certutil and cert8.db

[Roland Krikava]

Could someone please tell me how to list the certificates in a cert8.db file
using certutil? I have tried this using the latest NSS toolset (nss 3.9).
Doing the following will produce nothing:

certutil -L -d "location of cert8.db"

Using the same toolset with cert7.db files, does work however.

My goal is to extract Mozilla's default CA Root certificates.

Thanks,
Roland

[Julien Pierre]

Roland,

Post by Roland Krikava
Could someone please tell me how to list the certificates in a cert8.db file
using certutil? I have tried this using the latest NSS toolset (nss 3.9).
certutil -L -d "location of cert8.db"

That's probably because your database contains no certs.

Post by Roland Krikava
Using the same toolset with cert7.db files, does work however.

Then your cert7 database must contain certs.

Post by Roland Krikava
My goal is to extract Mozilla's default CA Root certificates.

Since NSS 3.1, the root CAs live in a separate PKCS#11 module, not in
the cert database. The root CAs will only get copied to the cert DB if
their trust is modified. To list the certs in all PKCS#11 modules, add
the "-h all" argument to certutil .