[EMAIL PROTECTED] wrote:
ah, IIRC this is the SunPKCS11 provider which calls softoken directly as a PKCS #11 module, not a true NSS application. All the automatic loading of trust anchors is handled by NSS proper. Anyway this is it's documentation for use with softoken. I don't know why it isn't getting to your key store, I presume you are replacing the 'nssSecmodDirectory' path with the real one for your firefox profile directory (that is you've replaces '/home/xxx' with your home directory and '16zcyg70.default' with actual salt value used on your system).On 23 Zář, 01:20, Robert Relyea <[EMAIL PROTECTED]> wrote:Robert Relyea wrote:[ output deleted].Which means that libnssckbi.so is used for obtaing trustanchors and i dont know why. In configuration I've set that i want only access to keystore. Any ideas?Yes, the trust anchors are stored in libnssckbi.so. NSS nssckbi is the NSS cryptoki Builtin (root store).To get trust anchors you need NSS to load that library. Applicationslike firefox know about this ahead of time, and automatically load it if it hasn't been loaded, but no all NSS apps know how to do this. To aid those applications, NSS will automatically load it if it finds it in the same directory as the NSS cert & key store.I believe this is exactly what you are seeing.BTW you can also create the same effect by using the modutil tool to add and explicit path to libnssckbi.so to secmod. Older versions of Firefox used to do this, but modern ones my just load libnssckbi on it's own.bobbob------------------------------------------------------------------------ _______________________________________________dev-tech-crypto mailing list [EMAIL PROTECTED] https://lists.mozilla.org/listinfo/dev-tech-cryptosmime.p7s 4KZobrazitStáhnoutThanks for reply but i just want to get only keystore (NSS Internal PKCS #11 Module (KEYSTORE, libsoftokn3.so, slot 1)), not trustanchors. For creating SunPKCS11 provider I've used following configuration:
I don't know what the SunPKCS11 provider does with the SecmodDirectory stuff, or if and how it loads the builtins (which is a separate PKCS #11 module), since it's provided by people outside the NSS team.
name=FireFox nssLibraryDirectory=/usr/lib/ nssSecmodDirectory=/home/xxx/.mozilla/firefox/16zcyg70.default/ nssDbMode=readOnly nssModule=keystore attributes=compatibility according to http://java.sun.com/javase/6/docs/technotes/guides/security/p11guide.html#NSS this should get access only to keystore. But it doesnt, it tryies to read trust anchors and this is regrettable in my java app. _______________________________________________ dev-tech-crypto mailing list [email protected] https://lists.mozilla.org/listinfo/dev-tech-crypto
smime.p7s
Description: S/MIME Cryptographic Signature
_______________________________________________ dev-tech-crypto mailing list [email protected] https://lists.mozilla.org/listinfo/dev-tech-crypto
