Netscape NETSCAPE MANAGEMENT SYSTEM 4.5 -... User manual

Command-Line Tools Guide
Netscape Certificate Management System
Version4.5
October 2001

Netscape Communications Corporation (“Netscape”), a subsidiary of America Online, Inc., and its licensors retain all ownership rights to
the software programs offered by Netscape (referred to herein as “Software”) and related documentation. Use of the Software and related
documentation is governed by the license agreement accompanying the Software and applicable copyright law.
Your right to copy this documentation is limited by copyright law. Making unauthorized copies, adaptations, or compilation works is
prohibited and constitutes a punishable violation of the law. Netscape may revise this documentation from time to time without notice.
THIS DOCUMENTATION IS PROVIDED “AS IS” WITHOUT WARRANTY OF ANY KIND. IN NO EVENT SHALL NETSCAPE BE
LIABLE FOR INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES OF ANY KIND ARISING FROM ANY ERROR IN
THIS DOCUMENTATION, INCLUDING WITHOUT LIMITATION ANY LOSS OR INTERRUPTION OF BUSINESS, PROFITS, USE, OR
DATA.
Software applications: © 2001 Sun Microsystems, Inc.
Some software code: © 1999, 2001 Netscape Communications Corporation.
All rights reserved.
Netscape and the Netscape N logo are registered trademarks of Netscape Communications Corporation in the United States and other
countries. Other Netscape logos, product names, and service names are also trademarks of Netscape Communications Corporation, which
may be registered in other countries. Other product and brand names are the exclusive property of their respective owners.
The downloading, exporting, or reexporting of Netscape software or any underlying information or technology must be in full compliance
with all United States and other applicable laws and regulations. Any provision of Netscape software or documentation to the U.S.
Government is with restricted rights as described in the license agreement accompanying Netscape software.

3
Contents
AboutThisGuide............................................................... 9
WhatYouShouldAlreadyKnow ..........................................................9
What’sinThisGuide....................................................................10
ConventionsUsedinThisGuide .........................................................11
WheretoGoforRelatedInformation......................................................13
Chapter 1 Command-LineTools................................................ 15
Chapter 2 Password Cache Utility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Location...............................................................................19
Syntax ................................................................................20
Usage.................................................................................20
ChangingtheSingleSign-OnPassword.................................................21
ListingtheContentsofthePasswordCache .............................................21
Adding a New Entry to the Password Cache . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
ChangingthePasswordofanEntryinthePasswordCache ...............................22
DeletinganEntryFromthePasswordCache ............................................23
CreatingaNewPasswordCache.......................................................24
Chapter 3 KillProcessTool ................................................... 25
Location...............................................................................25
Syntax ................................................................................25
Usage.................................................................................26
Chapter 4 PIN Generator Tool . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
LocatingthePINGeneratorTool .........................................................27

4 Netscape Certificate Management System Command-Line Tools Guide • October 2001
ThesetpinCommand................................................................... 28
Command-LineSyntax............................................................... 28
Arguments....................................................................... 28
Example ......................................................................... 32
HowtheToolWorks ................................................................... 32
InputFile........................................................................... 35
OutputFile ......................................................................... 36
HowPINsAreStoredintheDirectory ................................................. 37
ExitCodes.......................................................................... 38
Chapter 5 Extension Joiner Tool . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
Location .............................................................................. 40
Syntax ................................................................................ 40
Usage................................................................................. 40
Chapter 6 BackingUpandRestoringData ....................................... 43
BackupandRestoreTools ............................................................... 43
BackingUpData ....................................................................... 44
WhattheBackupToolDoes........................................................... 44
WhattheBackupToolDoesNotDo.................................................... 46
RunningtheBackupTool............................................................. 47
AfterYouFinishaBackup ............................................................ 48
RestoringData......................................................................... 49
BeforeYouRestoreData.............................................................. 49
RunningtheRestoreTool............................................................. 50
Chapter 7 ASCIItoBinaryTool................................................. 53
Availability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
Syntax ................................................................................ 53
Example .............................................................................. 54
Chapter 8 BinarytoASCIITool................................................. 55
Availability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
Syntax ................................................................................ 55
Example .............................................................................. 56
Chapter 9 PrettyPrintCertificateTool........................................... 57
Availability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
Syntax ................................................................................ 57
Example .............................................................................. 58

5
Chapter 10 PrettyPrintCRLTool............................................... 61
Availability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
Syntax ................................................................................61
Example...............................................................................62
Chapter 11 Certificate Database Tool . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65
Availability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65
Syntax ................................................................................66
OptionsandArguments ..............................................................66
Usage.................................................................................70
Examples..............................................................................71
CreatingaNewCertificateDatabase ...................................................71
ListingCertificatesinaDatabase.......................................................72
CreatingaCertificateRequest .........................................................72
CreatingaCertificate.................................................................73
Adding a Certificate to the Database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
ValidatingaCertificate ...............................................................74
Chapter 12 KeyDatabaseTool ................................................. 77
Availability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
Syntax ................................................................................78
OptionsandArguments ..............................................................78
Usage.................................................................................80
Examples..............................................................................81
CreatingaKeyDatabase..............................................................81
GeneratingaNewKey ...............................................................82
DisplayingPublicKeyInformation.....................................................83
ListingKeyIDs ......................................................................83
DeletingaPrivateKey................................................................84
Chapter 13 Netscape Signing Tool . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
IntroductiontoNetscapeSigningTool ....................................................85
WhatIsNetscapeSigningTool? .......................................................86
JARFormatandJARArchives.........................................................87
WhatSigningaFileMeans ............................................................88
Object-SigningCertificates ............................................................88
UsingNetscapeSigningTool.............................................................89
GettingReadytoUseNetscapeSigningTool ............................................90
SettingUpYourCertificate .........................................................90
ListingAvailableCertificates .......................................................91
SigningaFile........................................................................92
UsingNetscapeSigningToolwithaZIPUtility ..........................................93

6 Netscape Certificate Management System Command-Line Tools Guide • October 2001
TipsandTechniques ................................................................. 93
SignToolSyntaxandOptions ............................................................ 95
CommandSyntax ................................................................... 95
CommandOptions .................................................................. 95
CommandFileSyntax............................................................... 100
CommandFileKeywordsandExample ............................................... 100
GeneratingTestObject-SigningCertificates............................................... 102
GeneratingtheKeysandCertificate................................................... 102
UsingNetscapeSigningToolwithSmartCards ........................................... 104
WhatIsaSmartCard? .............................................................. 104
SettingUpaSmartCard............................................................. 104
Usingthe-MOptiontoListSmartCards .............................................. 106
UsingNetscapeSigningToolandaSmartCardtoSignFiles ............................. 106
NetscapeSigningToolandFIPS-140-1 ................................................... 107
UsingFIPS-140Mode ............................................................... 107
VerifyingFIPSMode................................................................ 108
AnswerstoCommonQuestions......................................................... 109
Chapter 14 SSL Debugging Tool . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113
Availability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113
Description........................................................................... 113
Syntax ............................................................................... 114
Options ........................................................................... 114
Examples ............................................................................ 115
Example1 ......................................................................... 116
Command ...................................................................... 116
Output ......................................................................... 116
Example2 ......................................................................... 120
Command ...................................................................... 120
Output ......................................................................... 120
Example3 ......................................................................... 123
Command ...................................................................... 123
Output ......................................................................... 123
Example4 ......................................................................... 124
Command ...................................................................... 124
Output ......................................................................... 124
UsageTips ........................................................................... 125
Chapter 15 SSLStrengthTool ................................................ 127
Availability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127
Syntax ............................................................................... 127
OptionsandArguments............................................................. 128

7
Usage................................................................................128
RestrictingCiphers..................................................................129
ExportPolicyandStep-up ...........................................................129
Examples.............................................................................130
Example1 .........................................................................130
Example2 .........................................................................131
Example3 .........................................................................131
Chapter 16 Security Module Database Tool . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133
Availability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133
Syntax ...............................................................................134
OptionsandArguments .............................................................134
Usage................................................................................137
JARInstallationFile....................................................................138
SampleScript ......................................................................138
ScriptGrammar ....................................................................139
Keys .................................................................................140
GlobalKeys ........................................................................140
Per-PlatformKeys ..................................................................142
Per-FileKeys .......................................................................143
Examples.............................................................................144
CreatingDatabaseFiles..............................................................145
DisplayingModuleInformation ......................................................145
SettingaDefaultProvider............................................................146
EnablingaSlot .....................................................................147
EnablingFIPSCompliance ...........................................................147
Adding a Cryptographic Module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148
Installing a Cryptographic Module from a JAR File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148
ChangingthePasswordonaToken ...................................................150
Index ....................................................................... 151

8 Netscape Certificate Management System Command-Line Tools Guide • October 2001

9
About This Guide
The Command-Line Tools Guide describes various command-line tools or utilities
that are bundled with Netscape Certificate Management System (CMS). It provides
the information such as the command syntax, platform support, examples, and so
on, required to use these tools.
This preface has the following sections:
• What You Should Already Know (page 9)
• What’s in This Guide (page 10)
• Conventions Used in This Guide (page 11)
• Where to Go for Related Information (page 13)
What You Should Already Know
This guide is intended for experienced system administrators who are planning to
deploy Certificate Management System. CMS agents should refer to CMS Agent’s
Guide for information on how to perform agent tasks, such as handling certificate
requests and revoking certificates.
This guide assumes that you
• Are familiar with the basic concepts of public-key cryptography and the Secure
Sockets Layer (SSL) protocol.
❍SSL cipher suites
❍The purpose of and major steps in the SSL handshake

What’s in This Guide
10 Netscape Certificate Management System Command-Line Tools Guide • October 2001
• Understand the concepts of intranet, extranet, and the Internet security and the
role of digital certificates in a secure enterprise. These include the following
topics:
❍Encryption and decryption
❍Public keys, private keys, and symmetric keys
❍Significance of key lengths
❍Digital signatures
❍Digital certificates, including various types of digital certificates
❍The role of digital certificates in a public-key infrastructure (PKI)
❍Certificate hierarchies
If you are new to these concepts, we recommend that you read the
security-related appendixes ( Appendix D and Appendix E ) of the
accompanying manual, Managing Servers with Netscape Console.
• Are familiar with the role of Netscape Console in managing Netscape version
4.x servers. Otherwise, see the accompanying manual, Managing Servers with
Netscape Console.
• Are reading this guide in conjunction with the documentation listed in “Where
to Go for Related Information” on page 13.
What’s in This Guide
This guide covers the following topics:
• Chapter 1, “Command-Line Tools” Provides an overview of the command-line
tools provided with Certificate Management System, including the ones that
are not covered in this documentation.
• Chapter 2, “Password Cache Utility” Describes how to use the tool for
managing the single sign-on password cache.
• Chapter 3, “Kill Process Tool” Describes how to use the tool for terminating
CMS process if the server fails to respond to a start, restart, or stop commands.
• Chapter 4, “PIN Generator Tool” Describes how to use the tool for generating
unique PINs for your users and for populating their directory entries with
PINs.

Conventions Used in This Guide
About This Guide 11
• Chapter 5, “Extension Joiner Tool” Describes how to use the tool for joining
MIME-64 encoded formats of certificate extensions to create a single blob.
• Chapter 7, “ASCII to Binary Tool” Describes how to use the tool for converting
ASCII data to its binary equivalent.
• Chapter 8, “Binary to ASCII Tool” Describes how to use the tool for converting
binary data to its ASCII equivalent.
• Chapter 9, “Pretty Print Certificate Tool” Describes how to use the tool for
printing or viewing the contents of a certificate stored as ASCII base-64 encoded data in
a human-readable form.
• Chapter 10, “Pretty Print CRL Tool” Describes how to use the tool for printing
or viewing the contents of a CRL stored as ASCII base-64 encoded data in a
human-readable form.
• Chapter 11, “Certificate Database Tool” Describes how to use the tool for
manipulating the certificate database.
• Chapter 12, “Key Database Tool” Describes how to use the tool for
manipulating the key database.
• Chapter 13, “Netscape Signing Tool” Describes how to use the tool to associate
a digital signature with any file, including CMS log files.
• Chapter 14, “SSL Debugging Tool” Describes how to use the tool for testing
and debugging purposes.
• Chapter 15, “SSL Strength Tool” Describes how to use the tool for testing and
debugging purposes.
• Chapter 16, “Security Module Database Tool” Describes the Password Cache
Utility and explains how to use it for managing the single sign-on password
cache.
Conventions Used in This Guide
This guide uses the following conventions:
The following conventions are used in this guide:
•Monospaced font—Thistypefaceisusedforanytextthatappearsonthe
computer screen or text that you should type. It’s also used for filenames,
functions, and examples.
Example: Server Root is the directory where the CMS binaries are kept.

Conventions Used in This Guide
12 Netscape Certificate Management System Command-Line Tools Guide • October 2001
•Italic—Italic type is used for emphasis, book titles, and glossary terms.
Example: This control depends on the access permissions the superadministrator
has set up for you.
• Text within “quotation marks”—Indicates cross-references to other topics
within this guide.
Example: For more information, see “Issuing a Certificate to a New User” on
page 154.
•[]—Square brackets enclose commands that are optional.
Example: PrettyPrintCert <input_file> [<output_file>]
<input_file> specifies the path to the file that contains the base-64
encoded certificate.
<output_file> specifies the path to the file to write the certificate. This
argument is optional; if you don’t specify an output file, the certificate
information is written to the standard output.
•<>—Angle brackets enclose variables or placeholders. When following
examples, replace the angle brackets and their text with text that applies to
your situation. For example, when path names appear in angle brackets,
substitute the path names used on your computer.
Example: Using Netscape Communicator 4.7x or later, enter the URL for the
Administration Server: http://<hostname>:<port_number>
•/—A forward slash is used to separate directories in a path. If you use the
Windows NT operating system, you should replace / with \ in paths.
Example: Except for the Security Module Database Tool, you can find all the
other command-line utilities at this location: <server_root>/bin/cert/tools
• Sidebar text—Sidebar text marks important information. Make sure you read
the information before continuing with a task.
Examples:
NOTE You can use Netscape Console only when Administration Server is
up and running.
CAUTION A caution note documents a potential risk of losing data, damaging
software or hardware, or otherwise disrupting system performance.

Where to Go for Related Information
About This Guide 13
Where to Go for Related Information
This section summarizes the documentation that ships with Certificate
Management System, using these conventions:
•<server_root> is the directory where the CMS binaries are kept (specified
during installation).
•<instance_id> is the ID for this instance of Certificate Management System
(specified during installation).
The documentation set for Certificate Management System includes the following:
•Managing Servers with Netscape Console
Provides background information on basic cryptography concepts and the role
of Netscape Console.
For the HTML version, open this file:
<server_root>/manual/en/admin/help/contents.htm
•CMS Installation and Setup Guide
Describes how to plan for, install, and administer Certificate Management
System. To access the installation and configuration information from within
the CMS Installation Wizard or from the CMS window (within Netscape
Console), click any help button.
To view the HTML version of this guide, open this file:
<server_root>/manual/en/cert/setup_guide/contents.htm
To view the PDF version of this guide, open this file:
<server_root>/manual/en/cert/pdf/cms45setup.pdf
•CMS Plug-ins Guide
Provides detailed reference information on CMS plug-ins. To access this
information from the CMS window within Netscape Console, click any help
button.
To view the HTML version of this guide, open this file:
<server_root>/manual/en/cert/plugin_guide/contents.htm
To view the PDF version of this guide, open this file:
<server_root>/manual/en/cert/pdf/cms45plugin.pdf
•CMS Command-Line Tools Guide (this guide)
Provides detailed reference information on CMS tools.

WheretoGoforRelatedInformation
14 Netscape Certificate Management System Command-Line Tools Guide • October 2001
To view the HTML version of this guide, open this file:
<server_root>/manual/en/cert/tools_guide/contents.htm
To view the PDF version of this guide, open this file:
<server_root>/manual/en/cert/pdf/cms45tools.pdf
•CMS Customization Guide
Provides detailed reference information on customizing the HTML-based
agent and end-entity interfaces.
To view the HTML version of this guide, open this file:
<server_root>/manual/en/cert/custom_guide/contents.htm
To view the PDF version of this guide, open this file:
<server_root>/manual/en/cert/pdf/cms45custom.pdf
•CMSAgent’sGuide
Provides detailed reference information on CMS agent interfaces. To access
this information from the Agent Services pages, click any help button.
To view the HTML version of this guide, open this file:
<server_root>/<instance_id>/web/agent/manual/agent_guide/
contents.htm
To view the PDF version of this guide, open this file:
<server_root>/manual/en/cert/pdf/cms45agent.pdf
•End-EntityHelp
Provides detailed reference information on CMS end-entity interfaces. To
access this information from the end-entity pages, click any help button.
To view the HTML version of this guide, open this file:
<server_root>/<instance_id>/web/ee/manual/ee_guide/contents.htm
For a complete list of CMS documentation, open the
<server_root>/manual/index.html file. For the latest information about
Certificate Management System, check the CMS Release Notes.
CAUTION Do not change the default location of any of the HTML files; they are
used for online help. You may move the PDF files to another
location.

15
Chapter 1
Command-Line Tools
Netscape Certificate Management System (CMS) is bundled with various
command-line utilities. This chapter summarizes these utilities and provides
pointers to chapters that further explain them.
Table 1-1 summarizes the command-line utilities that are bundled with Certificate
Management System.
Table 1-1 Summary of command-line utilities
Utility/Tool Function
Batch/Shell Scripts located under <server_root>/bin/cert/tools/ (require jre):
PasswordCache
(Password Cache Utility) Manipulates the contents of the single sign-on password cache. For details, see Chapter 2, “Password Cache Utility.”
AtoB
(ASCII to Binary Tool) Converts ASCII base-64 encoded data to binary base-64 encoded data. For details, see Chapter 7, “ASCII to Binary Tool.”
BtoA
(Binary to ASCII Tool) Converts binary base-64 encoded data to ASCII base-64 encoded data. For details, see Chapter 8, “Binary to ASCII Tool.”
PrettyPrintCert
(Pretty Print Certificate
Tool)
PrintsthecontentsofacertificatestoredasASCIIbase-64encoded
data in a human-readable form. For details, see Chapter 9, “Pretty
Print Certificate Tool.”
PrettyPrintCrl
(Pretty Print CRL Tool) Prints the contents of a CRL stored as ASCII base-64 encoded data in a human-readable form. For details, see Chapter 10, “Pretty
Print CRL Tool.”
Executable tools located under <server_root>/bin/cert/tools:
certutil
(Certificate Database Tool) View and manipulate the certificate database (cert7.db) contents. For details, see Chapter 11, “Certificate Database Tool.”
keyutil
(Key Database Tool) View and manipulate the key database (key3.db)contents.For details, see Chapter 12, “Key Database Tool.”

16 Netscape Certificate Management System Command-Line Tools Guide • October 2001
killproc
(Kill Process Tool)
Kills or terminates system processes in Windows NT. For details,
see Chapter 3, “Kill Process Tool.”
setpin
(PIN Generator tool) Generates PINs for end users for directory- and PIN-based authentication. For details, see Chapter 4, “PIN Generator Tool.”
signtool
(Netscape Signing Tool) Digitally signs any file, including log files. For details, see Chapter 13, “Netscape Signing Tool.”
sslstrength
(SSL Strength Tool) Connects to an SSL server and reports back the type and strength of the encryption cipher that it’s using. For details, see Chapter 15,
“SSL Strength Tool.”
ssltap
(SSL Debugging Tool) Used to debug SSL applications. For details, see Chapter 14, “SSL Debugging Tool.”
Perl Scripts located under <server_root> (require_perl):
cmsbackup Copies all of the pertinent data and configuration files for a CMS
instance, the local Administration Server, and local Netscape
Directory Servers that the instance uses into a compressed archive.
For details, see Chapter 6, “Backing Up and Restoring Data.”
cmsrestore Opens a named archive, extracts the data, and uses it to restore the
configuration of a CMS instance. For details, see Chapter 6,
“Backing Up and Restoring Data.”
Executable tools located under <server_root>/shared/bin:
modutil
(Security Module Database
Tool)
Used for managing the PKCS #11 module information within
secmod.db files or within hardware tokens. For details, see
Chapter 16, “Security Module Database Tool.”
Third-party executable tools located under <server_root>/bin/cert/tools:
dumpasn1 Dumps the contents of binary base-64-encoded data. Note that the
tool is freeware that is packaged with Certificate Management
System for your convenience. For more information about this
tool, check this site: http://www.cs.auckland.ac.nz/~pgut001/
Third-party support tools located under <server_root>:
bin/base/jre/bin/jre
bin/cert/jre/bin/jre
Java runtime executable for Netscape Console.
Java runtime executable for Certificate Management System.
Note that the CMS jre is invoked as cms_daemon during CMS
installation and configuration, as cms_watchdog to monitor the
status of the CMS server, and as cms_server to actually run the
CMS server.
Table 1-1 Summary of command-line utilities (Continued)
Utility/Tool Function

Chapter 1 Command-Line Tools 17
The AtoB,BtoA,PrettyPrintCert,PrettyPrintCrl,anddumpasn1 tools are
useful for converting back and forth between various encodings and formats you
may encounter when dealing with keys and certificates.
The Password Cache Utility can be used to manipulate the contents of an existing
single sign-on password cache and to create a new cache.
The Certificate Database Tool, Key Database Tool, and Security Module Database
Tool are useful for a variety of administrative tasks that involve manipulating
certificate and key databases.
The PIN Generator tool is used to create PINs for directory authentication. The
killproc tool is used to terminate the Java virtual machines, called jre processes,
when Certificate Management System becomes unresponsive.
The Netscape Signing Tool can be used to associate a digital signature with any file,
including CMS log files.
The SSL Strength Tool and SSL Debugging Tool are useful for testing and
debugging purposes.
bin/cert/tools/unzip Decompression utility executable.
bin/cert/tools/zip Compression utility executable.
install/perl perl scripting language executable.
NOTE If you find any problems in Certificate Database Tool (certutil),
Key Database Tool (keyutil),NetscapeSigningTool(signtool),
SSL Debugging Tool (ssltap), and SSL Strength Tool
(sslstrength), you may obtain the source code and build
instructions for the very latest version of these tools (and/or
potentially a binary image for the newer tool) at the following URL:
http://www.mozilla.org/projects/security/pki/nss/tools/
index.html
Note that all Key Database Tool functions have now been
incorporated into the single tool, Certificate Database Tool, and that
several of the command-line options for many of the tools may
have changed. Be sure to check back often to obtain the very latest
version of the desired security tool, as this site will be updated
often.
Table 1-1 Summary of command-line utilities (Continued)
Utility/Tool Function

18 Netscape Certificate Management System Command-Line Tools Guide • October 2001

19
Chapter 2
Password Cache Utility
During the installation of Netscape Certificate Management System (CMS), the
watchdog stores all the passwords required by the server for starting up—such as
passwords for the internal or external tokens, the bind password used by
Certificate Management System to access and update the internal database, the
bind password used by Certificate Management System to access and update the
LDAP directory used for authentication or publishing—in a password cache. The
cache is maintained in a file encrypted using the single sign-on password you
specify during installation.
The command-line utility named PasswordCache enables you to manipulate the
contents of the password cache. You will be required to manipulate the password
cache for various reasons. For example, assume you’ve configured the Certificate
Manager to publish certificates and CRLs to an LDAP directory and have
configured it to bind to the directory with Directory Manager’s DN and password.
If the directory administrator changes the Directory Manager’s password, the
Certificate Manager will fail to bind to the directory during startup. You can
resolve this problem by modifying the corresponding bind password in the cache
using the PasswordCache utility.
This chapter has the following sections:
• Location (page 19)
• Syntax (page 20)
• Usage (page 20)
LocationThe PasswordCache utility is located with the rest of the command-line tools in
this directory: <server_root>/bin/cert/tools

Syntax
20 Netscape Certificate Management System Command-Line Tools Guide • October 2001
Syntax You can run the utility by executing the following command from the
<server_root>/cert-<instance_id> directory:
PasswordCache <sso_password> <command>
where <sso_password> specifies the current single sign-on password and
<command> can be any of the following:
❍list
❍add <password_name> <password>
❍change <password_name> <password>
❍delete <password_name>
❍changesso <new_sso_password>
❍create
<password_name> specifies the string (describing the password usage) you
want to add to, or modify or delete from the cache; it is equivalent to the
value assigned to the bindPWPrompt or tokenname parameter in the CMS
configuration file.
<password> specifies the new password.
<new_sso_password> specifies the new single sign-on password.
Usage You can use the PasswordCache utility for the following:
• Changing the single sign-on password
• Listing or viewing the contents of the password cache
• Adding a new entry to the cache
• Changing the password associated with an entry
• Deleting an entry in the cache
NOTE YoumustrunthePasswordCache utility from the
<server_root>/cert-<instance_id> directory.