User manual REDHAT NETSCAPE MANAGEMENT SYSTEM 4.5 COMMAND-LINE

[. . . ] Command-Line Tools Guide Netscape Certificate Management System Version 4. 5 October 2001 Netscape Communications Corporation ("Netscape"), a subsidiary of America Online, Inc. , and its licensors retain all ownership rights to the software programs offered by Netscape (referred to herein as "Software") and related documentation. Use of the Software and related documentation is governed by the license agreement accompanying the Software and applicable copyright law. Your right to copy this documentation is limited by copyright law. Making unauthorized copies, adaptations, or compilation works is prohibited and constitutes a punishable violation of the law. [. . . ] Enter new password: Re-enter password: After you enter the password, Key Database Tool creates new key3. db and secmod. db files in the specified directory. Chapter 12 Key Database Tool 81 Examples Generating a New Key This example generates a new key in a key database: keyutil -G -d keydir Key Database Tool then displays the following: ---------------------------------------------------Netscape Communications Corporation Key Generation -------------------------------------------------------Welcome to the key generator. With this program, you can generate the public and private keys that you use for secure communications. A random seed must be generated that will be used in the creation of your key. One of the easiest ways to create a random seed is to use the timing of keystrokes on a keyboard. You have specified the name 'mykey' for your key If this is correct, press enter: To begin, type keys on the keyboard until this progress meter is full. DO NOT USE THE AUTOREPEAT FUNCTION ON YOUR KEYBOARD!Continue typing until the progress meter is full: |************************************************************| Finished. Press enter to continue: Generating key. Password: generated public/private key pair Note that if you do not specify a token name, the key is generated on the internal slot. This is equivalent to the -h internal argument. If you use the -f noise-file argument, Key Database Tool does not ask for keyboard input. If you use the -w password-file argument, Key Database Tool reads the password from the file instead of asking for keyboard input. Avoid using this argument when you are accessing both the internal slot and tokens that have different passwords. 82 Netscape Certificate Management System Command-Line Tools Guide · October 2001 Examples Displaying Public Key Information This example prints the public key's information: keyutil -P -k e95c -d keydir The public key information appears after you give the correct password: Password: It's the first key found. RSA Public-Key: modulus: 00:e9:5c:4a:73:74:39:22:6d:c6:da:4e:b3:1f:01:26:9d:be: d1:74:ae:cd:c7:7d:65:f9:1d:31:1f:71:fb:60:d0:45:46:5f: 5a:19:e7:61:1e:e7:ce:9f:4a:13:4e:d6:e9:06:90:2a:ba:bd: 0b:5f:7b:a3:28:21:1e:0f:1c:f4:3a:ba:3a:8f:0b:e1:99:91: cc:e8:fd:17:d2:1c:66:13:6b:95:27:b1:eb:bc:9c:e6:7b:f0: 3a:b9:44:dc:24:a6:f8:83:9a:9e:80:3f:74:48:09:6b:3f:a6: 46:51:be:e0:1b:51:87:8c:44:94:f0:fe:41:fe:b4:9f:4c:0a: 04:a9:a1 publicExponent: 65537 (0x10001) Listing Key IDs This command lists the key IDs in the key database: keyutil -L -d keydir After you enter the password, Key Database Tool displays the following: RSA Public-Key: modulus: 00:e9:5c:4a:73:74:39:22:6d:c6:da:4e:b3:1f:01:26:9d:be: d1:74:ae:cd:c7:7d:65:f9:1d:31:1f:71:fb:60:d0:45:46:5f: 5a:19:e7:61:1e:e7:ce:9f:4a:13:4e:d6:e9:06:90:2a:ba:bd: 0b:5f:7b:a3:28:21:1e:0f:1c:f4:3a:ba:3a:8f:0b:e1:99:91: cc:e8:fd:17:d2:1c:66:13:6b:95:27:b1:eb:bc:9c:e6:7b:f0: 3a:b9:44:dc:24:a6:f8:83:9a:9e:80:3f:74:48:09:6b:3f:a6: 46:51:be:e0:1b:51:87:8c:44:94:f0:fe:41:fe:b4:9f:4c:0a: 04:a9:a1 When unmodified, this command lists all the RSA keys in the default (internal) slot. You can refine this command's output with the -a, -h, and -l arguments. Chapter 12 Key Database Tool 83 Examples Deleting a Private Key This example deletes a private key from the key database: keyutil -D -k e95c -d keydir When you delete keys, be sure to remove any certificates associated with those keys from the certificate database by using the Certificate Database Tool. 84 Netscape Certificate Management System Command-Line Tools Guide · October 2001 Chapter 13 Netscape Signing Tool This chapter describes how to use version 1. 3 of Netscape Signing Tool (signtool on the command line) to digitally sign software, including binary files intended for distribution via SmartUpdate, Java class files, and JavaScript scripts. Version 1. 3 includes all the capabilities of, and is fully compatible with, previous versions of Netscape Signing Tool (. 50, . 60, 1. 0, 1. 1, and 1. 2). This chapter has these sections: · · · · · · · Introduction to Netscape Signing Tool (page 85) Using Netscape Signing Tool (page 89) SignTool Syntax and Options (page 95) Generating Test Object-Signing Certificates (page 102) Using Netscape Signing Tool with Smart Cards (page 104) Netscape Signing Tool and FIPS-140-1 (page 107) Answers to Common Questions (page 109) Introduction to Netscape Signing Tool This section reviews basic concepts that you need to understand before you begin using version 1. 3 of Netscape Signing Tool to sign files or JavaScript scripts. If you are already familiar with object-signing concepts, go straight to "Using Netscape Signing Tool" on page 89. · · · What Is Netscape Signing Tool?JAR Format and JAR Archives What Signing a File Means 85 Introduction to Netscape Signing Tool · Object-Signing Certificates For a complete introduction to object signing technology, see Netscape Object Signing: Establishing Trust for Downloaded Software at this URL: http://developer. netscape. com/docs/manuals/signedobj/trust/index. ht m What Is Netscape Signing Tool? Netscape Signing Tool is a stand-alone command-line tool that creates digital signatures and uses the Java Archive (JAR) format to associate them with files in a directory. It is intended for use by system administrators and by developers who want to distribute software electronically over the Internet. Netscape Signing Tool 1. 3 is available for AIX 4. 3, OSF/1 v4. 0D, Solaris 2. 6 (SunOS 5. 6), Solaris 8, and Windows NT 4. 0. [. . . ] Successfully changed defaults. Enabling a Slot This example enables a particular slot in the specified module: modutil -enable "Cryptographic Module" -slot "Cryptographic Reader" -dbdir c:\databases The Security Module Database Tool displays a warning: WARNING: Performing this operation while a Netscape product is running could cause corruption of your security databases. If a Netscape product is currently running, you should exit the product before continuing this operation. Type 'q <enter>' to abort, or <enter> to continue: After you press Enter, the tool displays the following: Using database directory c:\databases. . . Slot "Cryptographic Reader" enabled. Enabling FIPS Compliance This example enables FIPS-140-1 compliance in Communicator's internal module: modutil -fips true The Security Module Database Tool displays a warning: WARNING: Performing this operation while a Netscape product is running could cause corruption of your security databases. [. . . ]