1279678 - certutil should fail with more descriptive error messages

Status: NEW

(NSS :: Tools, enhancement, P3)

Description

[Franziskus Kiefer [:franziskus]]

Calling |certutil -N -d db| when db doesn't exist gives this output:

certutil: function failed: SEC_ERROR_LEGACY_DATABASE: The certificate/key database is in an old, unsupported format.

We should output better error messages so users know what's going on.

Comment 1

[Nick Gonella]

It seems to me that this is less of a fix in the certutil application, and more of a deeper fix in the NSS initialization logic. Should we attempt to fix it there or just make the change in the certutil code?

Comment 2

[Franziskus Kiefer [:franziskus]]

(In reply to ngonella from comment #1)
> It seems to me that this is less of a fix in the certutil application, and
> more of a deeper fix in the NSS initialization logic. Should we attempt to
> fix it there or just make the change in the certutil code?

If the error message is coming from the initialisation and can't be distinguished from the actual SEC_ERROR_LEGACY_DATABASE error, we certainly have to fix it in the initialisation and throw another error code there. We could also check if the folder exists in certutil before trying to initialise NSS. This fix would be specific to certutil though. So another error code might be the better option.