547 lines
No EOL
31 KiB
ReStructuredText
547 lines
No EOL
31 KiB
ReStructuredText
.. _mozilla_projects_nss_tools_signtool:
|
|
|
|
NSS tools : signtool
|
|
====================
|
|
|
|
.. container::
|
|
|
|
| Name
|
|
| signtool — Digitally sign objects and files.
|
|
| Synopsis
|
|
| signtool [-k keyName] `-h <-h>`__ `-H <-H>`__ `-l <-l>`__ `-L <-L>`__ `-M <-M>`__
|
|
`-v <-v>`__ `-w <-w>`__
|
|
| `-G nickname <-G_nickname>`__ `-s size <--keysize>`__ `-b basename <-b_basename>`__ [[-c
|
|
Compression
|
|
| Level] ] [[-d cert-dir] ] [[-i installer script] ] [[-m metafile] ] [[-x
|
|
| name] ] [[-f filename] ] [[-t|--token tokenname] ] [[-e extension] ] [[-o]
|
|
| ] [[-z] ] [[-X] ] [[--outfile] ] [[--verbose value] ] [[--norecurse] ]
|
|
| [[--leavearc] ] [[-j directory] ] [[-Z jarfile] ] [[-O] ] [[-p password] ]
|
|
| [directory-tree] [archive]
|
|
| Description
|
|
| The Signing Tool, signtool, creates digital signatures and uses a Java
|
|
| Archive (JAR) file to associate the signatures with files in a directory.
|
|
| Electronic software distribution over any network involves potential
|
|
| security problems. To help address some of these problems, you can
|
|
| associate digital signatures with the files in a JAR archive. Digital
|
|
| signatures allow SSL-enabled clients to perform two important operations:
|
|
| \* Confirm the identity of the individual, company, or other entity whose
|
|
| digital signature is associated with the files
|
|
| \* Check whether the files have been tampered with since being signed
|
|
| If you have a signing certificate, you can use Netscape Signing Tool to
|
|
| digitally sign files and package them as a JAR file. An object-signing
|
|
| certificate is a special kind of certificate that allows you to associate
|
|
| your digital signature with one or more files.
|
|
| An individual file can potentially be signed with multiple digital
|
|
| signatures. For example, a commercial software developer might sign the
|
|
| files that constitute a software product to prove that the files are
|
|
| indeed from a particular company. A network administrator manager might
|
|
| sign the same files with an additional digital signature based on a
|
|
| company-generated certificate to indicate that the product is approved for
|
|
| use within the company.
|
|
| The significance of a digital signature is comparable to the significance
|
|
| of a handwritten signature. Once you have signed a file, it is difficult
|
|
| to claim later that you didn't sign it. In some situations, a digital
|
|
| signature may be considered as legally binding as a handwritten signature.
|
|
| Therefore, you should take great care to ensure that you can stand behind
|
|
| any file you sign and distribute.
|
|
| For example, if you are a software developer, you should test your code to
|
|
| make sure it is virus-free before signing it. Similarly, if you are a
|
|
| network administrator, you should make sure, before signing any code, that
|
|
| it comes from a reliable source and will run correctly with the software
|
|
| installed on the machines to which you are distributing it.
|
|
| Before you can use Netscape Signing Tool to sign files, you must have an
|
|
| object-signing certificate, which is a special certificate whose
|
|
| associated private key is used to create digital signatures. For testing
|
|
| purposes only, you can create an object-signing certificate with Netscape
|
|
| Signing Tool 1.3. When testing is finished and you are ready to
|
|
| disitribute your software, you should obtain an object-signing certificate
|
|
| from one of two kinds of sources:
|
|
| \* An independent certificate authority (CA) that authenticates your
|
|
| identity and charges you a fee. You typically get a certificate from an
|
|
| independent CA if you want to sign software that will be distributed over
|
|
| the Internet.
|
|
| \* CA server software running on your corporate intranet or extranet.
|
|
| Netscape Certificate Management System provides a complete management
|
|
| solution for creating, deploying, and managing certificates, including CAs
|
|
| that issue object-signing certificates.
|
|
| You must also have a certificate for the CA that issues your signing
|
|
| certificate before you can sign files. If the certificate authority's
|
|
| certificate isn't already installed in your copy of Communicator, you
|
|
| typically install it by clicking the appropriate link on the certificate
|
|
| authority's web site, for example on the page from which you initiated
|
|
| enrollment for your signing certificate. This is the case for some test
|
|
| certificates, as well as certificates issued by Netscape Certificate
|
|
| Management System: you must download the CA certificate in addition to
|
|
| obtaining your own signing certificate. CA certificates for several
|
|
| certificate authorities are preinstalled in the Communicator certificate
|
|
| database.
|
|
| When you receive an object-signing certificate for your own use, it is
|
|
| automatically installed in your copy of the Communicator client software.
|
|
| Communicator supports the public-key cryptography standard known as PKCS
|
|
| #12, which governs key portability. You can, for example, move an
|
|
| object-signing certificate and its associated private key from one
|
|
| computer to another on a credit-card-sized device called a smart card.
|
|
| Options
|
|
| -b basename
|
|
| Specifies the base filename for the .rsa and .sf files in the
|
|
| META-INF directory to conform with the JAR format. For example, -b
|
|
| signatures causes the files to be named signatures.rsa and
|
|
| signatures.sf. The default is signtool.
|
|
| -c#
|
|
| Specifies the compression level for the -J or -Z option. The
|
|
| symbol # represents a number from 0 to 9, where 0 means no
|
|
| compression and 9 means maximum compression. The higher the level
|
|
| of compression, the smaller the output but the longer the
|
|
| operation takes. If the -c# option is not used with either the -J
|
|
| or the -Z option, the default compression value used by both the
|
|
| -J and -Z options is 6.
|
|
| -d certdir
|
|
| Specifies your certificate database directory; that is, the
|
|
| directory in which you placed your key3.db and cert7.db files. To
|
|
| specify the current directory, use "-d." (including the period).
|
|
| The Unix version of signtool assumes ~/.netscape unless told
|
|
| otherwise. The NT version of signtool always requires the use of
|
|
| the -d option to specify where the database files are located.
|
|
| -e extension
|
|
| Tells signtool to sign only files with the given extension; for
|
|
| example, use -e".class" to sign only Java class files. Note that
|
|
| with Netscape Signing Tool version 1.1 and later this option can
|
|
| appear multiple times on one command line, making it possible to
|
|
| specify multiple file types or classes to include.
|
|
| -f commandfile
|
|
| Specifies a text file containing Netscape Signing Tool options and
|
|
| arguments in keyword=value format. All options and arguments can
|
|
| be expressed through this file. For more information about the
|
|
| syntax used with this file, see "Tips and Techniques".
|
|
| -i scriptname
|
|
| Specifies the name of an installer script for SmartUpdate. This
|
|
| script installs files from the JAR archive in the local system
|
|
| after SmartUpdate has validated the digital signature. For more
|
|
| details, see the description of -m that follows. The -i option
|
|
| provides a straightforward way to provide this information if you
|
|
| don't need to specify any metadata other than an installer script.
|
|
| -j directory
|
|
| Specifies a special JavaScript directory. This option causes the
|
|
| specified directory to be signed and tags its entries as inline
|
|
| JavaScript. This special type of entry does not have to appear in
|
|
| the JAR file itself. Instead, it is located in the HTML page
|
|
| containing the inline scripts. When you use signtool -v, these
|
|
| entries are displayed with the string NOT PRESENT.
|
|
| -k key ... directory
|
|
| Specifies the nickname (key) of the certificate you want to sign
|
|
| with and signs the files in the specified directory. The directory
|
|
| to sign is always specified as the last command-line argument.
|
|
| Thus, it is possible to write signtool -k MyCert -d . signdir You
|
|
| may have trouble if the nickname contains a single quotation mark.
|
|
| To avoid problems, escape the quotation mark using the escape
|
|
| conventions for your platform. It's also possible to use the -k
|
|
| option without signing any files or specifying a directory. For
|
|
| example, you can use it with the -l option to get detailed
|
|
| information about a particular signing certificate.
|
|
| -G nickname
|
|
| Generates a new private-public key pair and corresponding
|
|
| object-signing certificate with the given nickname. The newly
|
|
| generated keys and certificate are installed into the key and
|
|
| certificate databases in the directory specified by the -d option.
|
|
| With the NT version of Netscape Signing Tool, you must use the -d
|
|
| option with the -G option. With the Unix version of Netscape
|
|
| Signing Tool, omitting the -d option causes the tool to install
|
|
| the keys and certificate in the Communicator key and certificate
|
|
| databases. If you are installing the keys and certificate in the
|
|
| Communicator databases, you must exit Communicator before using
|
|
| this option; otherwise, you risk corrupting the databases. In all
|
|
| cases, the certificate is also output to a file named x509.cacert,
|
|
| which has the MIME-type application/x-x509-ca-cert. Unlike
|
|
| certificates normally used to sign finished code to be distributed
|
|
| over a network, a test certificate created with -G is not signed
|
|
| by a recognized certificate authority. Instead, it is self-signed.
|
|
| In addition, a single test signing certificate functions as both
|
|
| an object-signing certificate and a CA. When you are using it to
|
|
| sign objects, it behaves like an object-signing certificate. When
|
|
| it is imported into browser software such as Communicator, it
|
|
| behaves like an object-signing CA and cannot be used to sign
|
|
| objects. The -G option is available in Netscape Signing Tool 1.0
|
|
| and later versions only. By default, it produces only RSA
|
|
| certificates with 1024-byte keys in the internal token. However,
|
|
| you can use the -s option specify the required key size and the -t
|
|
| option to specify the token. For more information about the use of
|
|
| the -G option, see "Generating Test Object-Signing
|
|
| Certificates""Generating Test Object-Signing Certificates" on page
|
|
| 1241.
|
|
| -l
|
|
| Lists signing certificates, including issuing CAs. If any of your
|
|
| certificates are expired or invalid, the list will so specify.
|
|
| This option can be used with the -k option to list detailed
|
|
| information about a particular signing certificate. The -l option
|
|
| is available in Netscape Signing Tool 1.0 and later versions only.
|
|
| -J
|
|
| Signs a directory of HTML files containing JavaScript and creates
|
|
| as many archive files as are specified in the HTML tags. Even if
|
|
| signtool creates more than one archive file, you need to supply
|
|
| the key database password only once. The -J option is available
|
|
| only in Netscape Signing Tool 1.0 and later versions. The -J
|
|
| option cannot be used at the same time as the -Z option. If the
|
|
| -c# option is not used with the -J option, the default compression
|
|
| value is 6. Note that versions 1.1 and later of Netscape Signing
|
|
| Tool correctly recognizes the CODEBASE attribute, allows paths to
|
|
| be expressed for the CLASS and SRC attributes instead of filenames
|
|
| only, processes LINK tags and parses HTML correctly, and offers
|
|
| clearer error messages.
|
|
| -L
|
|
| Lists the certificates in your database. An asterisk appears to
|
|
| the left of the nickname for any certificate that can be used to
|
|
| sign objects with signtool.
|
|
| --leavearc
|
|
| Retains the temporary .arc (archive) directories that the -J
|
|
| option creates. These directories are automatically erased by
|
|
| default. Retaining the temporary directories can be an aid to
|
|
| debugging.
|
|
| -m metafile
|
|
| Specifies the name of a metadata control file. Metadata is signed
|
|
| information attached either to the JAR archive itself or to files
|
|
| within the archive. This metadata can be any ASCII string, but is
|
|
| used mainly for specifying an installer script. The metadata file
|
|
| contains one entry per line, each with three fields: field #1:
|
|
| file specification, or + if you want to specify global metadata
|
|
| (that is, metadata about the JAR archive itself or all entries in
|
|
| the archive) field #2: the name of the data you are specifying;
|
|
| for example: Install-Script field #3: data corresponding to the
|
|
| name in field #2 For example, the -i option uses the equivalent of
|
|
| this line: + Install-Script: script.js This example associates a
|
|
| MIME type with a file: movie.qt MIME-Type: video/quicktime For
|
|
| information about the way installer script information appears in
|
|
| the manifest file for a JAR archive, see The JAR Format on
|
|
| Netscape DevEdge.
|
|
| -M
|
|
| Lists the PKCS #11 modules available to signtool, including smart
|
|
| cards. The -M option is available in Netscape Signing Tool 1.0 and
|
|
| later versions only. For information on using Netscape Signing
|
|
| Tool with smart cards, see "Using Netscape Signing Tool with Smart
|
|
| Cards". For information on using the -M option to verify
|
|
| FIPS-140-1 validated mode, see "Netscape Signing Tool and
|
|
| FIPS-140-1".
|
|
| --norecurse
|
|
| Blocks recursion into subdirectories when signing a directory's
|
|
| contents or when parsing HTML.
|
|
| -o
|
|
| Optimizes the archive for size. Use this only if you are signing
|
|
| very large archives containing hundreds of files. This option
|
|
| makes the manifest files (required by the JAR format) considerably
|
|
| smaller, but they contain slightly less information.
|
|
| --outfile outputfile
|
|
| Specifies a file to receive redirected output from Netscape
|
|
| Signing Tool.
|
|
| -p password
|
|
| Specifies a password for the private-key database. Note that the
|
|
| password entered on the command line is displayed as plain text.
|
|
| -s keysize
|
|
| Specifies the size of the key for generated certificate. Use the
|
|
| -M option to find out what tokens are available. The -s option can
|
|
| be used with the -G option only.
|
|
| -t token
|
|
| Specifies which available token should generate the key and
|
|
| receive the certificate. Use the -M option to find out what tokens
|
|
| are available. The -t option can be used with the -G option only.
|
|
| -v archive
|
|
| Displays the contents of an archive and verifies the cryptographic
|
|
| integrity of the digital signatures it contains and the files with
|
|
| which they are associated. This includes checking that the
|
|
| certificate for the issuer of the object-signing certificate is
|
|
| listed in the certificate database, that the CA's digital
|
|
| signature on the object-signing certificate is valid, that the
|
|
| relevant certificates have not expired, and so on.
|
|
| --verbosity value
|
|
| Sets the quantity of information Netscape Signing Tool generates
|
|
| in operation. A value of 0 (zero) is the default and gives full
|
|
| information. A value of -1 suppresses most messages, but not error
|
|
| messages.
|
|
| -w archive
|
|
| Displays the names of signers of any files in the archive.
|
|
| -x directory
|
|
| Excludes the specified directory from signing. Note that with
|
|
| Netscape Signing Tool version 1.1 and later this option can appear
|
|
| multiple times on one command line, making it possible to specify
|
|
| several particular directories to exclude.
|
|
| -z
|
|
| Tells signtool not to store the signing time in the digital
|
|
| signature. This option is useful if you want the expiration date
|
|
| of the signature checked against the current date and time rather
|
|
| than the time the files were signed.
|
|
| -Z jarfile
|
|
| Creates a JAR file with the specified name. You must specify this
|
|
| option if you want signtool to create the JAR file; it does not do
|
|
| so automatically. If you don't specify -Z, you must use an
|
|
| external ZIP tool to create the JAR file. The -Z option cannot be
|
|
| used at the same time as the -J option. If the -c# option is not
|
|
| used with the -Z option, the default compression value is 6.
|
|
| The Command File Format
|
|
| Entries in a Netscape Signing Tool command file have this general format:
|
|
| keyword=value Everything before the = sign on a single line is a keyword,
|
|
| and everything from the = sign to the end of line is a value. The value
|
|
| may include = signs; only the first = sign on a line is interpreted. Blank
|
|
| lines are ignored, but white space on a line with keywords and values is
|
|
| assumed to be part of the keyword (if it comes before the equal sign) or
|
|
| part of the value (if it comes after the first equal sign). Keywords are
|
|
| case insensitive, values are generally case sensitive. Since the = sign
|
|
| and newline delimit the value, it should not be quoted.
|
|
| Subsection
|
|
| basename
|
|
| Same as -b option.
|
|
| compression
|
|
| Same as -c option.
|
|
| certdir
|
|
| Same as -d option.
|
|
| extension
|
|
| Same as -e option.
|
|
| generate
|
|
| Same as -G option.
|
|
| installscript
|
|
| Same as -i option.
|
|
| javascriptdir
|
|
| Same as -j option.
|
|
| htmldir
|
|
| Same as -J option.
|
|
| certname
|
|
| Nickname of certificate, as with -k and -l -k options.
|
|
| signdir
|
|
| The directory to be signed, as with -k option.
|
|
| list
|
|
| Same as -l option. Value is ignored, but = sign must be present.
|
|
| listall
|
|
| Same as -L option. Value is ignored, but = sign must be present.
|
|
| metafile
|
|
| Same as -m option.
|
|
| modules
|
|
| Same as -M option. Value is ignored, but = sign must be present.
|
|
| optimize
|
|
| Same as -o option. Value is ignored, but = sign must be present.
|
|
| password
|
|
| Same as -p option.
|
|
| keysize
|
|
| Same as -s option.
|
|
| token
|
|
| Same as -t option.
|
|
| verify
|
|
| Same as -v option.
|
|
| who
|
|
| Same as -w option.
|
|
| exclude
|
|
| Same as -x option.
|
|
| notime
|
|
| Same as -z option. value is ignored, but = sign must be present.
|
|
| jarfile
|
|
| Same as -Z option.
|
|
| outfile
|
|
| Name of a file to which output and error messages will be
|
|
| redirected. This option has no command-line equivalent.
|
|
| Extended Examples
|
|
| The following example will do this and that
|
|
| Listing Available Signing Certificates
|
|
| You use the -L option to list the nicknames for all available certificates
|
|
| and check which ones are signing certificates.
|
|
| signtool -L
|
|
| using certificate directory: /u/jsmith/.netscape
|
|
| S Certificates
|
|
| - ------------
|
|
| BBN Certificate Services CA Root 1
|
|
| IBM World Registry CA
|
|
| VeriSign Class 1 CA - Individual Subscriber - VeriSign, Inc.
|
|
| GTE CyberTrust Root CA
|
|
| Uptime Group Plc. Class 4 CA
|
|
| \* Verisign Object Signing Cert
|
|
| Integrion CA
|
|
| GTE CyberTrust Secure Server CA
|
|
| AT&T Directory Services
|
|
| \* test object signing cert
|
|
| Uptime Group Plc. Class 1 CA
|
|
| VeriSign Class 1 Primary CA
|
|
| - ------------
|
|
| Certificates that can be used to sign objects have \*'s to their left.
|
|
| Two signing certificates are displayed: Verisign Object Signing Cert and
|
|
| test object signing cert.
|
|
| You use the -l option to get a list of signing certificates only,
|
|
| including the signing CA for each.
|
|
| signtool -l
|
|
| using certificate directory: /u/jsmith/.netscape
|
|
| Object signing certificates
|
|
| ---------------------------------------
|
|
| Verisign Object Signing Cert
|
|
| Issued by: VeriSign, Inc. - Verisign, Inc.
|
|
| Expires: Tue May 19, 1998
|
|
| test object signing cert
|
|
| Issued by: test object signing cert (Signtool 1.0 Testing
|
|
| Certificate (960187691))
|
|
| Expires: Sun May 17, 1998
|
|
| ---------------------------------------
|
|
| For a list including CAs, use the -L option.
|
|
| Signing a File
|
|
| 1. Create an empty directory.
|
|
| mkdir signdir
|
|
| 2. Put some file into it.
|
|
| echo boo > signdir/test.f
|
|
| 3. Specify the name of your object-signing certificate and sign the
|
|
| directory.
|
|
| signtool -k MySignCert -Z testjar.jar signdir
|
|
| using key "MySignCert"
|
|
| using certificate directory: /u/jsmith/.netscape
|
|
| Generating signdir/META-INF/manifest.mf file..
|
|
| --> test.f
|
|
| adding signdir/test.f to testjar.jar
|
|
| Generating signtool.sf file..
|
|
| Enter Password or Pin for "Communicator Certificate DB":
|
|
| adding signdir/META-INF/manifest.mf to testjar.jar
|
|
| adding signdir/META-INF/signtool.sf to testjar.jar
|
|
| adding signdir/META-INF/signtool.rsa to testjar.jar
|
|
| tree "signdir" signed successfully
|
|
| 4. Test the archive you just created.
|
|
| signtool -v testjar.jar
|
|
| using certificate directory: /u/jsmith/.netscape
|
|
| archive "testjar.jar" has passed crypto verification.
|
|
| status path
|
|
| ------------ -------------------
|
|
| verified test.f
|
|
| Using Netscape Signing Tool with a ZIP Utility
|
|
| To use Netscape Signing Tool with a ZIP utility, you must have the utility
|
|
| in your path environment variable. You should use the zip.exe utility
|
|
| rather than pkzip.exe, which cannot handle long filenames. You can use a
|
|
| ZIP utility instead of the -Z option to package a signed archive into a
|
|
| JAR file after you have signed it:
|
|
| cd signdir
|
|
| zip -r ../myjar.jar \*
|
|
| adding: META-INF/ (stored 0%)
|
|
| adding: META-INF/manifest.mf (deflated 15%)
|
|
| adding: META-INF/signtool.sf (deflated 28%)
|
|
| adding: META-INF/signtool.rsa (stored 0%)
|
|
| adding: text.txt (stored 0%)
|
|
| Generating the Keys and Certificate
|
|
| The signtool option -G generates a new public-private key pair and
|
|
| certificate. It takes the nickname of the new certificate as an argument.
|
|
| The newly generated keys and certificate are installed into the key and
|
|
| certificate databases in the directory specified by the -d option. With
|
|
| the NT version of Netscape Signing Tool, you must use the -d option with
|
|
| the -G option. With the Unix version of Netscape Signing Tool, omitting
|
|
| the -d option causes the tool to install the keys and certificate in the
|
|
| Communicator key and certificate databases. In all cases, the certificate
|
|
| is also output to a file named x509.cacert, which has the MIME-type
|
|
| application/x-x509-ca-cert.
|
|
| Certificates contain standard information about the entity they identify,
|
|
| such as the common name and organization name. Netscape Signing Tool
|
|
| prompts you for this information when you run the command with the -G
|
|
| option. However, all of the requested fields are optional for test
|
|
| certificates. If you do not enter a common name, the tool provides a
|
|
| default name. In the following example, the user input is in boldface:
|
|
| signtool -G MyTestCert
|
|
| using certificate directory: /u/someuser/.netscape
|
|
| Enter certificate information. All fields are optional. Acceptable
|
|
| characters are numbers, letters, spaces, and apostrophes.
|
|
| certificate common name: Test Object Signing Certificate
|
|
| organization: Netscape Communications Corp.
|
|
| organization unit: Server Products Division
|
|
| state or province: California
|
|
| country (must be exactly 2 characters): US
|
|
| username: someuser
|
|
| email address: someuser@netscape.com
|
|
| Enter Password or Pin for "Communicator Certificate DB": [Password will not echo]
|
|
| generated public/private key pair
|
|
| certificate request generated
|
|
| certificate has been signed
|
|
| certificate "MyTestCert" added to database
|
|
| Exported certificate to x509.raw and x509.cacert.
|
|
| The certificate information is read from standard input. Therefore, the
|
|
| information can be read from a file using the redirection operator (<) in
|
|
| some operating systems. To create a file for this purpose, enter each of
|
|
| the seven input fields, in order, on a separate line. Make sure there is a
|
|
| newline character at the end of the last line. Then run signtool with
|
|
| standard input redirected from your file as follows:
|
|
| signtool -G MyTestCert inputfile
|
|
| The prompts show up on the screen, but the responses will be automatically
|
|
| read from the file. The password will still be read from the console
|
|
| unless you use the -p option to give the password on the command line.
|
|
| Using the -M Option to List Smart Cards
|
|
| You can use the -M option to list the PKCS #11 modules, including smart
|
|
| cards, that are available to signtool:
|
|
| signtool -d "c:\netscape\users\jsmith" -M
|
|
| using certificate directory: c:\netscape\users\username
|
|
| Listing of PKCS11 modules
|
|
| -----------------------------------------------
|
|
| 1. Netscape Internal PKCS #11 Module
|
|
| (this module is internally loaded)
|
|
| slots: 2 slots attached
|
|
| status: loaded
|
|
| slot: Communicator Internal Cryptographic Services Version 4.0
|
|
| token: Communicator Generic Crypto Svcs
|
|
| slot: Communicator User Private Key and Certificate Services
|
|
| token: Communicator Certificate DB
|
|
| 2. CryptOS
|
|
| (this is an external module)
|
|
| DLL name: core32
|
|
| slots: 1 slots attached
|
|
| status: loaded
|
|
| slot: Litronic 210
|
|
| token:
|
|
| -----------------------------------------------
|
|
| Using Netscape Signing Tool and a Smart Card to Sign Files
|
|
| The signtool command normally takes an argument of the -k option to
|
|
| specify a signing certificate. To sign with a smart card, you supply only
|
|
| the fully qualified name of the certificate.
|
|
| To see fully qualified certificate names when you run Communicator, click
|
|
| the Security button in Navigator, then click Yours under Certificates in
|
|
| the left frame. Fully qualified names are of the format smart
|
|
| card:certificate, for example "MyCard:My Signing Cert". You use this name
|
|
| with the -k argument as follows:
|
|
| signtool -k "MyCard:My Signing Cert" directory
|
|
| Verifying FIPS Mode
|
|
| Use the -M option to verify that you are using the FIPS-140-1 module.
|
|
| signtool -d "c:\netscape\users\jsmith" -M
|
|
| using certificate directory: c:\netscape\users\jsmith
|
|
| Listing of PKCS11 modules
|
|
| -----------------------------------------------
|
|
| 1. Netscape Internal PKCS #11 Module
|
|
| (this module is internally loaded)
|
|
| slots: 2 slots attached
|
|
| status: loaded
|
|
| slot: Communicator Internal Cryptographic Services Version 4.0
|
|
| token: Communicator Generic Crypto Svcs
|
|
| slot: Communicator User Private Key and Certificate Services
|
|
| token: Communicator Certificate DB
|
|
| -----------------------------------------------
|
|
| This Unix example shows that Netscape Signing Tool is using a FIPS-140-1
|
|
| module:
|
|
| signtool -d "c:\netscape\users\jsmith" -M
|
|
| using certificate directory: c:\netscape\users\jsmith
|
|
| Enter Password or Pin for "Communicator Certificate DB": [password will not echo]
|
|
| Listing of PKCS11 modules
|
|
| -----------------------------------------------
|
|
| 1. Netscape Internal FIPS PKCS #11 Module
|
|
| (this module is internally loaded)
|
|
| slots: 1 slots attached
|
|
| status: loaded
|
|
| slot: Netscape Internal FIPS-140-1 Cryptographic Services
|
|
| token: Communicator Certificate DB
|
|
| -----------------------------------------------
|
|
| See Also
|
|
| signver (1)
|
|
| The NSS wiki has information on the new database design and how to
|
|
| configure applications to use it.
|
|
| o https://wiki.mozilla.org/NSS_Shared_DB_Howto
|
|
| o https://wiki.mozilla.org/NSS_Shared_DB
|
|
| Additional Resources
|
|
| For information about NSS and other tools related to NSS (like JSS), check
|
|
| out the NSS project wiki at
|
|
|
|
|
[1]\ `http://www.mozilla.org/projects/security/pki/nss/ <https://www.mozilla.org/projects/security/pki/nss/>`__.
|
|
The NSS site relates
|
|
| directly to NSS code changes and releases.
|
|
| Mailing lists: https://lists.mozilla.org/listinfo/dev-tech-crypto
|
|
| IRC: Freenode at #dogtag-pki
|
|
| Authors
|
|
| The NSS tools were written and maintained by developers with Netscape, Red
|
|
| Hat, and Sun.
|
|
| Authors: Elio Maldonado <emaldona@redhat.com>, Deon Lackey
|
|
| <dlackey@redhat.com>.
|
|
| Copyright
|
|
| (c) 2010, Red Hat, Inc. Licensed under the GNU Public License version 2.
|
|
| References
|
|
| Visible links
|
|
| 1.
|
|
`http://www.mozilla.org/projects/security/pki/nss/ <https://www.mozilla.org/projects/security/pki/nss/>`__ |