On 23 Zář, 01:20, Robert Relyea <[EMAIL PROTECTED]> wrote: > Robert Relyea wrote: > > [ output deleted]. > > >> Which means that libnssckbi.so is used for obtaing trustanchors and i > >> dont know why. In configuration I've set that i want only access to > >> keystore. Any ideas? > > > Yes, the trust anchors are stored in libnssckbi.so. NSS nssckbi is the > > NSS cryptoki Builtin (root store). > > > To get trust anchors you need NSS to load that library. Applications > > like firefox know about this ahead of time, and automatically load it > > if it hasn't been loaded, but no all NSS apps know how to do this. To > > aid those applications, NSS will automatically load it if it finds it > > in the same directory as the NSS cert & key store. > > > I believe this is exactly what you are seeing. > > BTW you can also create the same effect by using the modutil tool to add > and explicit path to libnssckbi.so to secmod. Older versions of Firefox > used to do this, but modern ones my just load libnssckbi on it's own. > > bob > > > > > bob > > > ------------------------------------------------------------------------ > > > _______________________________________________ > > dev-tech-crypto mailing list > > [EMAIL PROTECTED] > >https://lists.mozilla.org/listinfo/dev-tech-crypto > > > > smime.p7s > 4KZobrazitStáhnout
Thanks for reply but i just want to get only keystore (NSS Internal PKCS #11 Module (KEYSTORE, libsoftokn3.so, slot 1)), not trustanchors. For creating SunPKCS11 provider I've used following configuration: name=FireFox nssLibraryDirectory=/usr/lib/ nssSecmodDirectory=/home/xxx/.mozilla/firefox/16zcyg70.default/ nssDbMode=readOnly nssModule=keystore attributes=compatibility according to http://java.sun.com/javase/6/docs/technotes/guides/security/p11guide.html#NSS this should get access only to keystore. But it doesnt, it tryies to read trust anchors and this is regrettable in my java app. _______________________________________________ dev-tech-crypto mailing list [email protected] https://lists.mozilla.org/listinfo/dev-tech-crypto
