Netscape NETSCAPE MANAGEMENT SYSTEM 6.0 -... User manual

Command-Line Tools Guide
Netscape Certificate Management System
Version6.0
March 2002

Netscape Communications Corporation ("Netscape") and its licensors retain all ownership rights to the software programs offered by
Netscape (referred to herein as "Software") and related documentation. Use of the Software and related documentation is governed by the
license agreement for the Software and applicable copyright law.
Your right to copy this documentation is limited by copyright law. Making unauthorized copies, adaptations or compilation works is
prohibited and constitutes a punishable violation of the law. Netscape may revise this documentation from time to time without notice.
THIS DOCUMENTATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN NO EVENT SHALL NETSCAPE BE LIABLE
FOR INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES OF ANY KIND ARISING FROM ANY ERROR IN THIS
DOCUMENTATION, INCLUDING WITHOUT LIMITATION ANY LOSS OR INTERRUPTION OF BUSINESS, PROFITS, USE, OR DATA.
The Software and documentation are copyright © 2001 Sun Microsystems, Inc. Portions copyright 1999, 2002 Netscape Communications
Corporation. All rights reserved.
Netscape and the Netscape N logo are registered trademarks of Netscape Communications Corporation in the United States and other
countries. Other Netscape logos, product names, and service names are also trademarks of Netscape Communications Corporation, which
may be registered in some countries. Other product and brand names are the exclusive property of their respective owners.
The downloading, exporting, or reexporting of Netscape software or any underlying information or technology must be in full compliance
with all United States and other applicable laws and regulations. Any provision of Netscape software or documentation to the U.S.
government is with restricted rights as described in the license agreement for that Software.

3
Contents
AboutThisGuide............................................................... 9
WhatYouShouldAlreadyKnow ..........................................................9
What’sinThisGuide....................................................................10
ConventionsUsedinThisGuide .........................................................11
WheretoGoforRelatedInformation......................................................13
Chapter 1 Command-LineTools................................................ 15
Chapter 2 Password Cache Utility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Location...............................................................................19
Syntax ................................................................................20
Usage.................................................................................20
ListingtheContentsofthePasswordCache .............................................21
Adding a New Entry to the Password Cache . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
ChangingthePasswordofanEntryinthePasswordCache ...............................22
DeletinganEntryFromthePasswordCache ............................................23
Chapter 3 KillProcessTool ................................................... 25
Location...............................................................................25
Syntax ................................................................................25
Usage.................................................................................26
Chapter 4 PIN Generator Tool . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
LocatingthePINGeneratorTool .........................................................27
ThesetpinCommand ...................................................................28
Command-LineSyntax ...............................................................28

4 Netscape Certificate Management System Command-Line Tools Guide • March 2002
Arguments....................................................................... 28
Example ......................................................................... 31
HowtheToolWorks ................................................................... 32
InputFile........................................................................... 34
OutputFile ......................................................................... 36
HowPINsAreStoredintheDirectory ................................................. 37
ExitCodes.......................................................................... 37
Chapter 5 Extension Joiner Tool . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
Location .............................................................................. 40
Syntax ................................................................................ 40
Usage................................................................................. 40
Chapter 6 BackingUpandRestoringData ....................................... 43
BackupandRestoreTools ............................................................... 43
BackingUpData ....................................................................... 44
WhattheBackupToolDoes........................................................... 44
WhattheBackupToolDoesNotDo.................................................... 47
RunningtheBackupTool............................................................. 47
AfterYouFinishaBackup ............................................................ 48
RestoringData......................................................................... 49
BeforeYouRestoreData.............................................................. 49
RunningtheRestoreTool............................................................. 51
Chapter 7 ASCIItoBinaryTool................................................. 55
Location .............................................................................. 55
Syntax ................................................................................ 55
Example .............................................................................. 56
Chapter 8 BinarytoASCIITool................................................. 57
Location .............................................................................. 57
Syntax ................................................................................ 57
Example .............................................................................. 58
Chapter 9 PrettyPrintCertificateTool........................................... 59
Location .............................................................................. 59
Syntax ................................................................................ 59
Example .............................................................................. 60
Chapter 10 PrettyPrintCRLTool............................................... 63
Location .............................................................................. 63

5
Syntax ................................................................................63
Example...............................................................................64
Chapter 11 Certificate Database Tool . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67
Location...............................................................................67
Syntax ................................................................................68
OptionsandArguments ..............................................................68
Usage.................................................................................72
Examples..............................................................................73
CreatingaNewCertificateDatabase ...................................................73
ListingCertificatesinaDatabase.......................................................74
CreatingaCertificateRequest .........................................................74
CreatingaCertificate.................................................................75
Adding a Certificate to the Database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
ValidatingaCertificate ...............................................................76
Chapter 12 KeyDatabaseTool ................................................. 79
Location...............................................................................79
Syntax ................................................................................80
OptionsandArguments ..............................................................80
Usage.................................................................................82
Examples..............................................................................83
CreatingaKeyDatabase..............................................................83
GeneratingaNewKey ...............................................................84
DisplayingPublicKeyInformation.....................................................85
ListingKeyIDs ......................................................................85
DeletingaPrivateKey................................................................86
Chapter 13 Netscape Signing Tool . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87
IntroductiontoNetscapeSigningTool ....................................................87
WhatIsNetscapeSigningTool? .......................................................88
JARFormatandJARArchives.........................................................89
WhatSigningaFileMeans ............................................................90
Object-SigningCertificates ............................................................90
UsingNetscapeSigningTool.............................................................91
GettingReadytoUseNetscapeSigningTool ............................................92
SettingUpYourCertificate .........................................................92
ListingAvailableCertificates .......................................................93
SigningaFile........................................................................94
UsingNetscapeSigningToolwithaZIPUtility ..........................................95
TipsandTechniques .................................................................95
SignToolSyntaxandOptions ............................................................97

6 Netscape Certificate Management System Command-Line Tools Guide • March 2002
CommandSyntax ................................................................... 97
CommandOptions .................................................................. 97
CommandFileSyntax............................................................... 102
CommandFileKeywordsandExample ............................................... 102
GeneratingTestObject-SigningCertificates............................................... 104
GeneratingtheKeysandCertificate................................................... 104
UsingNetscapeSigningToolwithSmartCards ........................................... 106
WhatIsaSmartCard? .............................................................. 106
SettingUpaSmartCard............................................................. 106
Usingthe-MOptiontoListSmartCards .............................................. 108
UsingNetscapeSigningToolandaSmartCardtoSignFiles ............................. 108
NetscapeSigningToolandFIPS-140-1 ................................................... 109
UsingFIPS-140Mode ............................................................... 109
VerifyingFIPSMode................................................................ 110
AnswerstoCommonQuestions......................................................... 111
Chapter 14 SSL Debugging Tool . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115
Location ............................................................................. 115
Description........................................................................... 115
Syntax ............................................................................... 116
Options ........................................................................... 116
Examples ............................................................................ 117
Example1 ......................................................................... 118
Command ...................................................................... 118
Output ......................................................................... 118
Example2 ......................................................................... 122
Command ...................................................................... 122
Output ......................................................................... 122
Example3 ......................................................................... 125
Command ...................................................................... 125
Output ......................................................................... 125
Example4 ......................................................................... 126
Command ...................................................................... 126
Output ......................................................................... 126
UsageTips ........................................................................... 127
Chapter 15 SSLStrengthTool ................................................ 129
Location ............................................................................. 129
Syntax ............................................................................... 129
OptionsandArguments............................................................. 130
Usage................................................................................ 130
RestrictingCiphers ................................................................. 131

7
ExportPolicyandStep-up ...........................................................131
Examples.............................................................................132
Example1 .........................................................................132
Example2 .........................................................................133
Example3 .........................................................................133
Chapter 16 Security Module Database Tool . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135
Location..............................................................................135
Syntax ...............................................................................136
OptionsandArguments .............................................................136
Usage................................................................................139
JARInstallationFile....................................................................140
SampleScript ......................................................................140
ScriptGrammar ....................................................................141
Keys .................................................................................142
GlobalKeys ........................................................................142
Per-PlatformKeys ..................................................................144
Per-FileKeys .......................................................................145
Examples.............................................................................146
CreatingDatabaseFiles..............................................................147
DisplayingModuleInformation ......................................................147
SettingaDefaultProvider............................................................148
EnablingaSlot .....................................................................149
EnablingFIPSCompliance ...........................................................149
Adding a Cryptographic Module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150
Installing a Cryptographic Module from a JAR File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150
ChangingthePasswordonaToken ...................................................152
Index ....................................................................... 153

8 Netscape Certificate Management System Command-Line Tools Guide • March 2002

9
About This Guide
The Command-Line Tools Guide describes various command-line tools or utilities
that are bundled with Netscape Certificate Management System (CMS). It provides
the information such as the command syntax, platform support, examples, and so
on, required to use these tools.
This preface has the following sections:
• What You Should Already Know (page 9)
• What’s in This Guide (page 10)
• Conventions Used in This Guide (page 11)
• Where to Go for Related Information (page 13)
What You Should Already Know
This guide is intended for experienced system administrators who are planning to
deploy Certificate Management System. CMS agents should refer to CMS Agent’s
Guide for information on how to perform agent tasks, such as handling certificate
requests and revoking certificates.
This guide assumes that you
• Are familiar with the basic concepts of public-key cryptography and the Secure
Sockets Layer (SSL) protocol.
❍SSL cipher suites
❍The purpose of and major steps in the SSL handshake

What’s in This Guide
10 Netscape Certificate Management System Command-Line Tools Guide • March 2002
• Understand the concepts of intranet, extranet, and the Internet security and the
role of digital certificates in a secure enterprise. These include the following
topics:
❍Encryption and decryption
❍Public keys, private keys, and symmetric keys
❍Significance of key lengths
❍Digital signatures
❍Digital certificates, including various types of digital certificates
❍The role of digital certificates in a public-key infrastructure (PKI)
❍Certificate hierarchies
If you are new to these concepts, we recommend that you read the
security-related appendixes of the accompanying manual, Managing Servers
with Netscape Console.
• Are familiar with the role of Netscape Console in managing Netscape version
6.x servers. Otherwise, see the accompanying manual, Managing Servers with
Netscape Console.
• Are reading this guide in conjunction with the documentation listed in “Where
to Go for Related Information” on page 13.
What’s in This Guide
This guide covers the following topics:
• Chapter 1, “Command-Line Tools” Provides an overview of the command-line
tools provided with Certificate Management System, including the ones that
are not covered in this documentation.
• Chapter 2, “Password Cache Utility” Describes how to use the tool for
managing the single sign-on password cache.
• Chapter 3, “Kill Process Tool” Describes how to use the tool for terminating
CMS process if the server fails to respond to a start, restart, or stop commands.
• Chapter 4, “PIN Generator Tool” Describes how to use the tool for generating
unique PINs for your users and for populating their directory entries with
PINs.