Skip to content

Latest commit

 

History

History
57 lines (37 loc) · 1.94 KB

README

File metadata and controls

57 lines (37 loc) · 1.94 KB
Raw

NSS-SystemCerts

This package provides a few shell utilities to merge the system-wide certificate store, available in /etc/ssl/certs/ca-certificates.crt, and a NSS-compatible store living in /etc/pki/nssdb (the default path of the system-wide library defined in NSS).

Background

NSS has a much wider set of features than the system-wide trusted certificates whitelist:

  • Trusting a certificate for various uses (server authentication, email signing, ...)
  • Distrusting a certificate trusted by another source (e.g user database removing system-wide defaults)

It can also work with both user-specific and system-wide databases.

  • The system-wide is expected to be in /etc/pki/nssdb
  • The user-specific db lives in $HOME/.pki/nssdb

Purpose

The system-wide NSS database has no relation with the system-wide certificate store. This tool tries to bridge that gap, by permitting:

  • Initialization of the system-wide NSS database
  • Updating the system-wide NSS database whenever a new certificate is added to the system-wide store
  • Listing differences between both databases.

nss-systemcerts-import

This tool creates a NSS database from the system-wide certificate store.

It accepts the following options:

  • -n, --dry-run: don't do anything, just print what would be performed
  • -s, --system-store: path to the system store (defaults to /etc/ssl/certs)
  • -d, --nss-db: path to the NSS database, as understood by NSS certutil tool. Defaults to /etc/pki/nssdb

nss-systemcerts-hook

This short script is a hook for update-ca-certificates, and should be symlinked to /etc/ca-certificates/update.d/.

LICENSE

This software is distributes under the MIT license. A copy is included in the package. It was originally written by Raphaël Barrois.

Source code is available at https://github.com/rbarrois/nss-systemcerts.