用certutil 注册根证书到nss/firefox

最新推荐文章于 2024-09-26 10:01:48 发布

原创

最新推荐文章于 2024-09-26 10:01:48 发布 · 2.5k 阅读

3 ·

CC 4.0 BY-SA版权

文章标签：

#certutil #nss #firefox注册证书

环境： Centos 6.5

certutil 参数：

所有命令可参见系统自带帮助，通俗易懂。

certutil(选项)(参数)

[root@localhost lftshell]# certutil -H
-A              Add a certificate to the database        (create if needed)
   All options under -E apply
-B              Run a series of certutil commands from a batch file
   -i batch-file     Specify the batch file
-E              Add an Email certificate to the database (create if needed)
   -n cert-name      Specify the nickname of the certificate to add
   -t trustargs      Set the certificate trust attributes:
                          trustargs is of the form x,y,z where x is for SSL, y is for S/MIME,
                          and z is for code signing. Use ,, for no explicit trust.
                          p      prohibited (explicitly distrusted)
                          P      trusted peer
                          c      valid CA
                          T      trusted CA to issue client certs (implies c)
                          C      trusted CA to issue server certs (implies c)
                          u      user cert
                          w      send warning
                          g      make step-up cert
   -f pwfile         Specify the password file
   -d certdir        Cert database directory (default is ~/.netscape)
   -P dbprefix       Cert & Key database prefix
   -a                The input certificate is encoded in ASCII (RFC1113)
   -i input          Specify the certificate file (default is stdin)

-C              Create a new binary certificate from a BINARY cert request
   -c issuer-name    The nickname of the issuer cert
   -i cert-request   The BINARY certificate request file
   -o output-cert    Output binary cert to this file (default is stdout)
   -x                Self sign
   -m serial-number  Cert serial number
   -w warp-months    Time Warp
   -v months-valid   Months valid (default is 3)
   -f pwfile         Specify the password file
   -d certdir        Cert database directory (default is ~/.netscape)
   -P dbprefix       Cert & Key database prefix
   -1 | --keyUsage keyword,keyword,... 
                     Create key usage extension. Possible keywords:
                     "digitalSignature", "nonRepudiation", "keyEncipherment",
                     "dataEncipherment", "keyAgreement", "certSigning",
                     "crlSigning", "critical"
   -2                Create basic constraint extension
   -3                Create authority key ID extension
   -4                Create crl distribution point extension
   -5 | --nsCertType keyword,keyword,...  
                     Create netscape cert type extension. Possible keywords:
                     "sslClient", "sslServer", "smime", "objectSigning",
                     "sslCA", "smimeCA", "objectSigningCA", "critical".
   -6 | --extKeyUsage keyword,keyword,... 
                     Create extended key usage extension. Possible keywords:
                     "serverAuth", "clientAuth","codeSigning",