1784925 - Inconsistent certutil delete certificate behavior with tokens

Status: NEW

(NSS :: Tools, defect, P5)

Description

[Rob Crittenden]

Tested on Fedora rawhide (37) using nss-3.81.0-1.fc37.

The token and nickname options behave different when adding and removing a certificate from the database with a PKCS#11 token. I'm using the softhsm2 token.

You can add a certificate to a token with:

certutil -A -n test -d /etc/pki/nssdb -a -i /tmp/ca.crt -t CT,,

Enter Password or Pin for "NSS Certificate DB":

certutil -L -d /etc/pki/pki-tomcat/alias -h all -f /tmp/password

Certificate Nickname Trust Attributes
SSL,S/MIME,JAR/XPI

test CT,,
softhsm_token:test CT,,

Seems strange to have it listed twice but ok.

Trying to delete it with similar syntax:

certutil -D -h softhsm_token -n 'test' -d /etc/pki/pki-tomcat/alias/

Certificate Nickname Trust Attributes
SSL,S/MIME,JAR/XPI

softhsm_token:test ,,

It deleted only the softokn copy. Trying to delete it again returns:
certutil: could not find certificate named "test": SEC_ERROR_INVALID_ARGS: security library: invalid arguments.

It can be removed by including the token in the nickname:

[root@ipa ~]# certutil -D -h softhsm_token -n 'softhsm_token:test' -d /etc/pki/pki-tomcat/alias/
Enter Password or Pin for "softhsm_token":
[root@ipa ~]# certutil -L -d /etc/pki/pki-tomcat/alias -h all -f /tmp/password

Certificate Nickname Trust Attributes
SSL,S/MIME,JAR/XPI

Similarly, removing in reverse order, with the token:nickname format the token copy is removed but the softokn one remains:

certutil -A -n test -d /etc/pki/nssdb -a -i /tmp/ca.crt -t CT,,

Enter Password or Pin for "NSS Certificate DB":

certutil -L -d /etc/pki/pki-tomcat/alias -h all -f /tmp/password

Certificate Nickname Trust Attributes
SSL,S/MIME,JAR/XPI

test CT,,
softhsm_token:test CT,,

[root@ipa ~]# certutil -D -h softhsm_token -n 'softhsm_token:test' -d /etc/pki/pki-tomcat/alias/
Enter Password or Pin for "softhsm_token":
[root@ipa ~]# certutil -L -d /etc/pki/pki-tomcat/alias -h all -f /tmp/password
Certificate Nickname Trust Attributes
SSL,S/MIME,JAR/XPI

test CT,,