215214 - certutil only lists one instance of duplicate certs when using -L -h all

Status: RESOLVED FIXED

(NSS :: Tools, defect)

Description

[Julien Pierre]

When using certutil -h all -L, one would expect to get all instances of every
certificate listed. Instead, only a single certificate is listed.

This is because certutil uses PK11_ListCerts with the PK11CertListUnique
argument. This causes all instances of a certificate to be collapsed into one.
For example, if a certificate exists in both a softoken and a smartcard, only
one certificate will be listed, with the prefix of the hardware token name.

The fix requires using a new argument to PK11_ListCerts. See bug # 215186 .

Comment 1

[Julien Pierre]

Adding dependency

Comment 2

[Julien Pierre]

An alternative to using the new PK11CertListAll parameter proposed in bug 215186
is to call PK11_ListCerts twice with two different arguments :
PK11CertListUser and PK11CertListRootUnique .

This would show all the instances of user certs, and only one instance for root
certificates. Some products do that (NES) because typically the
administrator/user only cares about the multiple instances for the user certs,
but not for the root certs, for which the private keys are not normally available.

Comment 3

[Nelson Bolyard (seldom reads bugmail)]

The proposal in comment 2 would not show intermediate CA certs, right?

I think certutil -L -h all means "show all certs in all tokens".  
I think it should include intermediates and duplicates.
I don't think we should be using the "unique" flag in certutil -L.
Perhaps we should have a new argument that suggests doing a "unique" search.

Comment 4

[Julien Pierre]

Nelson, in response to comment #2, you are right it wouldn't show intermediates,
so that would be a bad thing.

It makes more sense for certutil to use the new PK11CertListAll option, once the
patch for bug 215186 is reviewed and checked in.

Comment 5

[Julien Pierre]

Attachment: list all instances of certs

Replace PK11CertListUnique with PK11CertListAll as argument to PK11_ListCerts .


I don't think we need an option for unique in this case. If the user specifies
-h all, it's safe to say that he wants to see all the instances of certs on all
tokens.

Comment 6

[Wan-Teh Chang]

Comment on attachment 131639 [details] [diff] [review]
list all instances of certs

r=wtc.

By the way, we found that PK11CertListRootUnique is a misnomer.
The "Root" really means a CA cert (as opposed to a root CA cert)
without a private key.

We've added a new flag, PK11CertListCAUnique, which means a
CA cert, whether we have the private key for it or not.

Comment 7

[Julien Pierre]

Checked in :

Checking in certutil.c;
/cvsroot/mozilla/security/nss/cmd/certutil/certutil.c,v  <--  certutil.c
new revision: 1.79; previous revision: 1.78
done

Comment 8

[Nelson Bolyard (seldom reads bugmail)]

Regarding comment 6 and the name that is a minomer, I hope you have added 
comments to that header file to document that important finding.

Comment 9

[Nelson Bolyard (seldom reads bugmail)]

Comment on attachment 131639 [details] [diff] [review]
list all instances of certs

sr=MisterSSL