# Network Security Services

From ArchWiki
Jump to navigation Jump to search
The printable version is no longer supported and may have rendering errors. Please update your browser bookmarks and please use the default browser print function instead.

Network Security Services (NSS) is a set of libraries designed to support cross-platform development of security-enabled client and server applications.

Applications built with NSS can support SSL v2 and v3, TLS, PKCS #5, #7, PKCS #11, PKCS #12, S/MIME, X.509 v3 certificates, and other security standards.

NSS is required by many packages, including, for example, Chromium and Firefox.

## Installation

Install the nss package.

## Usage

Use certutil utility provided with NSS to manage your certificates.

### List certificate DB

To get list of all certificates:

    $ certutil -d sql:$HOME/.pki/nssdb -L

To get details about certificate:

    $ certutil -d sql:$HOME/.pki/nssdb -L -n certificate_nickname

### Generate an RSA private key

    $ certutil -G -d database_directory -g keysize -n nickname

### Generate a certificate signing request

    $ certutil -S -s subject -n nickname -x -t C,C,C -o file

### Generate a self-signed certificate

    $ certutil -S -s subject -n nickname -x -t C,C,C -o file

### Import certificate

To add a certificate specify the `-A` option:

    $ certutil -d sql:$HOME/.pki/nssdb -A -t "TRUSTARGS" -n certificate_nickname -i /path/to/cert/filename

The `TRUSTARGS` are three strings of zero or more alphabetic characters, separated by commas, for example: `"TCu,Cu,Tuw"`. They define how the certificate should be trusted for SSL, email, and object signing, and are explained in the certutil documentation or Meena's blog post on trust flags.

To add a personal certificate and private key for SSL client authentication use the command:

    $ pk12util -d sql:$HOME/.pki/nssdb -i /path/to/PKCS12/cert/filename.p12

This will import a personal certificate and private key stored in a PKCS #12 file. The `TRUSTARGS` of the personal certificate will be set to `"u,u,u"`.

### Edit certificate

Call certutil with `-M` option to edit the certificate. For example, to edit the `TRUSTARGS`:

    $ certutil -d sql:$HOME/.pki/nssdb -M -t "TRUSTARGS" -n certificate_nickname

### Delete certificate

Use `-D` option to remove the certificate:

    $ certutil -d sql:$HOME/.pki/nssdb -D -n certificate_nickname

## See also

- Network Security Services - Mozilla
- Using the Certificate Database Tool - Mozilla
- Managing Certificate Trust flags in NSS Database - Meena Vyas, Oracle

Categories:

- Transport Layer Security
- Mozilla