1369 .PP 1370 This line can be added to the 1371 ~/\&.bashrc 1372 file to make the change permanent for the user\&. 1373 .sp 1374 .RS 4 1375 .ie n \{\ 1376 \h'-04'\(bu\h'+03'\c 1377 .\} 1378 .el \{\ 1379 .sp -1 1380 .IP \(bu 2.3 1381 .\} 1382 https://wiki\&.mozilla\&.org/NSS_Shared_DB_Howto 1383 .RE 1384 .PP 1385 For an engineering draft on the changes in the shared NSS databases, see the NSS project wiki: 1386 .sp 1387 .RS 4 1388 .ie n \{\ 1389 \h'-04'\(bu\h'+03'\c 1390 .\} 1391 .el \{\ 1392 .sp -1 1393 .IP \(bu 2.3 1394 .\} 1395 https://wiki\&.mozilla\&.org/NSS_Shared_DB 1396 .RE 1397 .SH "SEE ALSO" 1398 .PP 1399 certutil (1) 1400 .PP 1401 pk12util (1) 1402 .PP 1403 signtool (1) 1404 .PP 1405 The NSS wiki has information on the new database design and how to configure applications to use it\&. 1406 .sp 1407 .RS 4 1408 .ie n \{\ 1409 \h'-04'\(bu\h'+03'\c 1410 .\} 1411 .el \{\ 1412 .sp -1 1413 .IP \(bu 2.3 1414 .\} 1415 https://wiki\&.mozilla\&.org/NSS_Shared_DB_Howto 1416 .RE 1417 .sp 1418 .RS 4 1419 .ie n \{\ 1420 \h'-04'\(bu\h'+03'\c 1421 .\} 1422 .el \{\ 1423 .sp -1 1424 .IP \(bu 2.3 1425 .\} 1426 https://wiki\&.mozilla\&.org/NSS_Shared_DB 1427 .RE 1428 .SH "ADDITIONAL RESOURCES" 1429 .PP 1430 For information about NSS and other tools related to NSS (like JSS), check out the NSS project wiki at 1431 \m[blue]\fBhttp://www\&.mozilla\&.org/projects/security/pki/nss/\fR\m[]\&. The NSS site relates directly to NSS code changes and releases\&. 1432 .PP 1433 Mailing lists: https://lists\&.mozilla\&.org/listinfo/dev\-tech\-crypto 1434 .PP 1435 IRC: Freenode at #dogtag\-pki 1436 .SH "AUTHORS" 1437 .PP 1438 The NSS tools were written and maintained by developers with Netscape, Red Hat, Sun, Oracle, Mozilla, and Google\&. 1439 .PP 1440 Authors: Elio Maldonado <emaldona@redhat\&.com>, Deon Lackey <dlackey@redhat\&.com>\&. 1441 .SH "LICENSE" 1442 .PP 1443 Licensed under the Mozilla Public License, v\&. 2\&.0\&. If a copy of the MPL was not distributed with this file, You can obtain one at http://mozilla\&.org/MPL/2\&.0/\&. 1444 .SH "NOTES" 1445 .IP " 1." 4 1446 Mozilla NSS bug 836477 1447 .RS 4 1448 \%https://bugzilla.mozilla.org/show_bug.cgi?id=836477 1449 .RE