123296 - signtool doesn't like certutil object signing certificates

Status: RESOLVED FIXED

(NSS :: Tools, defect, P1)

Description

[Eric Murphy]

http://bugzilla.mozilla.org/show_bug.cgi?id=122100 has instructions I have
followed, and gotten to work with the latest CVS version of NSS. This creates
two object signing certificates in the database.

However, once I create these object signing certificates, signtool doesn't like
them. It says, "Certificate not approved for this operation". Here is the
command I use:

signtool -k"certs.mozdev.org" -p"mozdev.org" test/

Getting this working is urgent, because once I get this to work, I can finish my
section for the Mozilla Applications book about signed scripts.

Comment 1

[Eric Murphy]

Just to note, the password of the database is "mozdev.org". Sorry to make that
confusing.

Also, I made a temperary object signing certificate and compared it to the ones
I had made. Their credentials were identical.

Comment 2

[Eric Murphy]

Finally, to state that when I did signtool -L, mozdev.org showed up, and it did
not appear to be marked as an object certificate. Then the terminal hanged. -l
also has similar problems hanging the terminal for me, but nothing was listed at
all.

Comment 3

[Eric Murphy]

Attachment: certs.zip

This contains the db files with the certs I mentioned pre-installed. Also
contains .cacert representations of them.

Password is "mozdev.org"

Comment 4

[Eric Murphy]

I want to nominate this for P1. 

This stuff is going to be in the O'Reilly Mozilla Applications book, and I
really hope this can be fixed for 3.4. I need to fully test this stuff before it
goes to press. Sooner the better. Thanks.

Comment 5

[Jamie Nicolson]

Signtool doesn't recognize "mozdev.org" as a signing certificate because it
doesn't have the object signing flag set in the Netscape Certificate Type
extension. It looks like the cert has "object signing CA", but not "object
signing". The latter is necessary for signtool to recognize it as an object
signing cert.

Try generating a new certificate. This time specify both "object signing CA" and
"object signing" for the Netscape Certificate Type extension.

Comment 6

[Eric Murphy]

This still does not work :-( 

Comment 7

[Jamie Nicolson]

OK, please attach the latest databases to the bug report, and I'll see what
signtool doesn't like about your new cert.

Comment 8

[Wan-Teh Chang]

Assigned the bug to Jamie.

Comment 9

[Eric Murphy]

Comment on attachment 68238 [details]
certs.zip

Old database

Comment 10

[Eric Murphy]

Attachment: certs.zip

Certificate database with object signing and object signing CA

Comment 11

[Eric Murphy]

OK, I just tried this with nss-3.4.rc1 Windows version. I did this:

C:\Documents and Settings\Administrator\Desktop\nss-3.4.rc1\bin>signtool
-k"certs.mozdev.org
" -p"certs.mozdev.org" mozdev/
using certificate directory: .
Generating mozdev//META-INF/manifest.mf file..
--> test.txt
Generating zigbert.sf file..

The CPU went to 100% and hung there. I had to kill the signtool process.

Updated certificate database is attached. This database is both object signing
and object signing CA, as stated in Comment 5.

I have libplc4.dll, libnspr4.dll, and libplds4.dll (all version 4.1.2.0) and the
database files in the bin also. -d .

Comment 12

[Eric Murphy]

The result here is different that before, when it simply said "Certificate not
approved for this operation".

Comment 13

[Ian McGreer]

The problem is that you provided an incorrect password.  Interestingly, signtool
will loop indefinitely in that case.

I deduced that the correct password was "mozdev".  That will avoid the hang.

Your cert is still incorrect.  You need to set the key usage extension to
digital signature.  Use "-1" with certutil, and select "Digital Signature" when
prompted.  Worked for me.

Comment 14

[Ian McGreer]

Attachment: prevent infinite loop with incorrect password

providing incorrect password at command line causes infinite loop, this stops
it.

Comment 15

[Eric Murphy]

Sorry about the wrong password... :-/ At least that brought one other signtool
problem up.

It works! Thanks for the help. Now I sort of feel dumb for not noticing the
Digital Signature menu option, and figuring out that may be the problem.

Comment 16

[Wan-Teh Chang]

Comment on attachment 76199 [details] [diff] [review]
prevent infinite loop with incorrect password

r=wtc.

Comment 17

[Ian McGreer]

checked in.

Marking fixed since user completed the signing operation with a cert created by
certutil.