Network Security Services - ArchWiki

# Network Security Services

From ArchWiki
Jump to navigation Jump to search

Network Security Services (NSS) is a set of libraries designed to support cross-platform development of security-enabled client and server applications.

Applications built with NSS can support SSL v2 and v3, TLS, PKCS #5, #7, PKCS #11, PKCS #12, S/MIME, X.509 v3 certificates, and other security standards.

NSS is required by many packages, including, for example, Chromium and Firefox.

## Installation

Install the nss package.

## Usage

Use certutil utility provided with NSS to manage your certificates.

### List certificate DB

To get list of all certificates:

    $ certutil -d sql:$HOME/.pki/nssdb -L

To get details about certificate:

    $ certutil -d sql:$HOME/.pki/nssdb -L -n certificate_nickname

### Generate an RSA private key

    $ certutil -G -d database_directory -g keysize -n nickname

### Generate a certificate signing request

    $ certutil -S -s subject -n nickname -x -t C,C,C -o file

### Generate a self-signed certificate

    $ certutil -S -s subject -n nickname -x -t C,C,C -o file

### Import certificate

To add a certificate specify the `-A` option:

    $ certutil -d sql:$HOME/.pki/nssdb -A -t "TRUSTARGS" -n certificate_nickname -i /path/to/cert/filename

The `TRUSTARGS` are three strings of zero or more alphabetic characters, separated by commas, for example: `"TCu,Cu,Tuw"`. They define how the certificate should be trusted for SSL, email, and object signing, and are explained in the certutil docs or Meena's blog post on trust flags.

To add a personal certificate and private key for SSL client authentication use the command:

    $ pk12util -d sql:$HOME/.pki/nssdb -i /path/to/PKCS12/cert/filename.p12

This will import a personal certificate and private key stored in a PKCS #12 file. The `TRUSTARGS` of the personal certificate will be set to `"u,u,u"`.

### Edit certificate

Call certutil with `-M` option to edit the certificate. For example, to edit the `TRUSTARGS`:

    $ certutil -d sql:$HOME/.pki/nssdb -M -t "TRUSTARGS" -n certificate_nickname

### Delete certificate

Use `-D` option to remove the certificate:

    $ certutil -d sql:$HOME/.pki/nssdb -D -n certificate_nickname

## See also

- Network Security Services - Mozilla
- Using the Certificate Database Tool - Mozilla
- Linux Cert Management - Chromium[dead link 2020-04-01 ⓘ]
- Managing Certificate Trust flags in NSS Database - Meena Vyas, Oracle

Categories:

- Transport Layer Security
- Mozilla

Hidden category:

- Pages with dead links