47937 - tools obtaining self-signed certs by nickname

Status: RESOLVED INVALID

(NSS :: Tools, defect, P3)

Description

[Ian McGreer]

All tools using PK11_FindCertByNickname seem to fail on self-signed certs. 
Don't remember this happening before (mozilla).

Comment 1

[Ian McGreer]

(including relyea now that I have PKCS11 question)

Have tracked down what happens.  I am trying to create a test self-signed cert
with certutil, and then issue S/MIME user certs with it.  The following sequence
fails:

certutil -S -n smimeca -s "CN=smimeca" -x -t "CT,CT,CT" -m 100 -d test -1 -2 -5
certutil -S -n smimetest -s "CN=smimetest" -c smimeca -t "u,u,u" -m 101 -d test

the failure occurs in certutil.c:SignCert()
        CERTCertificate *issuer;
        issuer = PK11_FindCertFromNickname(issuerNickName, NULL);

fails to find the S/MIME CA cert created above.  The failure occurs in
pk11_searchCerts(), the cert is found okay but discarded because it is not a
user cert (line 3873).  Is this expected?  How does one extract non-user certs
through PKCS11?

Comment 2

[Robert Relyea]

The internal DB only exports user certs to the top level. non-user certs are 
only found through the direct cert db calls. NOTE: the definition of user cert 
here only implies that the private key exists. That means you should have the 
user cert bits set on this CA, otherwise you won't be able to sign with it.

Comment 3

[Ian McGreer]

Ah, I get it.  I need to use "CTu,CTu,CTu" as the trust when creating
self-signed certs for which I have the key.  I tried this and it worked (had I
gone back and read the docs I probably would have seen that, but I thought I
remembered how to do it).  Thanks bob.  Marking as invalid.