NSS

External

• https://en.wikipedia.org/wiki/Network_Security_Services

Internal

• Linux Security

Overview

Network Security Services (NSS) comprises a set of libraries designed to support cross-platform development of security-enabled client and server applications with optional support for hardware TLS/SSL acceleration on the server side and hardware smart cards on the client side. NSS provides a complete open-source implementation of cryptographic libraries supporting Transport Layer Security (TLS) / Secure Sockets Layer (SSL) and S/MIME.

Certificates

Location on Linux: /etc/pki/nssdb

certutil

certutil -L -d /etc/pki/nssdb

More certutil usage examples: http://serverfault.com/questions/498588/smtp-gmail-com-from-bash-gives-error-in-certificate-peers-certificate-issuer

Create a New Certificate Database and Import Google's Certificate

1. Create a New Directory

Create the new directory that will become the home of the new certificate database:

cd ~/tmp
mkdir certs

2. Initialize it as a Certificate Database

certutil -N -d ./certs

The command will inquire for a password to encrypt the keys. If this database is used for public keys only, you can use an empty password:

[root@oceanlab tmp]# certutil -N -d ./certs
Enter a password which will be used to encrypt your keys.
The password should be at least 8 characters long,
and should contain at least one non-alphabetic character.

Enter new password:
Re-enter password:

A certificate database consists in the following files with the following permissions:

/root/tmp/certs

-rw------- 1 root root 65536 Jan 31 16:43 cert8.db
-rw------- 1 root root 16384 Jan 31 16:43 key3.db
-rw------- 1 root root 16384 Jan 31 16:43 secmod.db

3. Get a Root Certificate

Get a root certificate and move it into certs directory:

wget https://www.geotrust.com/resources/root_certificates/certificates/GeoTrust_Global_CA.cer .
mv ./GeoTrust_Global_CA.cer certs

4. Get Google's Certificate

Get Google's certificate using the root certificate just downloaded:

echo -n | openssl s_client -connect smtp.gmail.com:465 -CAfile ./certs/GeoTrust_Global_CA.cer | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > GMAILCERT

The output of the command is similar to:

[root@oceanlab tmp]# echo -n | openssl s_client -connect smtp.gmail.com:465 -CAfile ./certs/GeoTrust_Global_CA.cer | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > GMAILCERT
depth=3 C = US, O = Equifax, OU = Equifax Secure Certificate Authority
verify return:1
depth=2 C = US, O = GeoTrust Inc., CN = GeoTrust Global CA
verify return:1
depth=1 C = US, O = Google Inc, CN = Google Internet Authority G2
verify return:1
depth=0 C = US, ST = California, L = Mountain View, O = Google Inc, CN = smtp.gmail.com
verify return:1
DONE

5. Import Google Certificate into the Certificate Database

certutil -A -n "Google Internet Authority" -t "C,," -d ./certs -i ./GMAILCERT 

6. Verify that the Certificate was Correctly Imported

certutil -L -d ./certs

Output:

Certificate Nickname                                         Trust Attributes
                                                             SSL,S/MIME,JAR/XPI

Google Internet Authority                                    C,,