Product: Fedora
Version: rawhide
Component: nss
Elio Maldonado Batiz <emaldona(a)redhat.com> has canceled Bug Zapper
<triage(a)lists.fedoraproject.org>'s request for needinfo:
Bug 546849: Certificate name confusion
https://bugzilla.redhat.com/show_bug.cgi?id=546849
------- Additional Comments from Elio Maldonado Batiz <emaldona(a)redhat.com>
I cannot reproduce the problem. I'm running
rpm -q nspr nss nss-util nss-softokn
nspr-4.8.9-2.fc16.x86_64
nss-3.13.1-7.fc16.elio.3.x86_64
nss-util-3.13.1-3.fc16.x86_64
nss-softokn-3.12.10-6.fc16.x86_64
This what I did to try to reproduce: - Copying and pasting may be faulty :-)
(1a) Generate the key pair for CA1
openssl genrsa -des3 -out ca1.key 1024
(1b) Generate the key pair for CA1
openssl genrsa -des3 -out ca2.key 1024
(2a) csr for ca1
openssl req -new -key ca1.key -out ca1.csr
Enter pass phrase for ca1.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:US
State or Province Name (full name) []:CA
Locality Name (eg, city) [Default City]:San Jose
Organization Name (eg, company) [Default Company Ltd]:Dummy Inc
Organizational Unit Name (eg, section) []:Testing
Common Name (eg, your name or your server's hostname) []:myca
Email Address []:emaldona@redhat.com
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
(2) csr for ca1 and ca2
openssl req -new -key ca1.key -out ca1.csr
$ openssl req -new -key ca2.key -out ca2.csr
-- at the prompts I gave the same answers
(3b) csr for 2 (
(4a) First self-signed cert
$ openssl x509 -req -days 365 -in ca1.csr -signkey ca1.key -out ca1.crt
Signature ok
subject=/C=US/ST=California/L=San Jose/O=Dummy/OU=Test/CN=none
Getting Private key
Enter pass phrase for ca1.key:
(4b) Second self-signed cert
$ openssl x509 -req -days 365 -in ca2.csr -signkey ca2.key -out ca2.crt
Signature ok
subject=/C=US/ST=California/L=San Jose/O=Dummy/OU=Test/CN=none
Getting Private key
Enter pass phrase for ca2.key:
-- subject is the same
(5) Make empty directory and start a fresh NSS database
$ rm -rf /tmp/cert/
$ mkdir /tmp/cert
$ certutil -d sql:/tmp/cert/ -N
Enter a password which will be used to encrypt your keys.
The password should be at least 8 characters long,
and should contain at least one non-alphabetic character.
Enter new password:
Re-enter password:
(6) Import CA1 cert as fred
$ certutil -d /tmp/cert -E -t TC,TC,TC -n "fred" -i ca1.crt
Enter Password or Pin for "NSS Certificate DB":
(7) Import CA2 cert as wilma
$ certutil -d /tmp/cert -E -t TC,TC,TC -n "wilma" -i ca2.crt
Enter Password or Pin for "NSS Certificate DB":
(8) List the certs
$ certutil -d sql:/tmp/cert/ -L
Certificate Nickname Trust Attributes
SSL,S/MIME,JAR/XPI
fred CT,C,C
wilma CT,C,C
different names, good!
(8) List them by nickname
certutil -d sql:/tmp/cert/ -L -n fred > fred.txt
certutil -d sql:/tmp/cert/ -L -n wilma > wilma.txt
'diff fred.txt wilma.txt' shows edentical output