Netscape NETSCAPE MANAGEMENT SYSTEM 4.5 -... User manual

Command-Line Tools Guide
Netscape Certificate Management System
Version4.5
October 2001

Netscape Communications Corporation (“Netscape”), a subsidiary of America Online, Inc., and its licensors retain all ownership rights to
the software programs offered by Netscape (referred to herein as “Software”) and related documentation. Use of the Software and related
documentation is governed by the license agreement accompanying the Software and applicable copyright law.
Your right to copy this documentation is limited by copyright law. Making unauthorized copies, adaptations, or compilation works is
prohibited and constitutes a punishable violation of the law. Netscape may revise this documentation from time to time without notice.
THIS DOCUMENTATION IS PROVIDED “AS IS” WITHOUT WARRANTY OF ANY KIND. IN NO EVENT SHALL NETSCAPE BE
LIABLE FOR INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES OF ANY KIND ARISING FROM ANY ERROR IN
THIS DOCUMENTATION, INCLUDING WITHOUT LIMITATION ANY LOSS OR INTERRUPTION OF BUSINESS, PROFITS, USE, OR
DATA.
Software applications: © 2001 Sun Microsystems, Inc.
Some software code: © 1999, 2001 Netscape Communications Corporation.
All rights reserved.
Netscape and the Netscape N logo are registered trademarks of Netscape Communications Corporation in the United States and other
countries. Other Netscape logos, product names, and service names are also trademarks of Netscape Communications Corporation, which
may be registered in other countries. Other product and brand names are the exclusive property of their respective owners.
The downloading, exporting, or reexporting of Netscape software or any underlying information or technology must be in full compliance
with all United States and other applicable laws and regulations. Any provision of Netscape software or documentation to the U.S.
Government is with restricted rights as described in the license agreement accompanying Netscape software.

3
Contents
AboutThisGuide............................................................... 9
WhatYouShouldAlreadyKnow ..........................................................9
What’sinThisGuide....................................................................10
ConventionsUsedinThisGuide .........................................................11
WheretoGoforRelatedInformation......................................................13
Chapter 1 Command-LineTools................................................ 15
Chapter 2 Password Cache Utility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Location...............................................................................19
Syntax ................................................................................20
Usage.................................................................................20
ChangingtheSingleSign-OnPassword.................................................21
ListingtheContentsofthePasswordCache .............................................21
Adding a New Entry to the Password Cache . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
ChangingthePasswordofanEntryinthePasswordCache ...............................22
DeletinganEntryFromthePasswordCache ............................................23
CreatingaNewPasswordCache.......................................................24
Chapter 3 KillProcessTool ................................................... 25
Location...............................................................................25
Syntax ................................................................................25
Usage.................................................................................26
Chapter 4 PIN Generator Tool . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
LocatingthePINGeneratorTool .........................................................27

4 Netscape Certificate Management System Command-Line Tools Guide • October 2001
ThesetpinCommand................................................................... 28
Command-LineSyntax............................................................... 28
Arguments....................................................................... 28
Example ......................................................................... 32
HowtheToolWorks ................................................................... 32
InputFile........................................................................... 35
OutputFile ......................................................................... 36
HowPINsAreStoredintheDirectory ................................................. 37
ExitCodes.......................................................................... 38
Chapter 5 Extension Joiner Tool . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
Location .............................................................................. 40
Syntax ................................................................................ 40
Usage................................................................................. 40
Chapter 6 BackingUpandRestoringData ....................................... 43
BackupandRestoreTools ............................................................... 43
BackingUpData ....................................................................... 44
WhattheBackupToolDoes........................................................... 44
WhattheBackupToolDoesNotDo.................................................... 46
RunningtheBackupTool............................................................. 47
AfterYouFinishaBackup ............................................................ 48
RestoringData......................................................................... 49
BeforeYouRestoreData.............................................................. 49
RunningtheRestoreTool............................................................. 50
Chapter 7 ASCIItoBinaryTool................................................. 53
Availability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
Syntax ................................................................................ 53
Example .............................................................................. 54
Chapter 8 BinarytoASCIITool................................................. 55
Availability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
Syntax ................................................................................ 55
Example .............................................................................. 56
Chapter 9 PrettyPrintCertificateTool........................................... 57
Availability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
Syntax ................................................................................ 57
Example .............................................................................. 58

5
Chapter 10 PrettyPrintCRLTool............................................... 61
Availability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
Syntax ................................................................................61
Example...............................................................................62
Chapter 11 Certificate Database Tool . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65
Availability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65
Syntax ................................................................................66
OptionsandArguments ..............................................................66
Usage.................................................................................70
Examples..............................................................................71
CreatingaNewCertificateDatabase ...................................................71
ListingCertificatesinaDatabase.......................................................72
CreatingaCertificateRequest .........................................................72
CreatingaCertificate.................................................................73
Adding a Certificate to the Database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
ValidatingaCertificate ...............................................................74
Chapter 12 KeyDatabaseTool ................................................. 77
Availability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
Syntax ................................................................................78
OptionsandArguments ..............................................................78
Usage.................................................................................80
Examples..............................................................................81
CreatingaKeyDatabase..............................................................81
GeneratingaNewKey ...............................................................82
DisplayingPublicKeyInformation.....................................................83
ListingKeyIDs ......................................................................83
DeletingaPrivateKey................................................................84
Chapter 13 Netscape Signing Tool . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
IntroductiontoNetscapeSigningTool ....................................................85
WhatIsNetscapeSigningTool? .......................................................86
JARFormatandJARArchives.........................................................87
WhatSigningaFileMeans ............................................................88
Object-SigningCertificates ............................................................88
UsingNetscapeSigningTool.............................................................89
GettingReadytoUseNetscapeSigningTool ............................................90
SettingUpYourCertificate .........................................................90
ListingAvailableCertificates .......................................................91
SigningaFile........................................................................92
UsingNetscapeSigningToolwithaZIPUtility ..........................................93

6 Netscape Certificate Management System Command-Line Tools Guide • October 2001
TipsandTechniques ................................................................. 93
SignToolSyntaxandOptions ............................................................ 95
CommandSyntax ................................................................... 95
CommandOptions .................................................................. 95
CommandFileSyntax............................................................... 100
CommandFileKeywordsandExample ............................................... 100
GeneratingTestObject-SigningCertificates............................................... 102
GeneratingtheKeysandCertificate................................................... 102
UsingNetscapeSigningToolwithSmartCards ........................................... 104
WhatIsaSmartCard? .............................................................. 104
SettingUpaSmartCard............................................................. 104
Usingthe-MOptiontoListSmartCards .............................................. 106
UsingNetscapeSigningToolandaSmartCardtoSignFiles ............................. 106
NetscapeSigningToolandFIPS-140-1 ................................................... 107
UsingFIPS-140Mode ............................................................... 107
VerifyingFIPSMode................................................................ 108
AnswerstoCommonQuestions......................................................... 109
Chapter 14 SSL Debugging Tool . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113
Availability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113
Description........................................................................... 113
Syntax ............................................................................... 114
Options ........................................................................... 114
Examples ............................................................................ 115
Example1 ......................................................................... 116
Command ...................................................................... 116
Output ......................................................................... 116
Example2 ......................................................................... 120
Command ...................................................................... 120
Output ......................................................................... 120
Example3 ......................................................................... 123
Command ...................................................................... 123
Output ......................................................................... 123
Example4 ......................................................................... 124
Command ...................................................................... 124
Output ......................................................................... 124
UsageTips ........................................................................... 125
Chapter 15 SSLStrengthTool ................................................ 127
Availability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127
Syntax ............................................................................... 127
OptionsandArguments............................................................. 128

7
Usage................................................................................128
RestrictingCiphers..................................................................129
ExportPolicyandStep-up ...........................................................129
Examples.............................................................................130
Example1 .........................................................................130
Example2 .........................................................................131
Example3 .........................................................................131
Chapter 16 Security Module Database Tool . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133
Availability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133
Syntax ...............................................................................134
OptionsandArguments .............................................................134
Usage................................................................................137
JARInstallationFile....................................................................138
SampleScript ......................................................................138
ScriptGrammar ....................................................................139
Keys .................................................................................140
GlobalKeys ........................................................................140
Per-PlatformKeys ..................................................................142
Per-FileKeys .......................................................................143
Examples.............................................................................144
CreatingDatabaseFiles..............................................................145
DisplayingModuleInformation ......................................................145
SettingaDefaultProvider............................................................146
EnablingaSlot .....................................................................147
EnablingFIPSCompliance ...........................................................147
Adding a Cryptographic Module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148
Installing a Cryptographic Module from a JAR File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148
ChangingthePasswordonaToken ...................................................150
Index ....................................................................... 151

8 Netscape Certificate Management System Command-Line Tools Guide • October 2001

9
About This Guide
The Command-Line Tools Guide describes various command-line tools or utilities
that are bundled with Netscape Certificate Management System (CMS). It provides
the information such as the command syntax, platform support, examples, and so
on, required to use these tools.
This preface has the following sections:
• What You Should Already Know (page 9)
• What’s in This Guide (page 10)
• Conventions Used in This Guide (page 11)
• Where to Go for Related Information (page 13)
What You Should Already Know
This guide is intended for experienced system administrators who are planning to
deploy Certificate Management System. CMS agents should refer to CMS Agent’s
Guide for information on how to perform agent tasks, such as handling certificate
requests and revoking certificates.
This guide assumes that you
• Are familiar with the basic concepts of public-key cryptography and the Secure
Sockets Layer (SSL) protocol.
❍SSL cipher suites
❍The purpose of and major steps in the SSL handshake

What’s in This Guide
10 Netscape Certificate Management System Command-Line Tools Guide • October 2001
• Understand the concepts of intranet, extranet, and the Internet security and the
role of digital certificates in a secure enterprise. These include the following
topics:
❍Encryption and decryption
❍Public keys, private keys, and symmetric keys
❍Significance of key lengths
❍Digital signatures
❍Digital certificates, including various types of digital certificates
❍The role of digital certificates in a public-key infrastructure (PKI)
❍Certificate hierarchies
If you are new to these concepts, we recommend that you read the
security-related appendixes ( Appendix D and Appendix E ) of the
accompanying manual, Managing Servers with Netscape Console.
• Are familiar with the role of Netscape Console in managing Netscape version
4.x servers. Otherwise, see the accompanying manual, Managing Servers with
Netscape Console.
• Are reading this guide in conjunction with the documentation listed in “Where
to Go for Related Information” on page 13.
What’s in This Guide
This guide covers the following topics:
• Chapter 1, “Command-Line Tools” Provides an overview of the command-line
tools provided with Certificate Management System, including the ones that
are not covered in this documentation.
• Chapter 2, “Password Cache Utility” Describes how to use the tool for
managing the single sign-on password cache.
• Chapter 3, “Kill Process Tool” Describes how to use the tool for terminating
CMS process if the server fails to respond to a start, restart, or stop commands.
• Chapter 4, “PIN Generator Tool” Describes how to use the tool for generating
unique PINs for your users and for populating their directory entries with
PINs.