Netscape NETSCAPE MANAGEMENT SYSTEM 6.1 -... User manual

Command-Line Tools Guide
Netscape Certificate Management System
Version6.1
February 2003

Netscape Communications Corporation ("Netscape") and its licensors retain all ownership rights to the software programs offered by
Netscape (referred to herein as "Software") and related documentation. Use of the Software and related documentation is governed by the
license agreement for the Software and applicable copyright law.
Your right to copy this documentation is limited by copyright law. Making unauthorized copies, adaptations or compilation works is
prohibited and constitutes a punishable violation of the law. Netscape may revise this documentation from time to time without notice.
THIS DOCUMENTATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN NO EVENT SHALL NETSCAPE BE LIABLE
FOR INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES OF ANY KIND ARISING FROM ANY ERROR IN THIS
DOCUMENTATION, INCLUDING WITHOUT LIMITATION ANY LOSS OR INTERRUPTION OF BUSINESS, PROFITS, USE, OR DATA.
The Software and documentation are copyright © 2001 Sun Microsystems, Inc. Portions copyright 1999, 2002-2003 Netscape
Communications Corporation. All rights reserved.
Netscape and the Netscape N logo are registered trademarks of Netscape Communications Corporation in the United States and other
countries. Other Netscape logos, product names, and service names are also trademarks of Netscape Communications Corporation, which
may be registered in some countries. Other product and brand names are the exclusive property of their respective owners.
The downloading, exporting, or reexporting of Netscape software or any underlying information or technology must be in full compliance
with all United States and other applicable laws and regulations. Any provision of Netscape software or documentation to the U.S.
government is with restricted rights as described in the license agreement for that Software.

3
Contents
About This Guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Who Should Read This Guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
What You Should Know . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
What’s in This Guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Conventions Used in This Guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Documentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Chapter 1 Command-Line Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Chapter 2 CMS Upgrade Utility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Before Upgrading . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Backing Up Your Previous CMS Instance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Upgrading . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
After Upgrading . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
Chapter 3 Password Cache Utility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
Location . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
Usage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
Listing the Contents of the Password Cache . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
Generating a new Protection Key for the Password Cache . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
Adding a New Entry to the Password Cache . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
Changing the Password of an Entry in the Password Cache . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
Deleting an Entry From the Password Cache . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

4 Netscape Certificate Management System Command-Line Tools Guide • February 2003
Chapter 4 AuditVerify . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
About the AuditVerify Tool . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
Setting Up the Auditor’s Database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
Audit Verify Tool Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
Return Values . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
Using the Audit Verify Tool . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
Chapter 5 PIN Generator Tool . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
Locating the PIN Generator Tool . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
The setpin Command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
Command-Line Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
How the Tool Works . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
Input File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
Output File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
How PINs Are Stored in the Directory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
Exit Codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
Chapter 6 Extension Joiner Tool . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
Location . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
Usage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
Chapter 7 Backing Up and Restoring Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
Backup and Restore Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
Backing Up Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62
What the Backup Tool Does . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
What the Backup Tool Does Not Do . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65
Running the Backup Tool . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65
After You Finish a Backup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66
Signing Backup Data Using cmsutil . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67
Verifying Signed Backup Data using cmsutil . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
Restoring Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70
Before You Restore Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
Running the Restore Tool . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72
Chapter 8 ASCII to Binary Tool . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
Location . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78

5
Chapter 9 Binary to ASCII Tool . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79
Location . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79
Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79
Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80
Chapter 10 Pretty Print Certificate Tool . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
Location . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
Examples . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82
Chapter 11 Pretty Print CRL Tool . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
Location . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86
Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89

6 Netscape Certificate Management System Command-Line Tools Guide •February 2003

7
About This Guide
The Command-Line Tools Guide describes various command-line tools or utilities
that are bundled with Netscape Certificate Management System (CMS). It provides
the information such as the command syntax, platform support, examples, and so
on, required to use these tools.
This preface has the following sections:
•Who Should Read This Guide
•What You Should Know
•What’s in This Guide
•Conventions Used in This Guide
•Documentation
Who Should Read This Guide
This guide is intended for experienced system administrators who are planning to
deploy Certificate Management System. CMS agents should refer to CMS Agent’s
Guide for information on how to perform agent tasks, such as handling certificate
requests and revoking certificates.
What You Should Know
This guide assumes that you
•Are familiar with the basic concepts of public-key cryptography and the Secure
Sockets Layer (SSL) protocol.

What’s in This Guide
8 Netscape Certificate Management System Command-Line Tools Guide •February 2003
❍SSL cipher suites
❍The purpose of and major steps in the SSL handshake
•Understand the concepts of intranet, extranet, and the Internet security and the
role of digital certificates in a secure enterprise. These include the following
topics:
❍Encryption and decryption
❍Public keys, private keys, and symmetric keys
❍Significance of key lengths
❍Digital signatures
❍Digital certificates, including various types of digital certificates
❍The role of digital certificates in a public-key infrastructure (PKI)
❍Certificate hierarchies
If you are new to these concepts, we recommend that you read the
security-related appendixes of the accompanying manual, Managing Servers
with Netscape Console.
What’s in This Guide
This guide contains the following topics:
Chapter 1 “Command-Line
Tools”Provides an overview of the command-line tools provided with Certificate Management System,
including the ones that are not covered in this
documentation.
Chapter 2 “CMS Upgrade
Utility”Describes how to use the utility to upgrade from a previous release of Certificate Management
System.
Chapter 3 “Password Cache
Utility”Describes how to use the tool for managing the single sign-on password cache.
Chapter 4 “AuditVerify”Describes how to use the tool used to verify
signed audit logs.

Conventions Used in This Guide
About This Guide 9
Conventions Used in This Guide
The following conventions are used in this guide:
Chapter 5 “PIN Generator
Tool”Describes how to use the tool for generating unique PINs for your users and for populating
their directory entries with PINs.
Chapter 6 “Extension Joiner
Tool”Describes how to use the tool for joining MIME-64 encoded formats of certificate
extensions to create a single blob.
Chapter 7 “Backing Up and
Restoring Data”Describes how to use the tools for backing up, signing, verifying, and restoring data to a CMS
instance.
Chapter 8 “ASCII to Binary
Tool”Describes how to use the tool for converting ASCII data to its binary equivalent.
Chapter 9 “Binary to ASCII
Tool”Describes how to use the tool for converting binary data to its ASCII equivalent.
Chapter 10 “Pretty Print
Certificate Tool”Describes how to use the tool for printing or
viewing the contents of a certificate stored as ASCII
base-64 encoded data in a human-readable form.
Chapter 11 “Pretty Print
CRL Tool”Describes how to use the tool for printing or
viewing the contents of a CRL stored as ASCII base-64
encoded data in a human-readable form.
Monospaced font This typeface is used for any text that appears on the
computer screen or text that you should type. It’s also
used for filenames, functions, and examples.
Example: Server Root is the directory where the CMS
binaries are kept.
Italic Italic type is used for emphasis, book titles, and
glossary terms.
Example: This control depends on the access
permissions the super administrator has set up for you.
Boldface Boldface type is used for various UI components such
as captions and field names, and the terminology
explained in the glossary.

Conventions Used in This Guide
10 Netscape Certificate Management System Command-Line Tools Guide •February 2003
Notes and Cautions:
Example:
Rotationfrequency. From the drop-down list, select the
interval at which the server should rotate the active
error log file. The available choices are Hourly, Daily,
Weekly, Monthly, and Yearly. The default selection is
Monthly.
Monospaced [] Square brackets enclose commands that are optional.
Example:
PrettyPrintCert <input_file> [<output_file>]
<input_file> specifies the path to the file that contains
the base-64 encoded certificate.
<output_file> specifies the path to the file to write the
certificate. This argument is optional; if you don’t
specify an output file, the certificate information is
written to the standard output.
Monospaced <> Angle brackets enclose variables or placeholders. When
following examples, replace the angle brackets and
their text with text that applies to your situation. For
example, when path names appear in angle brackets,
substitute the path names used on your computer.
Example: Using Netscape Communicator 4.7 or later,
enter the URL for the Netscape Administration Server:
http://<hostname>:<port_number>
/A slash is used to separate directories in a path.
Example: Except for the Security Module Database
Tool, you can find all the other command-line utilities
at this location: <server_root>/bin/cert/tools
NOTE A note alerts you to information that may be of interest to you.
CAUTION A caution signals a potential risk of losing data, damaging software
or hardware, or otherwise disrupting system performance.

Documentation
About This Guide 11
Documentation
All documentation is installed with the product and can be accessed from the help
system. Further, the documentation can also be accessed from the installed product
in the following directory:
<server_root>/manual/en/
The documentation set for CMS includes the following:
Managing Servers with Netscape Console
Provides background information on basic cryptography concepts and the role of
Netscape Console.
CMS Administrator’s Guide
Describes how to plan for, install, and administer CMS.
CMS Command-Line Tools Guide (this guide)
Provides detailed reference information on CMS tools.
CMS Customization Guide
Provides detailed reference information on customizing the HTML-based agent
and end-entity interfaces.
CMS Agent’s Guide
Provides detailed reference information on CMS agent interfaces. To access this
information from the Agent Services pages, click any help button.

Documentation
12 Netscape Certificate Management System Command-Line Tools Guide •February 2003

13
Chapter 1
Command-Line Tools
Netscape Certificate Management System (CMS) is bundled with various
command-line utilities. This chapter summarizes these utilities and provides
pointers to chapters that further explain them.
Table 1-1 summarizes the command-line utilities that are bundled with Certificate
Management System.
Table 1-1 Summary of command-line utilities
Utility/Tool Function
Batch/Shell Scripts located under <server_root>/bin/cert/tools/ (requires
<server_root>/bin/cert/jre/bin/java): :
AtoB
(ASCII to Binary Tool) Converts ASCII base-64 encoded data to binary base-64 encoded data. For details, see Chapter 8, “ASCII to Binary Tool.”
AuditVerify
(Signed Audit Verification Tool)
A command line utility utilized to verify signatures in signed
audit log files. For details, see Chapter 4, “AuditVerify.”
BtoA
(Binary to ASCII Tool) Converts binary base-64 encoded data to ASCII base-64 encoded data. For details, see Chapter 9, “Binary to ASCII Tool.”
CMCEnroll
(CMC Enrollment Utility)
A command line utility used to sign a certificate enrollment
request with an agent's certificate. For details, see the CMC Enroll
Utility in the Administrator's Guide.
CMCRevoke
(CMC Revocation Utility)
A command line utility used to sign a revocation request with an
agent's certificate. For details, see the CMC Revoke Utility in the
Administrator's Guide.
CRMFPopClient
(CRMF Pop Request Tool)
A command line utility used to generate CRMF requests with
proof of possession (POP).

14 Netscape Certificate Management System Command-Line Tools Guide •February 2003
ExtJoiner (Extension Joiner Tool) A command line utility utilized to join a sequence of extensions
together so that the final output can be used in the configuration
wizard for specifying extra extensions in default certificates (i. e. -
CA certificate, SSL certificate). For details, see Chapter 6,
“Extension Joiner Tool.”
GenExtKeyUsage (Key Usage
Extension Tool) A command line utility utilized to generate a DER-encoded Extended Key Usage extension. The first parameter is the
criticality of the extension, true or false. The OIDs to be included
in the extension are passed as command-line arguments. The
OIDs are described in RFC 2459. For example, the OID for code
signing is 1.3.6.1.5.5.7.3.3.
GenIssuerAltNameExt (Issuer
Alternative Name Extension Tool) A command line utility utilized to generate an issuer alternative name extension in base-64 encoding. The encoding output can be
used with the configuration wizard, using parameter pairs where
the first parameter specifies the general type from among
"DNSName", "EDIPartyName", "IPAddressName", "URIName",
"RFC822Name", "OIDName", or "X500Name", and the second
parameter specifies a general name for this type.
GenSubjectAltNameExt (Subject
Alternative Name Extension Tool) A command line utility utilized to generate a subject alternative name extension in base-64 encoding. The encoding output can be
used with the configuration wizard, using parameter pairs where
the first parameter specifies the general type from among
"DNSName", "EDIPartyName", "IPAddressName", "URIName",
"RFC822Name", "OIDName", or "X500Name", and the second
parameter specifies a general name for this type.
PasswordCache
(Password Cache Utility) Manipulates the contents of the single sign-on password cache. For details, see Chapter 3, “Password Cache Utility.”
PQGGen (PQG Generation Tool) A command line utility utilized to generate the P, Q, and G values
required by the DSA algorithm. See RFC 2459, section 7.3.3: DSA
Signature Keys for more information.
PrettyPrintCert
(Pretty Print Certificate Tool) Prints the contents of a certificate stored as ASCII base-64 encoded data in a human-readable form. For details, see Chapter 10,
“Pretty Print Certificate Tool.”
PrettyPrintCrl
(Pretty Print CRL Tool) Prints the contents of a CRL stored as ASCII base-64 encoded data in a human-readable form. For details, see Chapter 11, “Pretty
Print CRL Tool.”
Executable tools located under <server_root>/bin/cert/tools:
Table 1-1 Summary of command-line utilities (Continued)
Utility/Tool Function

Chapter 1 Command-Line Tools 15
bulkissuance
(Bulk Issuance Tool)
A command line utility utilized to send either a KEYGEN or
CRMF enrollment request to the bulk issuance interface for the
automatic creation of certificates.
certutil
(Certificate and Key Database Tool) View and manipulatethe certificate database (cert8.db) and key database (key3.db) contents. For details, check the
http://www.mozilla.org/projects/security/pki/nss
/tools/. site.
cmsutil
(Cryptographic Message Syntax tool) A command line tool used to perform basic Cryptographic Message Syntax operations related to encrypting, decrypting, and
signing messages using S/MIME. For details, check the
http://www.mozilla.org/projects/security/pki/nss
/tools/. site.
crlutil
(Certificate Revocation List utility) A command line tool used to manage CRLs within the certificate database.
pk12util
(PKCS #12 utility) A command line tool used to import and export keys and certificates between the cert/key databases and files in PKCS #12
format. For details, check the
http://www.mozilla.org/projects/security/pki/nss
/tools/. site.
revoker (automation utility) A command line tool which may be conveniently utilized to
automate user management scripts used to revoke certificates.
setpin
(PIN Generator tool) Generates PINs for end users for directory- and PIN-based authentication. For details, see Chapter 5, “PIN Generator Tool.”
This tool utilizes a configuration file called "setpin.conf".
signtool
(Netscape Signing Tool) Digitally signs any file, including log files. For details, check the http://www.mozilla.org/projects/security/pki/nss
/tools/. site.
signver
(Netscape Signature Verification Tool) A command line tool used to create digitally-signed jar archives containing files and/or code. For details, check the
http://www.mozilla.org/projects/security/pki/nss
/tools/. site.
ssltap
(SSL Debugging Tool) Used to debug SSL applications. For details, check the http://www.mozilla.org/projects/security/pki/nss
/tools/. site.
Batch/Shell Scripts located under <server_root>/bin/cert/upgrade/ (requires
<server_root>/bin/cert/jre/bin/java):
Table 1-1 Summary of command-line utilities (Continued)
Utility/Tool Function

16 Netscape Certificate Management System Command-Line Tools Guide •February 2003
Upgrade Utility
(Upgrade an old CMS version to CMS
6.1)
Upgrades from a CMS 4.2, CMS 4.2 (SP 2), 4.5, or 6.0 instance to a
CMS 6.1 instance. For details, see Chapter 2, “CMS Upgrade
Utility.”
Batch/Shell Scripts located under <server_root>/cert-<instance> (requires <server_root>/install/perl):
cmsbackup
(Backup a CMS instance) Copies all of the pertinent data and configuration files for a CMS instance, the local Administration Server, and local Netscape
Directory Servers that the instance uses into a compressed archive.
For details, see Chapter 7, “Backing Up and Restoring Data.”This
tool utilizes two Perl support scripts located in
<server_root>/bin/cert/tools called "CMSBackup.pl" and
"CMSCommon.pl".
cmsrestore
(Restore a backed-up CMS
instance)
Opens a named archive, extracts the data, and uses it to restore the
configuration of a CMS instance. For details, see Chapter 7,
“Backing Up and Restoring Data.”This tool utilizes two Perl
support scripts located in <server_root>/bin/cert/tools called
"CMSCommon.pl" and "CMSRestore.pl".
Common Criteria Batch/Shell Scripts and executable tools located under <server_root>/bin/cert/tools:
cmssuid (execute
setuid/setgid program tool) A command line utility existing ONLY on Solaris platform versions of the CMS server used to launch processes as
setuid/setgid scripts. This program is intended for use with CMS
when it must be set up as a Common Criteria Target of Evaluation.
This tool utilizes a configuration file called "/etc/cmssuid.cfg", a
sample of which is included in the <server_root>/bin/cert/tools
directory.
toecrle.sh (ld.config Bourne
shell script) A Bourne shell script existing ONLY on Solaris platform versions of the CMS server used to configure the "/var/ld/ld.config"
database. This script is intended for use withCMS when it mustbe
set up as a Common Criteria Target of Evaluation.
toperms.sh (permissions
Bourne shell script) A Bourne shell script existing ONLY on Solaris platform versions of the CMS server used to set permissions on various files and
directories. This script is intended for use with CMS when it must
be set up as a Common Criteria Target of Evaluation.
Executable tools located under <server_root>/shared/bin:
modutil
(Security Module Database Tool) Used for managing the PKCS #11 module information within secmod.db files or within hardware tokens. For details, check the
http://www.mozilla.org/projects/security/pki/nss
/tools/. site.
Third-party executable tools located under <server_root>/bin/cert/tools:
Table 1-1 Summary of command-line utilities (Continued)
Utility/Tool Function

Chapter 1 Command-Line Tools 17
The Certificate Database Tool (certutil), Netscape Signing Tool (signtool),
Netscape Signature Verification Tool (signver), PKCS #12 Utility (pk12util),
Cryptographic Message Syntax Tool (cmsutil), SSL Debugging Tool (ssltap), and
Security Database Tool (modutil) are a part of Network Security Services (NSS)
tools. The remaining tools are either CMS-specific tools or Third-party support
tools.
•The AtoB, BtoA, PrettyPrintCert, PrettyPrintCrl, and dumpasn1 tools are
useful for converting back and forth between various encodings and formats
you may encounter when dealing with keys and certificates.
•The Password Cache Utility can be used to manipulate the contents of an
existing single sign-on password cache and to create a new cache.
•The PIN Generator tool is used to create PINs for directory authentication.
dumpasn1
(Display the contents of
binary base-64 encoded data)
Dumps the contents of binary base-64-encoded data. Note that the
tool is freeware that is packaged with Certificate Management
System for your convenience. For more information about this
tool, check this site:
http://www.cs.auckland.ac.nz/~pgut001/
This tool utilizes a configuration file called "dumpasn1.cfg". A
statement regarding the licensing of this executable and
configuration file is located in the <server_root>/bin/cert/tools
directory in a file called "README".
Third-party support tools located under <server_root>:
bin/base/jre/bin/jre
(Client JVM runtime) Java runtime executable for Netscape Console (utilizes the Client JVM).
bin/cert/jre/bin/jre
(Server JVM runtime) Java runtime executable for Certificate Management System (utilizes the Server JVM).
bin/cert/tools/unzip
(Decompression utility) Decompression utility executable. The third-party license for this utility is contained in the <server_root>/bin/cert/tools directory
in a file called "infozip_license".
bin/cert/tools/zip
(Compression utility) Compression utility executable. The third-party license for this utility is contained in the <server_root>/bin/cert/tools directory
in a file called "infozip_license".
install/perl
(Perl scripting language) perl scripting language executable.
Table 1-1 Summary of command-line utilities (Continued)
Utility/Tool Function

18 Netscape Certificate Management System Command-Line Tools Guide •February 2003
•The Certificate and Key Database Tool and Security Module Database Tool are
useful for a variety of administrative tasks that involve manipulating certificate
and key databases.
•The Netscape Signing Tool can be used to associate a digital signature with any
file, including CMS log files.
•The SSL Debugging Tool is useful for testing and debugging purposes.
If you find any problems with NSS tools, you may obtain the source code and build
instructions for the very latest version of these tools (and/or potentially a binary
image for the newer tool) at the following URL:
http://www.mozilla.org/projects/security/pki/nss/tools/index.html
If you’re familiar with older versions of NSS tools, notice that all Key Database
Tool functions have now been incorporated into the single tool, Certificate
Database Tool, and that several of the command-line options for many of the tools
may have changed. Be sure to check back often to obtain the very latest version of
the desired security tool, as this site is updated often.

19
Chapter 2
CMS Upgrade Utility
If you have a previous installation of Netscape Certificate Management System
(Certificate Management System), you can use the CMS Upgrade utility for
upgrading to Certificate Management System, version 6.1. The utility enables you
to upgrade from the following releases of Certificate Management System (CMS)
to the CMS 6.1 release:
•CMS 4.2
•CMS 4.2 (SP 1)
•CMS 4.2 (SP 1a)
•CMS 4.2 (SP 2)
•CMS 4.5
•CMS 6.0
•CMS 6.01
NOTE: Always perform the steps in the upgrade procedure for each and every
instance to be migrated!
There are three phases to upgrading from a previous CMS instance. This chapter
explains these phases in the following sections:
•“Before Upgrading,”on page 20
•“Upgrading,”on page 20
•“After Upgrading,”on page 31

Before Upgrading
20 Netscape Certificate Management System Command-Line Tools Guide •February 2003
Before Upgrading
Before upgrading from a CMS 4.2, 4.2 (SP 1), 4.2 (SP 1a), 4.2 (SP 2), 4.5, or 6.0
instance to a CMS 6.1 instance, you must complete the following tasks:
•Backing Up Your Previous CMS Instance
Backing Up Your Previous CMS Instance
You must backup your existing CMS 4.2, 4.2 (SP 1), 4.2 (SP 1a), 4.2 (SP 2), 4.5, or 6.0
instance before you can upgrade to CMS 6.1.
•For instructions to back up a CMS 4.2, 4.2 (SP 1), 4.2 (SP 1a), 4.2 (SP 2), or 4.5
instance, check the CMS Command-Line Tools Guide that was provided with the
product; open the <server_root>/manual/en/cert/tools/backup.htm file.
You can also find the CMS 4.5 documentation at this site:
http://enterprise.netscape.com/docs/cms/index.html
•For instructions to back up a CMS 6.0 instance, see Chapter 7, “Backing Up and
Restoring Data.”
Upgrading
This section provides instructions for migrating to CMS 6.1 from earlier versions.
1. Install and Configure CMS 6.1
The migration tools are available in the following directory:
<61_server_root>/bin/cert/upgrade
2. Stop the CMS 6.1 instance. To stop the instance do the following:
a. Go to the following directory:
<61_server_root>/cert-<instance>
b. Execute the following command:
stop-cert
3. Copy the key (cert7.db, key3.db) into CMS 6.1's alias directory. To do this,
follow these steps:
a. Go to the following directory:
<old_server_root>