Re: how to create keystore by using NSS certutil (Hubert Kario

On Tuesday 18 August 2015 14:28:35 Kelly wrote:
> Thanks again.
>              i input the command you said, and it reply "Warning: ignoring
> private key. Consider to use pk12util" i want to know :
>       1, the cert has wrotten into it?

the one in the file

certutil can import just certificate, keys need to be imported from PKCS#12 
files

see pkcs12 man page for openssl utility that allows you to convert a PEM 
format cert and key pair to a pkcs12 file

then use pk12util to import it to NSS database

>       2, the cert i wrote has private key,  like format follow:
>                ------BEGIN CERTIFICATE-----
> 
>                ------END CERTIFICATE-----
>              ------BEGIN EC PRIVATE KEY-----
> 
>         ------END EC PRIVATE KEY-----
> 
> 
> how can i to deal with it?
> 

see above

> 3, can you help me to packaged the certutil tool into API function, then i
> can use it in my QT app?

sorry, I'm not familiar with C/C++ API of NSS, I can only suggest reading 
sources of certutil, pk12util and online documentation here: 
https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/Reference

> but i use command "certutil -L  -n  nick-name", it reply "certutil: function
> failed: SEC_ERROR_LEGACY_DATABASE: The certificate/key database is in old,
> unsupported format."

you need to always specify the database using -d otherwise you're using the 
default from ~/.netscape

Currently a user default database is stored in ~/.pki/nssdb

> how can i get the cert i wrote in?
> 
> 
> 
> i use command ""certutil -L -a  -n  nick-name  -d sql:./nssdb/"
>  it display the cert content with not private key

to export the key you must use pk12util, there's no other standard NSS tool to 
do that

>                                                         kelly
> 
> At 2015-08-17 19:15:33, "Hubert Kario" <[email protected]> wrote:
> >On Monday 17 August 2015 17:44:56 Kelly wrote:
> >> First,thank you.
> >> 
> >> i use the command you said "certutil -N -d sql:./nssdb/ "   but not with
> >> "--empty-password" it work ok.
> >> 
> >> and then i use  command  "certutil -A -d sql:./nssdb/ -n cert-nickname -a
> >> -i cert-in-ascii.pem" like "certutil -A -d sql:./nssdb/ -n cert-nickname
> >> -a -i>> 
> >>   /home/l/Desktop/ASUE1.cer" it said "certutil  -A: trust is required for
> >> 
> >> this command (-t)"
> >> and then i input "certutil -A -t -d sql:./nssdb/ -n cert-nickname -a -i
> >> /home/l/Desktop/ASUE1.cer" it reply "certutil: function failed:
> >> SEC_ERROR_LEGACY_DATABASE: The certificate/key database is in old,
> >> unsupported format."
> >
> >-t requires a parameter, try
> >
> >-t ',,'
> 
> 宝宝的进口奶粉纸尿裤，1元全包了
> 
> 
> 
> 宝宝的进口奶粉纸尿裤，1元全包了

-- 
Regards,
Hubert Kario
Quality Engineer, QE BaseOS Security team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purkyňova 99/71, 612 45, Brno, Czech Republic
_______________________________________________
dev-security mailing list
[email protected]
https://lists.mozilla.org/listinfo/dev-security