749242 - certutil multiple nicknames for the same CN bug

Status: NEW

(NSS :: Tools, defect, P5)

Description

[john doe]

User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)

Steps to reproduce:

certutil -N -d ./
certutil -S -d ./ -s "CN=MyTrueName" -n "MyNickName1" -t ",," -x
certutil -S -d ./ -s "CN=MyTrueName" -n "MyNickName2" -t ",," -x
certutil -L -d ./ -n "MyNickName2"



Actual results:

certutil: Could not find cert: MyNickName2
: File not found


Expected results:

It should list the certificate I inserted under the -n "MyNickName2".

Instead, it inserted the certificate under MyNickName1 again:
certutil -L -d ./

Certificate Nickname                                         Trust Attributes
                                                             SSL,S/MIME,JAR/XPI

MyNickName1                                                  u,u,u
MyNickName1                                                  u,u,u

Why can't the same entity have two different nicknames/certificates? The meaning of the -n parameter is very inconsistent - when you successfully insert something under a nickname and then can't find it under that nickname.

Comment 1

[Nelson Bolyard (seldom reads bugmail)]

This is working as designed.
All certs with the same subject name bear the same nickname.
When you insert a cert with the same subject name as another cert, the -n option is ignored.
That aspect of the NSS cert database design is unlikely to get changed after 16 years,
however, certutil could detect that this has happened and warn the user that his nickname choice was ignored, and inform the user of the chosen nickname.  So I'll leave this open.

Comment 2

[Nelson Bolyard (seldom reads bugmail)]

I confirm this bug, the observed behavior is by design.