pk12util.1 (19144B)
1 '\" t 2 .\" Title: PK12UTIL 3 .\" Author: [see the "Authors" section] 4 .\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/> 5 .\" Date: 19 May 2021 6 .\" Manual: NSS Security Tools 7 .\" Source: nss-tools 8 .\" Language: English 9 .\" 10 .TH "PK12UTIL" "1" "19 May 2021" "nss-tools" "NSS Security Tools" 11 .\" ----------------------------------------------------------------- 12 .\" * Define some portability stuff 13 .\" ----------------------------------------------------------------- 14 .\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 15 .\" http://bugs.debian.org/507673 16 .\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html 17 .\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 18 .ie \n(.g .ds Aq \(aq 19 .el .ds Aq ' 20 .\" ----------------------------------------------------------------- 21 .\" * set default formatting 22 .\" ----------------------------------------------------------------- 23 .\" disable hyphenation 24 .nh 25 .\" disable justification (adjust text to left margin only) 26 .ad l 27 .\" ----------------------------------------------------------------- 28 .\" * MAIN CONTENT STARTS HERE * 29 .\" ----------------------------------------------------------------- 30 .SH "NAME" 31 pk12util \- Export and import keys and certificate to or from a PKCS #12 file and the NSS database 32 .SH "SYNOPSIS" 33 .HP \w'\fBpk12util\fR\ 'u 34 \fBpk12util\fR [\-i\ p12File|\-l\ p12File|\-o\ p12File] [\-c\ keyCipher] [\-C\ certCipher] [\-d\ directory] [\-h\ tokenname] [\-m\ |\ \-\-key\-len\ keyLength] [\-M\ hashAlg] [\-n\ certname] [\-P\ dbprefix] [\-r] [\-v] [\-\-cert\-key\-len\ certKeyLength] [\-k\ slotPasswordFile|\-K\ slotPassword] [\-w\ p12filePasswordFile|\-W\ p12filePassword] 35 .SH "STATUS" 36 .PP 37 This documentation is still work in progress\&. Please contribute to the initial review in 38 \m[blue]\fBMozilla NSS bug 836477\fR\m[]\&\s-2\u[1]\d\s+2 39 .SH "DESCRIPTION" 40 .PP 41 The PKCS #12 utility, 42 \fBpk12util\fR, enables sharing certificates among any server that supports PKCS #12\&. The tool can import certificates and keys from PKCS #12 files into security databases, export certificates, and list certificates and keys\&. 43 .SH "OPTIONS AND ARGUMENTS" 44 .PP 45 \fBOptions\fR 46 .PP 47 \-i p12file 48 .RS 4 49 Import keys and certificates from a PKCS #12 file into a security database\&. 50 .RE 51 .PP 52 \-l p12file 53 .RS 4 54 List the keys and certificates in PKCS #12 file\&. 55 .RE 56 .PP 57 \-o p12file 58 .RS 4 59 Export keys and certificates from the security database to a PKCS #12 file\&. 60 .RE 61 .PP 62 \fBArguments\fR 63 .PP 64 \-c keyCipher 65 .RS 4 66 Specify the key encryption algorithm\&. 67 .RE 68 .PP 69 \-C certCipher 70 .RS 4 71 Specify the certiticate encryption algorithm\&. 72 .RE 73 .PP 74 \-d directory 75 .RS 4 76 Specify the database directory into which to import to or export from certificates and keys\&. 77 .sp 78 \fBpk12util\fR 79 supports two types of databases: the legacy security databases (cert8\&.db, 80 key3\&.db, and 81 secmod\&.db) and new SQLite databases (cert9\&.db, 82 key4\&.db, and 83 pkcs11\&.txt)\&. If the prefix 84 \fBdbm:\fR 85 is not used, then the tool assumes that the given databases are in the SQLite format\&. 86 .RE 87 .PP 88 \-h tokenname 89 .RS 4 90 Specify the name of the token to import into or export from\&. 91 .RE 92 .PP 93 \-k slotPasswordFile 94 .RS 4 95 Specify the text file containing the slot\*(Aqs password\&. 96 .RE 97 .PP 98 \-K slotPassword 99 .RS 4 100 Specify the slot\*(Aqs password\&. 101 .RE 102 .PP 103 \-m | \-\-key\-len keyLength 104 .RS 4 105 Specify the desired length of the symmetric key to be used to encrypt the private key\&. 106 .RE 107 .PP 108 \-M hashAlg 109 .RS 4 110 Specify the hash algorithm used in the pkcs #12 mac\&. This algorithm also specifies the HMAC used in the prf when using pkcs #5 v2\&. 111 .RE 112 .PP 113 \-\-cert\-key\-len certKeyLength 114 .RS 4 115 Specify the desired length of the symmetric key to be used to encrypt the certificates and other meta\-data\&. 116 .RE 117 .PP 118 \-n certname 119 .RS 4 120 Specify the nickname of the cert and private key to export\&. 121 .sp 122 The nickname can also be a PKCS #11 URI\&. For example, if you have a certificate named "my\-server\-cert" on the internal certificate store, it can be unambiguously specified as "pkcs11:token=NSS%20Certificate%20DB;object=my\-server\-cert"\&. For details about the format, see RFC 7512\&. 123 .RE 124 .PP 125 \-P prefix 126 .RS 4 127 Specify the prefix used on the certificate and key databases\&. This option is provided as a special case\&. Changing the names of the certificate and key databases is not recommended\&. 128 .RE 129 .PP 130 \-r 131 .RS 4 132 Dumps all of the data in raw (binary) form\&. This must be saved as a DER file\&. The default is to return information in a pretty\-print ASCII format, which displays the information about the certificates and public keys in the p12 file\&. 133 .RE 134 .PP 135 \-v 136 .RS 4 137 Enable debug logging when importing\&. 138 .RE 139 .PP 140 \-w p12filePasswordFile 141 .RS 4 142 Specify the text file containing the pkcs #12 file password\&. 143 .RE 144 .PP 145 \-W p12filePassword 146 .RS 4 147 Specify the pkcs #12 file password\&. 148 .RE 149 .SH "RETURN CODES" 150 .sp 151 .RS 4 152 .ie n \{\ 153 \h'-04'\(bu\h'+03'\c 154 .\} 155 .el \{\ 156 .sp -1 157 .IP \(bu 2.3 158 .\} 159 0 \- No error 160 .RE 161 .sp 162 .RS 4 163 .ie n \{\ 164 \h'-04'\(bu\h'+03'\c 165 .\} 166 .el \{\ 167 .sp -1 168 .IP \(bu 2.3 169 .\} 170 1 \- User Cancelled 171 .RE 172 .sp 173 .RS 4 174 .ie n \{\ 175 \h'-04'\(bu\h'+03'\c 176 .\} 177 .el \{\ 178 .sp -1 179 .IP \(bu 2.3 180 .\} 181 2 \- Usage error 182 .RE 183 .sp 184 .RS 4 185 .ie n \{\ 186 \h'-04'\(bu\h'+03'\c 187 .\} 188 .el \{\ 189 .sp -1 190 .IP \(bu 2.3 191 .\} 192 6 \- NLS init error 193 .RE 194 .sp 195 .RS 4 196 .ie n \{\ 197 \h'-04'\(bu\h'+03'\c 198 .\} 199 .el \{\ 200 .sp -1 201 .IP \(bu 2.3 202 .\} 203 8 \- Certificate DB open error 204 .RE 205 .sp 206 .RS 4 207 .ie n \{\ 208 \h'-04'\(bu\h'+03'\c 209 .\} 210 .el \{\ 211 .sp -1 212 .IP \(bu 2.3 213 .\} 214 9 \- Key DB open error 215 .RE 216 .sp 217 .RS 4 218 .ie n \{\ 219 \h'-04'\(bu\h'+03'\c 220 .\} 221 .el \{\ 222 .sp -1 223 .IP \(bu 2.3 224 .\} 225 10 \- File initialization error 226 .RE 227 .sp 228 .RS 4 229 .ie n \{\ 230 \h'-04'\(bu\h'+03'\c 231 .\} 232 .el \{\ 233 .sp -1 234 .IP \(bu 2.3 235 .\} 236 11 \- Unicode conversion error 237 .RE 238 .sp 239 .RS 4 240 .ie n \{\ 241 \h'-04'\(bu\h'+03'\c 242 .\} 243 .el \{\ 244 .sp -1 245 .IP \(bu 2.3 246 .\} 247 12 \- Temporary file creation error 248 .RE 249 .sp 250 .RS 4 251 .ie n \{\ 252 \h'-04'\(bu\h'+03'\c 253 .\} 254 .el \{\ 255 .sp -1 256 .IP \(bu 2.3 257 .\} 258 13 \- PKCS11 get slot error 259 .RE 260 .sp 261 .RS 4 262 .ie n \{\ 263 \h'-04'\(bu\h'+03'\c 264 .\} 265 .el \{\ 266 .sp -1 267 .IP \(bu 2.3 268 .\} 269 14 \- PKCS12 decoder start error 270 .RE 271 .sp 272 .RS 4 273 .ie n \{\ 274 \h'-04'\(bu\h'+03'\c 275 .\} 276 .el \{\ 277 .sp -1 278 .IP \(bu 2.3 279 .\} 280 15 \- error read from import file 281 .RE 282 .sp 283 .RS 4 284 .ie n \{\ 285 \h'-04'\(bu\h'+03'\c 286 .\} 287 .el \{\ 288 .sp -1 289 .IP \(bu 2.3 290 .\} 291 16 \- pkcs12 decode error 292 .RE 293 .sp 294 .RS 4 295 .ie n \{\ 296 \h'-04'\(bu\h'+03'\c 297 .\} 298 .el \{\ 299 .sp -1 300 .IP \(bu 2.3 301 .\} 302 17 \- pkcs12 decoder verify error 303 .RE 304 .sp 305 .RS 4 306 .ie n \{\ 307 \h'-04'\(bu\h'+03'\c 308 .\} 309 .el \{\ 310 .sp -1 311 .IP \(bu 2.3 312 .\} 313 18 \- pkcs12 decoder validate bags error 314 .RE 315 .sp 316 .RS 4 317 .ie n \{\ 318 \h'-04'\(bu\h'+03'\c 319 .\} 320 .el \{\ 321 .sp -1 322 .IP \(bu 2.3 323 .\} 324 19 \- pkcs12 decoder import bags error 325 .RE 326 .sp 327 .RS 4 328 .ie n \{\ 329 \h'-04'\(bu\h'+03'\c 330 .\} 331 .el \{\ 332 .sp -1 333 .IP \(bu 2.3 334 .\} 335 20 \- key db conversion version 3 to version 2 error 336 .RE 337 .sp 338 .RS 4 339 .ie n \{\ 340 \h'-04'\(bu\h'+03'\c 341 .\} 342 .el \{\ 343 .sp -1 344 .IP \(bu 2.3 345 .\} 346 21 \- cert db conversion version 7 to version 5 error 347 .RE 348 .sp 349 .RS 4 350 .ie n \{\ 351 \h'-04'\(bu\h'+03'\c 352 .\} 353 .el \{\ 354 .sp -1 355 .IP \(bu 2.3 356 .\} 357 22 \- cert and key dbs patch error 358 .RE 359 .sp 360 .RS 4 361 .ie n \{\ 362 \h'-04'\(bu\h'+03'\c 363 .\} 364 .el \{\ 365 .sp -1 366 .IP \(bu 2.3 367 .\} 368 23 \- get default cert db error 369 .RE 370 .sp 371 .RS 4 372 .ie n \{\ 373 \h'-04'\(bu\h'+03'\c 374 .\} 375 .el \{\ 376 .sp -1 377 .IP \(bu 2.3 378 .\} 379 24 \- find cert by nickname error 380 .RE 381 .sp 382 .RS 4 383 .ie n \{\ 384 \h'-04'\(bu\h'+03'\c 385 .\} 386 .el \{\ 387 .sp -1 388 .IP \(bu 2.3 389 .\} 390 25 \- create export context error 391 .RE 392 .sp 393 .RS 4 394 .ie n \{\ 395 \h'-04'\(bu\h'+03'\c 396 .\} 397 .el \{\ 398 .sp -1 399 .IP \(bu 2.3 400 .\} 401 26 \- PKCS12 add password itegrity error 402 .RE 403 .sp 404 .RS 4 405 .ie n \{\ 406 \h'-04'\(bu\h'+03'\c 407 .\} 408 .el \{\ 409 .sp -1 410 .IP \(bu 2.3 411 .\} 412 27 \- cert and key Safes creation error 413 .RE 414 .sp 415 .RS 4 416 .ie n \{\ 417 \h'-04'\(bu\h'+03'\c 418 .\} 419 .el \{\ 420 .sp -1 421 .IP \(bu 2.3 422 .\} 423 28 \- PKCS12 add cert and key error 424 .RE 425 .sp 426 .RS 4 427 .ie n \{\ 428 \h'-04'\(bu\h'+03'\c 429 .\} 430 .el \{\ 431 .sp -1 432 .IP \(bu 2.3 433 .\} 434 29 \- PKCS12 encode error 435 .RE 436 .SH "EXAMPLES" 437 .PP 438 \fBImporting Keys and Certificates\fR 439 .PP 440 The most basic usage of 441 \fBpk12util\fR 442 for importing a certificate or key is the PKCS #12 input file (\fB\-i\fR) and some way to specify the security database being accessed (either 443 \fB\-d\fR 444 for a directory or 445 \fB\-h\fR 446 for a token)\&. 447 .PP 448 pk12util \-i p12File [\-h tokenname] [\-v] [\-d directory] [\-P dbprefix] [\-k slotPasswordFile|\-K slotPassword] [\-w p12filePasswordFile|\-W p12filePassword] 449 .PP 450 For example: 451 .PP 452 453 .sp 454 .if n \{\ 455 .RS 4 456 .\} 457 .nf 458 # pk12util \-i /tmp/cert\-files/users\&.p12 \-d /home/my/sharednssdb 459 460 Enter a password which will be used to encrypt your keys\&. 461 The password should be at least 8 characters long, 462 and should contain at least one non\-alphabetic character\&. 463 464 Enter new password: 465 Re\-enter password: 466 Enter password for PKCS12 file: 467 pk12util: PKCS12 IMPORT SUCCESSFUL 468 .fi 469 .if n \{\ 470 .RE 471 .\} 472 .PP 473 \fBExporting Keys and Certificates\fR 474 .PP 475 Using the 476 \fBpk12util\fR 477 command to export certificates and keys requires both the name of the certificate to extract from the database (\fB\-n\fR) and the PKCS #12\-formatted output file to write to\&. There are optional parameters that can be used to encrypt the file to protect the certificate material\&. 478 .PP 479 pk12util \-o p12File \-n certname [\-c keyCipher] [\-C certCipher] [\-m|\-\-key_len keyLen] [\-n|\-\-cert_key_len certKeyLen] [\-d directory] [\-P dbprefix] [\-k slotPasswordFile|\-K slotPassword] [\-w p12filePasswordFile|\-W p12filePassword] 480 .PP 481 For example: 482 .sp 483 .if n \{\ 484 .RS 4 485 .\} 486 .nf 487 # pk12util \-o certs\&.p12 \-n Server\-Cert \-d /home/my/sharednssdb 488 Enter password for PKCS12 file: 489 Re\-enter password: 490 .fi 491 .if n \{\ 492 .RE 493 .\} 494 .PP 495 \fBListing Keys and Certificates\fR 496 .PP 497 The information in a 498 \&.p12 499 file are not human\-readable\&. The certificates and keys in the file can be printed (listed) in a human\-readable pretty\-print format that shows information for every certificate and any public keys in the 500 \&.p12 501 file\&. 502 .PP 503 pk12util \-l p12File [\-h tokenname] [\-r] [\-d directory] [\-P dbprefix] [\-k slotPasswordFile|\-K slotPassword] [\-w p12filePasswordFile|\-W p12filePassword] 504 .PP 505 For example, this prints the default ASCII output: 506 .sp 507 .if n \{\ 508 .RS 4 509 .\} 510 .nf 511 # pk12util \-l certs\&.p12 512 513 Enter password for PKCS12 file: 514 Key(shrouded): 515 Friendly Name: Thawte Freemail Member\*(Aqs Thawte Consulting (Pty) Ltd\&. ID 516 517 Encryption algorithm: PKCS #12 V2 PBE With SHA\-1 And 3KEY Triple DES\-CBC 518 Parameters: 519 Salt: 520 45:2e:6a:a0:03:4d:7b:a1:63:3c:15:ea:67:37:62:1f 521 Iteration Count: 1 (0x1) 522 Certificate: 523 Data: 524 Version: 3 (0x2) 525 Serial Number: 13 (0xd) 526 Signature Algorithm: PKCS #1 SHA\-1 With RSA Encryption 527 Issuer: "E=personal\-freemail@thawte\&.com,CN=Thawte Personal Freemail C 528 A,OU=Certification Services Division,O=Thawte Consulting,L=Cape T 529 own,ST=Western Cape,C=ZA" 530 531 .fi 532 .if n \{\ 533 .RE 534 .\} 535 .PP 536 Alternatively, the 537 \fB\-r\fR 538 prints the certificates and then exports them into separate DER binary files\&. This allows the certificates to be fed to another application that supports 539 \&.p12 540 files\&. Each certificate is written to a sequentially\-number file, beginning with 541 file0001\&.der 542 and continuing through 543 file000N\&.der, incrementing the number for every certificate: 544 .sp 545 .if n \{\ 546 .RS 4 547 .\} 548 .nf 549 pk12util \-l test\&.p12 \-r 550 Enter password for PKCS12 file: 551 Key(shrouded): 552 Friendly Name: Thawte Freemail Member\*(Aqs Thawte Consulting (Pty) Ltd\&. ID 553 554 Encryption algorithm: PKCS #12 V2 PBE With SHA\-1 And 3KEY Triple DES\-CBC 555 Parameters: 556 Salt: 557 45:2e:6a:a0:03:4d:7b:a1:63:3c:15:ea:67:37:62:1f 558 Iteration Count: 1 (0x1) 559 Certificate Friendly Name: Thawte Personal Freemail Issuing CA \- Thawte Consulting 560 561 Certificate Friendly Name: Thawte Freemail Member\*(Aqs Thawte Consulting (Pty) Ltd\&. ID 562 563 .fi 564 .if n \{\ 565 .RE 566 .\} 567 .SH "PASSWORD ENCRYPTION" 568 .PP 569 PKCS #12 provides for not only the protection of the private keys but also the certificate and meta\-data associated with the keys\&. Password\-based encryption is used to protect private keys on export to a PKCS #12 file and, optionally, the associated certificates\&. If no algorithm is specified, the tool defaults to using PKCS #12 SHA\-1 and 3\-key triple DES for private key encryption\&. When not in FIPS mode, PKCS #12 SHA\-1 and 40\-bit RC4 is used for certificate encryption\&. When in FIPS mode, there is no certificate encryption\&. If certificate encryption is not wanted, specify 570 \fB"NONE"\fR 571 as the argument of the 572 \fB\-C\fR 573 option\&. 574 .PP 575 The private key is always protected with strong encryption by default\&. 576 .PP 577 Several types of ciphers are supported\&. 578 .PP 579 PKCS #5 password\-based encryption 580 .RS 4 581 .sp 582 .RS 4 583 .ie n \{\ 584 \h'-04'\(bu\h'+03'\c 585 .\} 586 .el \{\ 587 .sp -1 588 .IP \(bu 2.3 589 .\} 590 PBES2 with AES\-CBC\-Pad as underlying encryption scheme (\fB"AES\-128\-CBC"\fR, 591 \fB"AES\-192\-CBC"\fR, and 592 \fB"AES\-256\-CBC"\fR) 593 .RE 594 .RE 595 .PP 596 PKCS #12 password\-based encryption 597 .RS 4 598 .sp 599 .RS 4 600 .ie n \{\ 601 \h'-04'\(bu\h'+03'\c 602 .\} 603 .el \{\ 604 .sp -1 605 .IP \(bu 2.3 606 .\} 607 SHA\-1 and 128\-bit RC4 (\fB"PKCS #12 V2 PBE With SHA\-1 And 128 Bit RC4"\fR 608 or 609 \fB"RC4"\fR) 610 .RE 611 .sp 612 .RS 4 613 .ie n \{\ 614 \h'-04'\(bu\h'+03'\c 615 .\} 616 .el \{\ 617 .sp -1 618 .IP \(bu 2.3 619 .\} 620 SHA\-1 and 40\-bit RC4 (\fB"PKCS #12 V2 PBE With SHA\-1 And 40 Bit RC4"\fR) (used by default for certificate encryption in non\-FIPS mode) 621 .RE 622 .sp 623 .RS 4 624 .ie n \{\ 625 \h'-04'\(bu\h'+03'\c 626 .\} 627 .el \{\ 628 .sp -1 629 .IP \(bu 2.3 630 .\} 631 SHA\-1 and 3\-key triple\-DES (\fB"PKCS #12 V2 PBE With SHA\-1 And 3KEY Triple DES\-CBC"\fR 632 or 633 \fB"DES\-EDE3\-CBC"\fR) 634 .RE 635 .sp 636 .RS 4 637 .ie n \{\ 638 \h'-04'\(bu\h'+03'\c 639 .\} 640 .el \{\ 641 .sp -1 642 .IP \(bu 2.3 643 .\} 644 SHA\-1 and 128\-bit RC2 (\fB"PKCS #12 V2 PBE With SHA\-1 And 128 Bit RC2 CBC"\fR 645 or 646 \fB"RC2\-CBC"\fR) 647 .RE 648 .sp 649 .RS 4 650 .ie n \{\ 651 \h'-04'\(bu\h'+03'\c 652 .\} 653 .el \{\ 654 .sp -1 655 .IP \(bu 2.3 656 .\} 657 SHA\-1 and 40\-bit RC2 (\fB"PKCS #12 V2 PBE With SHA\-1 And 40 Bit RC2 CBC"\fR) 658 .RE 659 .RE 660 .PP 661 With PKCS #12, the crypto provider may be the soft token module or an external hardware module\&. If the cryptographic module does not support the requested algorithm, then the next best fit will be selected (usually the default)\&. If no suitable replacement for the desired algorithm can be found, the tool returns the error 662 \fIno security module can perform the requested operation\fR\&. 663 .SH "NSS DATABASE TYPES" 664 .PP 665 NSS originally used BerkeleyDB databases to store security information\&. The last versions of these 666 \fIlegacy\fR 667 databases are: 668 .sp 669 .RS 4 670 .ie n \{\ 671 \h'-04'\(bu\h'+03'\c 672 .\} 673 .el \{\ 674 .sp -1 675 .IP \(bu 2.3 676 .\} 677 cert8\&.db for certificates 678 .RE 679 .sp 680 .RS 4 681 .ie n \{\ 682 \h'-04'\(bu\h'+03'\c 683 .\} 684 .el \{\ 685 .sp -1 686 .IP \(bu 2.3 687 .\} 688 key3\&.db for keys 689 .RE 690 .sp 691 .RS 4 692 .ie n \{\ 693 \h'-04'\(bu\h'+03'\c 694 .\} 695 .el \{\ 696 .sp -1 697 .IP \(bu 2.3 698 .\} 699 secmod\&.db for PKCS #11 module information 700 .RE 701 .PP 702 BerkeleyDB has performance limitations, though, which prevent it from being easily used by multiple applications simultaneously\&. NSS has some flexibility that allows applications to use their own, independent database engine while keeping a shared database and working around the access issues\&. Still, NSS requires more flexibility to provide a truly shared security database\&. 703 .PP 704 In 2009, NSS introduced a new set of databases that are SQLite databases rather than BerkleyDB\&. These new databases provide more accessibility and performance: 705 .sp 706 .RS 4 707 .ie n \{\ 708 \h'-04'\(bu\h'+03'\c 709 .\} 710 .el \{\ 711 .sp -1 712 .IP \(bu 2.3 713 .\} 714 cert9\&.db for certificates 715 .RE 716 .sp 717 .RS 4 718 .ie n \{\ 719 \h'-04'\(bu\h'+03'\c 720 .\} 721 .el \{\ 722 .sp -1 723 .IP \(bu 2.3 724 .\} 725 key4\&.db for keys 726 .RE 727 .sp 728 .RS 4 729 .ie n \{\ 730 \h'-04'\(bu\h'+03'\c 731 .\} 732 .el \{\ 733 .sp -1 734 .IP \(bu 2.3 735 .\} 736 pkcs11\&.txt, which is listing of all of the PKCS #11 modules contained in a new subdirectory in the security databases directory 737 .RE 738 .PP 739 Because the SQLite databases are designed to be shared, these are the 740 \fIshared\fR 741 database type\&. The shared database type is preferred; the legacy format is included for backward compatibility\&. 742 .PP 743 By default, the tools (\fBcertutil\fR, 744 \fBpk12util\fR, 745 \fBmodutil\fR) assume that the given security databases use the SQLite type Using the legacy databases must be manually specified by using the 746 \fBdbm:\fR 747 prefix with the given security directory\&. For example: 748 .sp 749 .if n \{\ 750 .RS 4 751 .\} 752 .nf 753 # pk12util \-i /tmp/cert\-files/users\&.p12 \-d dbm:/home/my/sharednssdb 754 .fi 755 .if n \{\ 756 .RE 757 .\} 758 .PP 759 To set the legacy database type as the default type for the tools, set the 760 \fBNSS_DEFAULT_DB_TYPE\fR 761 environment variable to 762 \fBdbm\fR: 763 .sp 764 .if n \{\ 765 .RS 4 766 .\} 767 .nf 768 export NSS_DEFAULT_DB_TYPE="dbm" 769 .fi 770 .if n \{\ 771 .RE 772 .\} 773 .PP 774 This line can be set added to the 775 ~/\&.bashrc 776 file to make the change permanent\&. 777 .sp 778 .RS 4 779 .ie n \{\ 780 \h'-04'\(bu\h'+03'\c 781 .\} 782 .el \{\ 783 .sp -1 784 .IP \(bu 2.3 785 .\} 786 https://wiki\&.mozilla\&.org/NSS_Shared_DB_Howto 787 .RE 788 .PP 789 For an engineering draft on the changes in the shared NSS databases, see the NSS project wiki: 790 .sp 791 .RS 4 792 .ie n \{\ 793 \h'-04'\(bu\h'+03'\c 794 .\} 795 .el \{\ 796 .sp -1 797 .IP \(bu 2.3 798 .\} 799 https://wiki\&.mozilla\&.org/NSS_Shared_DB 800 .RE 801 .SH "COMPATIBILITY NOTES" 802 .PP 803 The exporting behavior of 804 \fBpk12util\fR 805 has changed over time, while importing files exported with older versions of NSS is still supported\&. 806 .PP 807 Until the 3\&.30 release, 808 \fBpk12util\fR 809 used the UTF\-16 encoding for the PKCS #5 password\-based encryption schemes, while the recommendation is to encode passwords in UTF\-8 if the used encryption scheme is defined outside of the PKCS #12 standard\&. 810 .PP 811 Until the 3\&.31 release, even when 812 \fB"AES\-128\-CBC"\fR 813 or 814 \fB"AES\-192\-CBC"\fR 815 is given from the command line, 816 \fBpk12util\fR 817 always used 256\-bit AES as the underlying encryption scheme\&. 818 .PP 819 For historical reasons, 820 \fBpk12util\fR 821 accepts password\-based encryption schemes not listed in this document\&. However, those schemes are not officially supported and may have issues in interoperability with other tools\&. 822 .SH "SEE ALSO" 823 .PP 824 certutil (1) 825 .PP 826 modutil (1) 827 .PP 828 The NSS wiki has information on the new database design and how to configure applications to use it\&. 829 .sp 830 .RS 4 831 .ie n \{\ 832 \h'-04'\(bu\h'+03'\c 833 .\} 834 .el \{\ 835 .sp -1 836 .IP \(bu 2.3 837 .\} 838 https://wiki\&.mozilla\&.org/NSS_Shared_DB_Howto 839 .RE 840 .sp 841 .RS 4 842 .ie n \{\ 843 \h'-04'\(bu\h'+03'\c 844 .\} 845 .el \{\ 846 .sp -1 847 .IP \(bu 2.3 848 .\} 849 https://wiki\&.mozilla\&.org/NSS_Shared_DB 850 .RE 851 .SH "ADDITIONAL RESOURCES" 852 .PP 853 For information about NSS and other tools related to NSS (like JSS), check out the NSS project wiki at 854 \m[blue]\fBhttp://www\&.mozilla\&.org/projects/security/pki/nss/\fR\m[]\&. The NSS site relates directly to NSS code changes and releases\&. 855 .PP 856 Mailing lists: https://lists\&.mozilla\&.org/listinfo/dev\-tech\-crypto 857 .PP 858 IRC: Freenode at #dogtag\-pki 859 .SH "AUTHORS" 860 .PP 861 The NSS tools were written and maintained by developers with Netscape, Red Hat, Sun, Oracle, Mozilla, and Google\&. 862 .PP 863 Authors: Elio Maldonado <emaldona@redhat\&.com>, Deon Lackey <dlackey@redhat\&.com>\&. 864 .SH "LICENSE" 865 .PP 866 Licensed under the Mozilla Public License, v\&. 2\&.0\&. If a copy of the MPL was not distributed with this file, You can obtain one at http://mozilla\&.org/MPL/2\&.0/\&. 867 .SH "NOTES" 868 .IP " 1." 4 869 Mozilla NSS bug 836477 870 .RS 4 871 \%https://bugzilla.mozilla.org/show_bug.cgi?id=836477 872 .RE