index.rst (11750B)
1 .. _mozilla_projects_nss_reference_nss_tools_:_crlutil: 2 3 NSS tools : crlutil 4 =================== 5 6 .. container:: 7 8 Name 9 10 | crlutil — List, generate, modify, or delete CRLs within the NSS security 11 | database file(s) and list, create, modify or delete certificates entries 12 | in a particular CRL. 13 14 Synopsis 15 16 crlutil [options] `[[arguments]] <arguments>`__ 17 18 | STATUS 19 | This documentation is still work in progress. Please contribute to the initial review in 20 Mozilla NSS bug 836477[1] 21 22 Description 23 24 | The Certificate Revocation List (CRL) Management Tool, crlutil, is a 25 | command-line utility that can list, generate, modify, or delete CRLs 26 | within the NSS security database file(s) and list, create, modify or 27 | delete certificates entries in a particular CRL. 28 29 | The key and certificate management process generally begins with creating 30 | keys in the key database, then generating and managing certificates in the 31 | certificate database(see certutil tool) and continues with certificates 32 | expiration or revocation. 33 34 | This document discusses certificate revocation list management. For 35 | information on security module database management, see Using the Security 36 | Module Database Tool. For information on certificate and key database 37 | management, see Using the Certificate Database Tool. 38 39 To run the Certificate Revocation List Management Tool, type the command 40 41 crlutil option [arguments] 42 43 | where options and arguments are combinations of the options and arguments 44 | listed in the following section. Each command takes one option. Each 45 | option may take zero or more arguments. To see a usage string, issue the 46 | command without options, or with the -H option. 47 48 Options and Arguments 49 50 Options 51 52 | Options specify an action. Option arguments modify an action. The options 53 | and arguments for the crlutil command are defined as follows: 54 55 -G 56 57 Create new Certificate Revocation List(CRL).- 58 59 -D 60 61 Delete Certificate Revocation List from cert database. 62 63 -I 64 65 Import a CRL to the cert database 66 67 -E 68 69 Erase all CRLs of specified type from the cert database 70 71 -L 72 73 List existing CRL located in cert database file. 74 75 -M 76 77 | Modify existing CRL which can be located in cert db or in 78 | arbitrary file. If located in file it should be encoded in ASN.1 79 | encode format. 80 81 -G 82 83 Arguments 84 85 Option arguments modify an action and are lowercase. 86 87 -B 88 89 Bypass CA signature checks. 90 91 -P dbprefix 92 93 | Specify the prefix used on the NSS security database files (for 94 | example, my_cert8.db and my_key3.db). This option is provided as a 95 | special case. Changing the names of the certificate and key 96 | databases is not recommended. 97 98 -a 99 100 | Use ASCII format or allow the use of ASCII format for input and 101 | output. This formatting follows RFC #1113. 102 103 -c crl-gen-file 104 105 | Specify script file that will be used to control crl 106 | generation/modification. See crl-cript-file format below. If 107 | options -M|-G is used and -c crl-script-file is not specified, 108 | crlutil will read script data from standard input. 109 110 -d directory 111 112 | Specify the database directory containing the certificate and key 113 | database files. On Unix the Certificate Database Tool defaults to 114 | $HOME/.netscape (that is, ~/.netscape). On Windows NT the default 115 | is the current directory. 116 117 The NSS database files must reside in the same directory. 118 119 -i crl-import-file 120 121 Specify the file which contains the CRL to import 122 123 -f password-file 124 125 | Specify a file that will automatically supply the password to 126 | include in a certificate or to access a certificate database. This 127 | is a plain-text file containing one password. Be sure to prevent 128 | unauthorized access to this file. 129 130 -l algorithm-name 131 132 | Specify a specific signature algorithm. List of possible 133 | algorithms: MD2 \| MD4 \| MD5 \| SHA1 \| SHA256 \| SHA384 \| SHA512 134 135 -n nickname 136 137 | Specify the nickname of a certificate or key to list, create, add 138 | to a database, modify, or validate. Bracket the nickname string 139 | with quotation marks if it contains spaces. 140 141 -o output-file 142 143 | Specify the output file name for new CRL. Bracket the output-file 144 | string with quotation marks if it contains spaces. If this 145 | argument is not used the output destination defaults to standard 146 | output. 147 148 -t crl-type 149 150 | Specify type of CRL. possible types are: 0 - SEC_KRL_TYPE, 1 - 151 | SEC_CRL_TYPE. This option is obsolete 152 153 -u url 154 155 Specify the url. 156 157 CRL Generation script syntax 158 159 CRL generation script file has the following syntax: 160 161 \* Line with comments should have # as a first symbol of a line 162 163 \* Set "this update" or "next update" CRL fields: 164 165 update=YYYYMMDDhhmmssZ nextupdate=YYYYMMDDhhmmssZ 166 167 | Field "next update" is optional. Time should be in GeneralizedTime format 168 | (YYYYMMDDhhmmssZ). For example: 20050204153000Z 169 170 \* Add an extension to a CRL or a crl certificate entry: 171 172 addext extension-name critical/non-critical [arg1[arg2 ...]] 173 174 Where: 175 176 | extension-name: string value of a name of known extensions. 177 | critical/non-critical: is 1 when extension is critical and 0 otherwise. 178 | arg1, arg2: specific to extension type extension parameters 179 180 | addext uses the range that was set earlier by addcert and will install an 181 | extension to every cert entries within the range. 182 183 \* Add certificate entries(s) to CRL: 184 185 addcert range date 186 187 | range: two integer values separated by dash: range of certificates that 188 | will be added by this command. dash is used as a delimiter. Only one cert 189 | will be added if there is no delimiter. date: revocation date of a cert. 190 | Date should be represented in GeneralizedTime format (YYYYMMDDhhmmssZ). 191 192 \* Remove certificate entry(s) from CRL 193 194 rmcert range 195 196 Where: 197 198 | range: two integer values separated by dash: range of certificates that 199 | will be added by this command. dash is used as a delimiter. Only one cert 200 | will be added if there is no delimiter. 201 202 \* Change range of certificate entry(s) in CRL 203 204 range new-range 205 206 Where: 207 208 | new-range: two integer values separated by dash: range of certificates 209 | that will be added by this command. dash is used as a delimiter. Only one 210 | cert will be added if there is no delimiter. 211 212 Implemented Extensions 213 214 | The extensions defined for CRL provide methods for associating additional 215 | attributes with CRLs of theirs entries. For more information see RFC #3280 216 217 \* Add The Authority Key Identifier extension: 218 219 | The authority key identifier extension provides a means of identifying the 220 | public key corresponding to the private key used to sign a CRL. 221 222 authKeyId critical [key-id \| dn cert-serial] 223 224 Where: 225 226 | authKeyIdent: identifies the name of an extension critical: value of 1 of 227 | 0. Should be set to 1 if this extension is critical or 0 otherwise. 228 | key-id: key identifier represented in octet string. dn:: is a CA 229 | distinguished name cert-serial: authority certificate serial number. 230 231 \* Add Issuer Alternative Name extension: 232 233 | The issuer alternative names extension allows additional identities to be 234 | associated with the issuer of the CRL. Defined options include an rfc822 235 | name (electronic mail address), a DNS name, an IP address, and a URI. 236 237 issuerAltNames non-critical name-list 238 239 Where: 240 241 | subjAltNames: identifies the name of an extension should be set to 0 since 242 | this is non-critical extension name-list: comma separated list of names 243 244 \* Add CRL Number extension: 245 246 | The CRL number is a non-critical CRL extension which conveys a 247 | monotonically increasing sequence number for a given CRL scope and CRL 248 | issuer. This extension allows users to easily determine when a particular 249 | CRL supersedes another CRL 250 251 crlNumber non-critical number 252 253 Where: 254 255 | crlNumber: identifies the name of an extension critical: should be set to 256 | 0 since this is non-critical extension number: value of long which 257 | identifies the sequential number of a CRL. 258 259 \* Add Revocation Reason Code extension: 260 261 | The reasonCode is a non-critical CRL entry extension that identifies the 262 | reason for the certificate revocation. 263 264 reasonCode non-critical code 265 266 Where: 267 268 | reasonCode: identifies the name of an extension non-critical: should be 269 | set to 0 since this is non-critical extension code: the following codes 270 | are available: 271 272 | unspecified (0), keyCompromise (1), cACompromise (2), affiliationChanged 273 | (3), superseded (4), cessationOfOperation (5), certificateHold (6), 274 | removeFromCRL (8), privilegeWithdrawn (9), aACompromise (10) 275 276 \* Add Invalidity Date extension: 277 278 | The invalidity date is a non-critical CRL entry extension that provides 279 | the date on which it is known or suspected that the private key was 280 | compromised or that the certificate otherwise became invalid. 281 282 invalidityDate non-critical date 283 284 Where: 285 286 | crlNumber: identifies the name of an extension non-critical: should be set 287 | to 0 since this is non-critical extension date: invalidity date of a cert. 288 | Date should be represented in GeneralizedTime format (YYYYMMDDhhmmssZ). 289 290 Usage 291 292 | The Certificate Revocation List Management Tool's capabilities are grouped 293 | as follows, using these combinations of options and arguments. Options and 294 | arguments in square brackets are optional, those without square brackets 295 | are required. 296 297 | See "Implemented extensions" for more information regarding extensions and 298 | their parameters. 299 300 \* Creating or modifying a CRL: 301 302 crlutil -G|-M -c crl-gen-file -n nickname [-i crl] [-u url] [-d keydir] [-P dbprefix] [-l alg] 303 [-a] [-B] 304 305 | 306 | \* Listing all CRls or a named CRL: 307 308 crlutil -L [-n crl-name] [-d krydir] 309 310 | 311 | \* Deleting CRL from db: 312 313 crlutil -D -n nickname [-d keydir] [-P dbprefix] 314 315 | 316 | \* Erasing CRLs from db: 317 318 crlutil -E [-d keydir] [-P dbprefix] 319 320 | 321 | \* Deleting CRL from db: 322 323 crlutil -D -n nickname [-d keydir] [-P dbprefix] 324 325 | 326 | \* Erasing CRLs from db: 327 328 crlutil -E [-d keydir] [-P dbprefix] 329 330 | 331 | \* Import CRL from file: 332 333 crlutil -I -i crl [-t crlType] [-u url] [-d keydir] [-P dbprefix] [-B] 334 335 | 336 | See also 337 338 certutil(1) 339 340 See Also 341 342 Additional Resources 343 344 | NSS is maintained in conjunction with PKI and security-related projects 345 | through Mozilla dn Fedora. The most closely-related project is Dogtag PKI, 346 | with a project wiki at [1]\ http://pki.fedoraproject.org/wiki/. 347 348 | For information specifically about NSS, the NSS project wiki is located at 349 | [2]\ `http://www.mozilla.org/projects/security/pki/nss/ <https://www.mozilla.org/projects/security/pki/nss/>`__. 350 The NSS site relates 351 | directly to NSS code changes and releases. 352 353 Mailing lists: pki-devel@redhat.com and pki-users@redhat.com 354 355 IRC: Freenode at #dogtag-pki 356 357 Authors 358 359 | The NSS tools were written and maintained by developers with Netscape, Red Hat, 360 | Sun, Oracle, Mozilla, and Google. 361 362 | Authors: Elio Maldonado <emaldona@redhat.com>, Deon Lackey 363 | <dlackey@redhat.com>. 364 365 License 366 367 Licensed under the Mozilla Public License, v. 2.0. 368 369 | If a copy of the MPL was not distributed with this file, You can 370 | obtain one at https://mozilla.org/MPL/2.0/. 371 372 References 373 374 1. Mozilla NSS bug 836477 - https://bugzilla.mozilla.org/show_bug.cgi?id=836477 375 376 | Visible links 377 | 1. http://pki.fedoraproject.org/wiki/ 378 | 2. 379 `http://www.mozilla.org/projects/security/pki/nss/ <https://www.mozilla.org/projects/security/pki/nss/>`__