| Index: docs/linux_cert_management.md
|
| diff --git a/docs/linux_cert_management.md b/docs/linux_cert_management.md
|
| index 7faf6bafdd5fa9034e4f4b904c8a13fbe6c4ebea..7c75acf8ceabdb12ea5427dc319480b2d9108533 100644
|
| --- a/docs/linux_cert_management.md
|
| +++ b/docs/linux_cert_management.md
|
| @@ -1,64 +1,96 @@
|
| -**NOTE:** SSL client authentication with personal certificates does not work completely in Linux, see [issue 16830](http://code.google.com/p/chromium/issues/detail?id=16830) and [issue 25241](http://code.google.com/p/chromium/issues/detail?id=25241).
|
| +# Linux Cert Management
|
|
|
| -# Introduction
|
| +**NOTE:** SSL client authentication with personal certificates does not work
|
| +completely in Linux, see [issue 16830](https://crbug.com/16830) and
|
| +[issue 25241](https://crbug.com/25241).
|
|
|
| -The easy way to manage certificates is navigate to chrome://settings/search#ssl. Then click on the "Manage Certificates" button. This will load a built-in interface for managing certificates.
|
| +The easy way to manage certificates is navigate to chrome://settings/search#ssl.
|
| +Then click on the "Manage Certificates" button. This will load a built-in
|
| +interface for managing certificates.
|
|
|
| -On Linux, Chromium uses the [NSS Shared DB](https://wiki.mozilla.org/NSS_Shared_DB_And_LINUX). If the built-in manager does not work for you then you can configure certificates with the [NSS command line tools](http://www.mozilla.org/projects/security/pki/nss/tools/).
|
| +On Linux, Chromium uses the
|
| +[NSS Shared DB](https://wiki.mozilla.org/NSS_Shared_DB_And_LINUX). If the
|
| +built-in manager does not work for you then you can configure certificates with
|
| +the
|
| +[NSS command line tools](http://www.mozilla.org/projects/security/pki/nss/tools/).
|
|
|
| -# Details
|
| +## Details
|
|
|
| -## Get the tools
|
| - * Debian/Ubuntu: `sudo apt-get install libnss3-tools`
|
| - * Fedora: `su -c "yum install nss-tools"`
|
| - * Gentoo: `su -c "echo 'dev-libs/nss utils' >> /etc/portage/package.use && emerge dev-libs/nss"` (You need to launch all commands below with the `nss` prefix, e.g., `nsscertutil`.)
|
| - * Opensuse: `sudo zypper install mozilla-nss-tools`
|
| +### Get the tools
|
|
|
| +* Debian/Ubuntu: `sudo apt-get install libnss3-tools`
|
| +* Fedora: `su -c "yum install nss-tools"`
|
| +* Gentoo: `su -c "echo 'dev-libs/nss utils' >> /etc/portage/package.use &&
|
| + emerge dev-libs/nss"` (You need to launch all commands below with the `nss`
|
| + prefix, e.g., `nsscertutil`.)
|
| +* Opensuse: `sudo zypper install mozilla-nss-tools`
|
|
|
| -## List all certificates
|
| +### List all certificates
|
|
|
| -`certutil -d sql:$HOME/.pki/nssdb -L`
|
| + certutil -d sql:$HOME/.pki/nssdb -L
|
| +
|
| +#### Ubuntu Jaunty error
|
|
|
| -### Ubuntu Jaunty error
|
| Above (and most commands) gives:
|
|
|
| -`certutil: function failed: security library: invalid arguments.`
|
| + certutil: function failed: security library: invalid arguments.
|
|
|
| Package version 3.12.3.1-0ubuntu0.9.04.2
|
|
|
| -## List details of a certificate
|
| +### List details of a certificate
|
|
|
| -`certutil -d sql:$HOME/.pki/nssdb -L -n <certificate nickname>`
|
| + certutil -d sql:$HOME/.pki/nssdb -L -n <certificate nickname>
|
|
|
| -## Add a certificate
|
| +### Add a certificate
|
|
|
| -`certutil -d sql:$HOME/.pki/nssdb -A -t <TRUSTARGS> -n <certificate nickname> -i <certificate filename>`
|
| +```shell
|
| +certutil -d sql:$HOME/.pki/nssdb -A -t <TRUSTARGS> -n <certificate nickname> \
|
| +-i <certificate filename>
|
| +```
|
|
|
| -The TRUSTARGS are three strings of zero or more alphabetic
|
| -characters, separated by commas. They define how the certificate should be trusted for SSL, email, and object signing, and are explained in the [certutil docs](http://www.mozilla.org/projects/security/pki/nss/tools/certutil.html#1034193) or [Meena's blog post on trust flags](https://blogs.oracle.com/meena/entry/notes_about_trust_flags).
|
| +The TRUSTARGS are three strings of zero or more alphabetic characters, separated
|
| +by commas. They define how the certificate should be trusted for SSL, email, and
|
| +object signing, and are explained in the
|
| +[certutil docs](http://www.mozilla.org/projects/security/pki/nss/tools/certutil.html#1034193)
|
| +or
|
| +[Meena's blog post on trust flags](https://blogs.oracle.com/meena/entry/notes_about_trust_flags).
|
|
|
| -For example, to trust a root CA certificate for issuing SSL server certificates, use
|
| +For example, to trust a root CA certificate for issuing SSL server certificates,
|
| +use
|
|
|
| -`certutil -d sql:$HOME/.pki/nssdb -A -t "C,," -n <certificate nickname> -i <certificate filename>`
|
| +```shell
|
| +certutil -d sql:$HOME/.pki/nssdb -A -t "C,," -n <certificate nickname> \
|
| +-i <certificate filename>
|
| +```
|
|
|
| To import an intermediate CA certificate, use
|
|
|
| -`certutil -d sql:$HOME/.pki/nssdb -A -t ",," -n <certificate nickname> -i <certificate filename>`
|
| +```shell
|
| +certutil -d sql:$HOME/.pki/nssdb -A -t ",," -n <certificate nickname> \
|
| +-i <certificate filename>
|
| +```
|
|
|
| Note: to trust a self-signed server certificate, we should use
|
|
|
| -`certutil -d sql:$HOME/.pki/nssdb -A -t "P,," -n <certificate nickname> -i <certificate filename>`
|
| +```
|
| +certutil -d sql:$HOME/.pki/nssdb -A -t "P,," -n <certificate nickname> \
|
| +-i <certificate filename>
|
| +```
|
|
|
| -This should work now, because [NSS bug 531160](https://bugzilla.mozilla.org/show_bug.cgi?id=531160) is claimed to be fixed in a related bug report. If it doesn't work, then to work around the NSS bug, you have to trust it as a CA using the "C,," trust flags.
|
| +This should work now, because
|
| +[NSS bug 531160](https://bugzilla.mozilla.org/show_bug.cgi?id=531160) is claimed
|
| +to be fixed in a related bug report. If it doesn't work, then to work around
|
| +the NSS bug, you have to trust it as a CA using the "C,," trust flags.
|
|
|
| -### Add a personal certificate and private key for SSL client authentication
|
| +#### Add a personal certificate and private key for SSL client authentication
|
|
|
| Use the command:
|
|
|
| -`pk12util -d sql:$HOME/.pki/nssdb -i PKCS12_file.p12`
|
| + pk12util -d sql:$HOME/.pki/nssdb -i PKCS12_file.p12
|
|
|
| -to import a personal certificate and private key stored in a PKCS #12 file. The TRUSTARGS of the personal certificate will be set to "u,u,u".
|
| +to import a personal certificate and private key stored in a PKCS #12 file. The
|
| +TRUSTARGS of the personal certificate will be set to "u,u,u".
|
|
|
| -## Delete a certificate
|
| +### Delete a certificate
|
|
|
| -`certutil -d sql:$HOME/.pki/nssdb -D -n <certificate nickname>`
|
| + certutil -d sql:$HOME/.pki/nssdb -D -n <certificate nickname>
|
|
|