320438 - certutil documentation improperly illustrates setting user trust bits

Status: NEW

(NSS :: Documentation, defect, P3)

Description

[TJ]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8) Gecko/20051111 Firefox/1.5 Mnenhy/0.7.3.0
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8) Gecko/20051111 Firefox/1.5 Mnenhy/0.7.3.0

Whilst working out how to sign Firefox extension XPI packages I discovered that when importing a new code-signing certificate (from Unizeto Certum) into an NSS database using the trust attribute -t "u,u,u" the trusts didn't seem to be applied to the key/certificate.

I had also imported the same code-signing key/certificate into Mozilla Firefox database and using certutil -L showed it had the correct attributes.

I couldn't find any articles about this through searching, nor bug reports.

Reproducible: Always

Steps to Reproduce:
1. certutil -A -n "Code Signing (Certum)" -t "u,u,u" -d . -i "CodeSigning.cer"
2. certutil -L -d .

Actual Results:  
C:\Projects\CodeSigning> certutil -L -d .
myTestCert                                                   u,u,Cu
Certum Root CA                                               CT,C,C
Certum Level I                                               CT,C,C
Code Signing (Certum)                                        ,, 

Expected Results:  
C:\Projects\CodeSigning> certutil -L -d .
myTestCert                                                   u,u,Cu
Certum Root CA                                               CT,C,C
Certum Level I                                               c,c,C
Code Signing (Certum)                                        u,u,u

I've documented the circumstances and the workaround in the article I've just completed that describes how to use a code-signing certificate on Windows for XPIs.

The demo URL of this report contains the link. In the article, find Step 14. Details are about 6 paragraphs in.

TJ.

Comment 1

[Wan-Teh Chang]

Nelson, Bob, Julien, could you answer this question?

Comment 2

[Julien Pierre]

The "u" user trust bit can no longer be set manually in current versions of NSS.
NSS will automatically set that bit for you if the private key is available. In this case, you added the certificate without adding the private key, so the user bit will never be shown. You can import both the private key and the certificate at the same time with pk12util if you have a PKCS#12 file containing them.

This is working as designed, so I'm closing this bug as invalid.

Comment 3

[TJ]

This behaviour should be added to the documentation for certutil then, because there is no indiciation of this anywhere - especially as it gives examples with the "u" attribute.

Comment 4

[Nelson Bolyard (seldom reads bugmail)]

I'll turn this into a documentation bug.