ćæć¤ćć«ćÆä½ć®ć”ćć«ć§ććļ¼ē§ćć”ćÆ話ćć¦ććå
¬ééµć¤ć³ćć©ć¹ćć©ćÆćć£å
¬ééµęå·č¦ę ¼ļ¼å
¬ééµęå·åęØęŗć«åŗć„ćć¦- ļ¼PKI / IECå
¬ééµåŗē¤ļ¼ - PKCSćļ¼ććććŖććÆćć¼ć¤ć³ćć©ć¹ćć©ćÆćć£ć«ćÆćććććęä½ććććć®ćć¾ćć¾ćŖćŖććøć§ćÆććØć”ć«ććŗć ćććć³ćŖććøć§ćÆćć®ēøäŗä½ēØć®ććć®ćććć³ć«ļ¼TLSćOCSPćŖć©ļ¼ćå«ć¾ćć¦ćć¾ćć PKI / PKIćŖććøć§ćÆćć«ćÆćx509čؼęęøćØćć¼ćć¢ļ¼ē§åÆéµćØå
¬ééµļ¼ćē½²åććć³ęå·åćććććć„ć”ć³ćļ¼pkcsļ¼7ćCMSļ¼ćē§åÆéµćę ¼ē“ććććć®å®å
ØćŖć³ć³ććć¼ļ¼pkcsļ¼8ļ¼ćććć³éµä»ćć®ē§åÆčؼęęøļ¼pkcsļ¼ 12ļ¼ćŖć©ćć®ć”ć«ććŗć ć«ćÆććć¾ćć¾ćŖć¢ć«ć“ćŖćŗć ćä½æēØćć¦ććć„ć”ć³ććęå·åććć³ē½²åć§ććęå·åę©č½ć ćć§ćŖććęØęŗļ¼čؼęęøćč¦ę±ćē½²å/ęå·åćććććć„ć”ć³ćććććć³ć«ććć±ć¼ćøćŖć©ļ¼ć«å¾ć£ć¦PKIćØć³ććŖććøć§ćÆććå½¢ęććę©č½ćå«ć¾ćć¾ćć .Pćļ¼ććÆććććć¦äø央ć®PKI / PKIćŖććøć§ćÆććč¦ćć¦ććŖćę¹ę³-čŖå®ć»ć³ćæć¼ļ¼CAļ¼ć
ć¤ć³ćæć¼ćććć¦ć¼ć¶ć¼ćÆćē„ććŖććć”ć«ććć¾ćć¾ćŖPKI / PKIć”ć«ććŗć ćØćŖććøć§ćÆććä½æēØćć¾ććććØćć°ććć¾ćć¾ćŖćµć¤ćć«ć¢ćÆć»ć¹ćććØććé»åć”ć¼ć«ć«ē½²åććć³/ć¾ććÆęå·åćććØććć¾ććÆćÆć¼ćÆććć¼ć§é»åē½²åćä½æēØćććØćć«ćHTTPSćććć³ć«ćä½æēØćć¾ćć
ćććŖććÆćć¼ć¤ć³ćć©ć¹ćć©ćÆćć£ćä½ęććććć®ęćé«åŗ¦ćŖćć¼ć«ć§ććPKI / PKIć½ććć¦ć§ć¢ćć¼ć«ćÆćOpenSSLćØććććÆć¼ćÆć»ćć„ćŖćć£ćµć¼ćć¹ļ¼NSSļ¼ć§ćć
OpenSSLćÆćć»ć¼ćć¹ć¦ć®ä½ć¬ćć«ć®ććć·ć„ćęå·åćććć³é»åē½²åć¢ć«ć“ćŖćŗć ććµćć¼ćććę¬ę ¼ēćŖćŖć¼ćć³ć½ć¼ć¹ć®ęå·åć©ć¤ćć©ćŖćØć¦ć¼ćć£ćŖćć£ć®ć»ććć§ćććRSAćDHćDSAćECćć¼ć®ä½ęćēŗč”ćŖć©ćäøč¬ēćŖęå·åęØęŗć®ć»ćØćć©ćå®č£ ćć¦ćć¾ćć X.509čؼęęøććć¼ćæć®ęå·åćØē½²åćSSL / TLSę„ē¶ć®ä½ęć
OpenSSLć¦ć¼ćć£ćŖćć£ćę©č½ćććŖććøć§ćÆććÆććć”ć¤ć«ļ¼čؼęęøććć¼ļ¼ć«ę ¼ē“ććć¦ććććØć«ę³Øęćć¦ćć ćććććććÆć¼ćÆć»ćć„ćŖćć£ćµć¼ćć¹ļ¼NSSļ¼ćÆć
ę¬ę ¼ēćŖćŖć¼ćć³ć½ć¼ć¹ć®ęå·åć©ć¤ćć©ćŖćØć¦ć¼ćć£ćŖćć£ć®åćć»ććć§ćć
OpenSSLćØNSSć®äø»ćŖéććÆćOpenSSLćÆčؼęęøćØćć¼ććć”ć¤ć«ć«ę ¼ē“ććć¦ćććØę³å®ćć¦ććć®ć«åƾććNSSćÆPKCSļ¼11ćć¼ćæćć¼ć¹ćØćć¼ćÆć³ćä½æēØćć¦čؼęęøćØćć¼ćę ¼ē“ćć¦ććććØć§ćć
ęćéč¦ćŖććØćÆćäø”ę¹ć®ćććøć§ćÆćļ¼OpenSSLćØNSSļ¼ćå³åÆć«ęØęŗć«ęŗę ćć¦ćććććē°ćŖććććøć§ćÆćć§äøē·ć«ä½æēØćć¦ćåé”ććŖćććØć§ćććććć®é£é¦ć®ćć®ćććŖčÆćä¾ćÆćććØćć°ććµć¤ć/ćć¼ćæć«ćOpenSSLć«åŗć„ćmod_sslćåććApacheć«åŗć„ćć¦ę§ēÆćććććććøć®ć¢ćÆć»ć¹ćTLS 1.0 / TLS1.2ććć³TLS1.3ććµćć¼ćććFirefoxćä»ćć¦å®č”ćććå “åćHTTPSćććć³ć«ć®ä½æēØć«å½¹ē«ć”ć¾ćć NSSć©ć¤ćć©ćŖćä½æēØćć¦å®č”ććć¾ćć
OpenSSLććć³NSSć¦ć¼ćć£ćŖćć£ćä½æēØćć¦åćåé”ćč§£ę±ŗććę¹ę³ć仄äøć«ē¤ŗćć¾ććå°ę„ēć«ćÆćčŖ°ććčŖåć®å„½ćæć«åććć¦ć¦ć¼ćć£ćŖćć£ćä½æēØć§ććććć«ćŖćć¾ćć
ćć®ć¦ć¼ćć£ćŖćć£ć¾ććÆćć®ć¦ć¼ćć£ćŖćć£ć®ć½ć¼ć¹ć³ć¼ććč¦ććØćčŖ°ć§ćć©ć¤ćć©ćŖé¢ę°ć«ē²¾éććććØćć§ćć¾ćć
ćć”ć¤ć«ć«äæåććć¦ććčؼęęøććć®ä»ć®ćØć³ćć£ćć£ćč”Øē¤ŗćć
OpenSSLććć±ć¼ćøć«ćÆ1ć¤ć®ć¦ć¼ćć£ćŖćć£ćććć¾ć-opensslććć®ęåć®ćć©ć”ć¼ćæćÆć³ćć³ćčŖä½ļ¼ęØęŗć³ćć³ćļ¼ć§ćććå®č”ććåæ č¦ćććć¾ćć
$ opensslćć«ć
Standard commands
asn1parse ca ciphers cms
crl crl2pkcs7 dgst dhparam
dsa dsaparam ec ecparam
enc engine errstr exit
gendsa genpkey genrsa help
list nseq ocsp passwd
pkcs12 pkcs7 pkcs8 pkey
pkeyparam pkeyutl prime rand
rehash req rsa rsautl
s_client s_server s_time sess_id
smime speed spkac srp
ts verify version x509
Message Digest commands (see the `dgst' command for more details)
blake2b512 blake2s256 gost md2
md4 md5 rmd160 sha1
sha224 sha256 sha384 sha512
Cipher commands (see the `enc' command for more details)
aes-128-cbc aes-128-ecb aes-192-cbc aes-192-ecb
aes-256-cbc aes-256-ecb base64 bf
bf-cbc bf-cfb bf-ecb bf-ofb
camellia-128-cbc camellia-128-ecb camellia-192-cbc camellia-192-ecb
camellia-256-cbc camellia-256-ecb cast cast-cbc
cast5-cbc cast5-cfb cast5-ecb cast5-ofb
des des-cbc des-cfb des-ecb
des-ede des-ede-cbc des-ede-cfb des-ede-ofb
des-ede3 des-ede3-cbc des-ede3-cfb des-ede3-ofb
des-ofb des3 desx idea
idea-cbc idea-cfb idea-ecb idea-ofb
rc2 rc2-40-cbc rc2-64-cbc rc2-cbc
rc2-cfb rc2-ecb rc2-ofb rc4
rc4-40 rc5 rc5-cbc rc5-cfb
rc5-ecb rc5-ofb seed seed-cbc
seed-cfb seed-ecb seed-ofb zlib
$
ć覧ć®ćØćććopenssl helpć³ćć³ććå®č”ćććØćć³ćć³ćčŖä½ć®ćŖć¹ćć«å ćć¦ććµćć¼ćććć¦ććććć·ć„ć¢ć«ć“ćŖćŗć ćØęå·åć¢ć«ć“ćŖćŗć ć®ćŖć¹ććč”Øē¤ŗććć¾ćļ¼ćŖć¹ćć«ćÆå§ēø®é¢ę°ćØbase64é¢ę°ćå«ć¾ćć¦ćć¾ćļ¼ć
čؼęęøļ¼x509ļ¼ćč¦ę±ļ¼reqļ¼ćć¾ććÆčؼęęø失å¹ćŖć¹ćļ¼crlļ¼ćč”Øē¤ŗććć«ćÆćꬔć®ć³ćć³ććå®č”ćć¾ć
ćopensslx509 [| req | crl] [-nameopt utf8] -inform PEM | DER -noout -in <ćć”ć¤ć«å> ..ć
ććØćć°ćꬔć®ć³ćć³ććå®č”ćć¾ćć
$openssl x509 -text -nameopt utf8 -inform PEM -noout -in cert.pemPEMļ¼base64ļ¼ļ¼-inform PEMļ¼ć§ćØć³ć³ć¼ććććutf-8ćØć³ć³ć¼ćļ¼-nameoptļ¼ć§ęåćå«ććć”ć¤ć«cert.pemļ¼-in cert.pemļ¼ć«ę ¼ē“ććć¦ććęč”å½¢å¼ļ¼x509 -textļ¼ć§čؼęęøć®å 容ćć³ć³ćć„ć¼ćæć¼ē»é¢ć«č”Øē¤ŗćć¾ćć utf8ļ¼ććć®å “åćPEMćØć³ć³ć¼ćć£ć³ć°ć®čؼęęøčŖä½ćÆē»é¢ć«č”Øē¤ŗććć¾ććļ¼-nooutļ¼ć
NSSććć±ć¼ćøć§ćÆćppć¦ć¼ćć£ćŖćć£ćÆåćććØćč”ćć¾ćć
ppć¦ć¼ćć£ćŖćć£ćÆćDERć¾ććÆPEMćØć³ć³ć¼ćć£ć³ć°ć§ASN.1ę§é ćå«ććć”ć¤ć«ć®PrettyPrintć¦ć¼ćć£ćŖćć£ć§ćć
Usage: pp [-t type] [-a] [-i input] [-o output] [-w] [-u], - c-čؼęęø;
- cr-čؼęęøć®č¦ę±ć
- pk-å ¬ééµ;
- pk-å ¬ééµćć”ć¤ć«ć
- crl-åćę¶ćććčؼęęøć®ćŖć¹ćć
čؼęęøć«é©ēØćććå„ć®ćæć¤ćć§ććciļ¼certificate-identityļ¼ć«ę³Øęćć¦ćć ććććć®ćæć¤ćć§ćÆććµććøć§ćÆćļ¼ęęč ļ¼ćēŗč”č ļ¼ēŗč”č ļ¼ćć·ćŖć¢ć«ēŖå·ļ¼ć·ćŖć¢ć«ēŖå·ļ¼ćęē“ļ¼SHA-1ććć³SHA-256ęē“ļ¼ćŖć©ć®čå„ę å ±ćčؼęęøććåå¾ć§ćć¾ćć x509ć®opensslć¦ć¼ćć£ćŖćć£ć«ćåę§ć®ćć©ć”ć¼ćæćććć¾ćć
ććć©ć«ćć§ćÆććć¹ć¦ć®ćŖććøć§ćÆććÆDERćØć³ć³ć¼ćććć¦ćććØč¦ćŖććć¾ćććŖććøć§ćÆććPEMćØć³ć³ć¼ćć£ć³ć°ć®å “åćÆćć-aććć©ć”ć¼ćæćęå®ććåæ č¦ćććć¾ćļ¼opensslć¦ć¼ćć£ćŖćć£ć®ć-informPEMććć©ć”ć¼ćæćØåę§ļ¼ćć¾ćććŖććøć§ćÆćć«UTF-8ćØć³ć³ć¼ćć£ć³ć°ć®ęåćå«ć¾ćć¦ććå “åćÆććć1ć¤ć®ćć©ć”ć¼ćæć¼ć-uććčØå®ććć¾ćć opensslć¦ć¼ćć£ćŖćć£ć«ćåę§ć®ćć©ć”ć¼ćæć-nameoptutf8ććććććØćęćåŗćć¦ćć ććć
NSSććć±ć¼ćøć«ćÆććŖććøć§ćÆćć®ASN.1ę§é ćč”Øē¤ŗććććć®ć¦ć¼ćć£ćŖćć£ćå«ć¾ćć¦ćć¾ćććććÆopensslć¦ć¼ćć£ćŖćć£asn1.parseć®é”ä¼¼ē©ć§ćććććÆderdumpć¦ć¼ćć£ćŖćć£ć§ćļ¼
$derdump -i < > [-o < >]ć¦ć¼ćć£ćŖćć£ć®ååćććDERć§ćØć³ć³ć¼ććććå½¢å¼ć®ćć”ć¤ć«ć§ę©č½ććććØććććć¾ćććććććććÆ大äø夫ć§ćććć®ććć±ć¼ćøć«ćÆććć”ć¤ć«ćPEM / BASE64ćØć³ć³ć¼ćć£ć³ć°ććDERćØć³ć³ć¼ćć£ć³ć°ć«ćć¾ććÆćć®éć«å¤ęćć2ć¤ć®ć¦ć¼ćć£ćŖćć£ćå«ć¾ćć¦ćć¾ććććććÆatobććć³btoać¦ć¼ćć£ćŖćć£ć§ćć
ććØćć°ćOpenSSLć§čؼęęøćPEMå½¢å¼ććDERå½¢å¼ć«å¤ęććć«ćÆćꬔć®ć³ćć³ććå®č”ćć¾ćć
$openssl x509 -inform der -in CERT.der -out CERT.pem NSSć§ćÆćꬔć®ććć«ćŖćć¾ćć
$btoa -in CERT.der -out CERT.pem -w "CERTIFICATE"ć-wććŖćć·ć§ć³ćÆćåŗåćć”ć¤ć«ć®ęåćØęå¾ć«å«ććććć¹ććęå®ćć¾ćććć®å “åćć-w CERTIFICATEććÆćPEMęØęŗć®OpenSSLćććć¼ćØćć¬ć¼ć©ć¼ć«ćŖćć¾ćć
-----BEGIN CERTIFICATE-----
< BASE64>
-----END CERTIFICATE----- OpenSSLćØNSSćÆć©ć”ćććpkcsļ¼12ć³ć³ććć§åä½ćć¾ććć¾ććć©ć”ććpkcs12ć³ć³ććć®ä½ęć ćć§ćŖććć³ć³ćć³ćć®č”Øē¤ŗćåÆč½ć§ćććć ććopensslć¦ć¼ćć£ćŖćć£ćä½æēØććå “åćÆćęåć«ć³ć³ćććåč§£ććć³ć³ććć®čؼęęøćåå„ć®ćć”ć¤ć«ć«äæåććåæ č¦ćććć¾ćććć®å¾ćå®å Øć«č”Øē¤ŗć§ćć¾ććNSSć§ćÆćć³ć³ććć®å 容ć®č”Øē¤ŗć1åć®ćć¹ć§å®č”ć§ćć¾ćććććč”ćć«ćÆćꬔć®å½¢å¼ć®pk12utilć¦ć¼ćć£ćŖćć£ćä½æēØćć¾ćć
pk12util -l < pkcs12> [-W < pkcs12>] [-d < NSS>] [-h <>]ä¾ćć°ļ¼
$ pk12util -l cert_RSA.p12 -W 01234567
Certificate(has private key):
Data:
Version: 3 (0x2)
Serial Number: 3 (0x3)
Signature Algorithm: PKCS #1 SHA-1 With RSA Encryption
Issuer: "CN=CA-RSA"
Validity:
Not Before: Thu May 21 09:50:00 2020
Not After : Fri May 21 16:17:00 2021
Subject: "CN=soft.lissi.ru"
Subject Public Key Info:
Public Key Algorithm: PKCS #1 RSA Encryption
RSA Public Key:
Modulus:
a2:f3:e1:63:fd:4f:60:4e:a9:de:56:37:a6:be:54:f3:
3d:67:9a:68:9e:f1:47:69:e3:3a:10:b0:2e:88:0c:ef:
7c:7f:48:47:6b:c0:75:63:c7:13:23:88:9a:ff:9a:48:
30:6a:a0:52:53:6f:4e:e5:84:c0:a1:b0:50:a2:ab:3d:
f9:62:2c:d8:30:be:19:1b:c9:f4:b8:20:57:a1:8e:5e:
61:8c:a7:50:91:44:61:99:71:40:bb:dc:4c:b7:7c:67:
be:a0:71:26:9f:af:dd:69:63:84:7d:93:3f:92:1b:fb:
d1:78:d7:95:75:42:8e:14:a8:63:e2:7b:7d:ef:c8:74:
35:7c:39:44:82:ad:92:1f:98:0e:91:95:c8:d8:bd:41:
fc:44:7e:4d:f5:94:d1:cc:25:ea:df:69:d7:b1:d7:86:
ad:4d:03:f1:35:65:03:a6:84:f8:26:6e:9b:d3:c9:67:
d5:a5:a4:9e:c7:82:76:28:9f:90:14:f1:16:6a:29:5d:
f8:df:c6:6c:e4:21:0d:6f:c5:87:61:a0:65:e3:97:0f:
96:42:ad:7d:96:79:ef:1d:ab:6c:e3:a0:da:3a:65:d8:
39:69:f3:20:e2:b1:27:fe:cb:4c:8c:0c:f5:76:f2:65:
a0:c7:bb:08:b0:f5:50:c0:96:8a:30:e9:75:f7:56:65
Exponent: 65537 (0x10001)
Signed Extensions:
Name: Certificate Basic Constraints
Critical: True
Data: Is not a CA.
Name: Certificate Key Usage
Usages: Digital Signature
Non-Repudiation
Key Encipherment
Name: Certificate Subject Alt Name
DNS name: "lissi.ru"
Name: Certificate Type
Data: <SSL Server>
Name: Certificate Comment
Comment: "xca certificate"
Signature Algorithm: PKCS #1 SHA-1 With RSA Encryption
Signature:
12:8c:c3:7e:e9:18:5a:d7:ee:f8:10:8b:72:55:ba:ee:
8b:85:6c:aa:e3:de:58:26:a2:da:15:c6:3b:15:d9:82:
6d:02:33:16:cc:0c:84:9d:96:b0:67:d4:63:10:b5:42:
a1:c3:de:cb:40:6f:9b:9b:eb:c1:98:b6:66:55:ae:88:
56:14:02:5c:62:8c:bc:22:97:94:cf:53:da:2e:47:c1:
c6:83:dc:39:6f:0b:b8:39:4e:66:89:a3:9d:51:c6:e3:
bd:fc:9e:f3:7b:02:a4:77:bc:08:4e:89:e6:57:54:5c:
c1:cc:83:93:9e:4e:f5:41:4e:b5:13:bc:64:29:a9:8d:
ce:13:ae:48:6c:21:fc:da:2a:a2:87:67:f8:df:23:53:
08:a3:11:93:69:91:84:40:4b:58:c1:f3:d0:78:dc:33:
f6:a5:a6:6f:ed:39:a9:ec:f3:48:e8:06:09:4c:c3:9f:
9c:0f:58:80:7f:f5:09:40:2a:f1:cf:42:d7:5b:57:62:
99:e7:dc:a5:31:f3:9d:1f:5a:88:c2:30:1b:8c:ec:69:
8b:87:dc:4c:08:9e:70:49:3d:5e:7b:8f:6f:98:50:8b:
0d:b9:8f:c1:7e:9b:1f:c2:76:3a:ca:c5:e3:3d:ea:93:
81:c0:3b:e2:b7:d1:5d:e4:fd:48:d6:1b:8f:96:e2:18
Fingerprint (SHA-256):
D3:38:99:C9:8B:A5:49:96:BC:26:7B:10:1E:2A:7C:4B:55:15:E5:94:47:C6:D0:49:44:2E:48:58:1B:CF:83:7E
Fingerprint (SHA1):
D5:26:80:B7:CE:40:5B:54:85:F6:B2:31:58:C3:3E:9D:A4:3D:C1:F3
Friendly Name: soft.lissi.ru
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 1 (0x1)
Signature Algorithm: PKCS #1 SHA-1 With RSA Encryption
Issuer: "CN=CA-RSA"
Validity:
Not Before: Wed May 20 16:12:00 2020
Not After : Tue May 21 16:12:00 2030
Subject: "CN=CA-RSA"
Subject Public Key Info:
Public Key Algorithm: PKCS #1 RSA Encryption
RSA Public Key:
Modulus:
a3:ca:c1:3b:ac:17:1b:32:69:90:8c:70:3b:95:3e:78:
4c:90:55:27:2a:25:05:16:54:d3:88:69:b0:43:a0:20:
3d:ca:0d:a2:f9:a5:2f:8c:e1:69:b6:df:79:bd:25:7d:
aa:71:2b:f2:9f:82:f1:e7:49:cf:fa:3c:b6:6f:80:09:
b2:ee:d5:18:e3:3d:96:67:38:cb:9c:e8:e5:76:c4:a8:
0b:b9:ad:dd:42:25:c7:da:cf:d4:15:41:bf:b0:0e:4f:
d1:9c:b7:d0:b1:32:a0:c7:14:67:ba:a2:9a:e7:23:26:
d7:7e:32:d9:5d:15:47:9e:4b:b0:b1:8b:04:38:1e:c3:
b2:fc:17:fe:8e:d1:cb:de:de:fd:13:17:b3:0e:5b:58:
e1:37:c7:12:32:b6:94:82:77:b8:4c:87:99:c6:c3:7d:
51:ed:3c:41:73:31:aa:13:de:26:84:e7:f7:a9:34:e9:
b3:9e:7d:aa:91:65:79:a7:14:9d:fc:45:42:de:e6:43:
9d:67:96:94:66:38:0b:2e:32:0a:4d:c3:3d:14:b9:06:
6b:e0:92:e2:35:0c:8f:78:7f:2c:ad:ec:dc:67:66:0b:
8c:47:82:c5:0e:39:a5:35:75:b5:fb:7f:2d:07:97:ef:
15:d8:fc:d4:72:6a:da:32:86:9e:64:ea:4a:e3:37:5b
Exponent: 65537 (0x10001)
Signed Extensions:
Name: Certificate Basic Constraints
Critical: True
Data: Is a CA with no maximum path length.
Name: Certificate Key Usage
Usages: Certificate Signing
CRL Signing
Name: Certificate Type
Data: <SSL CA,S/MIME CA,ObjectSigning CA>
Name: Certificate Comment
Comment: "xca certificate"
Signature Algorithm: PKCS #1 SHA-1 With RSA Encryption
Signature:
24:90:ac:91:3f:13:f6:1a:d4:3c:1b:de:33:e1:4a:0c:
d8:27:a0:00:d2:43:c8:1b:13:90:93:d3:d2:f0:fe:79:
da:14:fd:34:2e:3a:f4:fc:c8:71:c9:4f:0d:65:c0:fd:
40:04:92:ef:7e:72:35:09:4a:08:1e:ed:21:53:06:03:
73:f9:13:e7:a3:9c:e2:17:9c:25:b2:a5:f9:dc:07:7d:
32:9f:cd:82:85:6c:26:79:dd:ee:e7:31:4e:10:55:19:
d6:ac:1e:70:39:01:d2:37:00:3b:41:de:a9:c2:bd:bf:
b4:c1:f8:8d:bd:d4:6b:95:6d:53:f3:17:76:40:d4:05:
a4:1e:69:e8:54:92:91:bf:89:b6:ba:45:c5:14:89:bb:
f4:44:cf:91:ca:16:44:55:86:8f:b9:37:4e:9e:9e:04:
cd:48:e7:57:ec:c8:e2:72:f3:df:34:49:0a:9b:3f:67:
a4:01:dd:f3:a3:bb:ec:b5:b8:20:f5:7e:45:8e:ae:53:
7e:b8:92:38:0a:b7:41:8e:81:15:ab:72:42:f7:37:4a:
6d:d7:4f:aa:0a:99:ee:9b:49:16:54:03:42:d6:fe:c1:
ee:63:71:28:b1:84:c2:e6:d4:7b:f6:10:4c:a0:7a:39:
9d:03:30:ff:78:24:ce:5b:ac:fe:ac:6d:f6:61:77:a6
Fingerprint (SHA-256):
AA:1F:B9:29:D2:F9:CC:AB:3D:F7:8C:26:26:4B:51:A3:71:01:1A:94:F8:FE:47:1D:BD:E3:72:DD:63:17:FE:6C
Fingerprint (SHA1):
B3:7A:A1:65:01:E2:A0:09:F4:55:17:EC:40:88:5C:42:9A:45:F5:36
Key(shrouded):
Friendly Name: soft.lissi.ru
Encryption algorithm: PKCS #12 V2 PBE With SHA-1 And 3KEY Triple DES-CBC
Parameters:
Salt:
08:0b:8d:be:fa:fc:a5:a3
Iteration Count: 2048 (0x800)
$ć¦ć¼ćć£ćŖćć£ćÆä¾æå©ć§ćććč»čć«ććØććŖćććć§ćÆććć¾ćććč»čć®ććØćÆććć·ć¢ć®ęåćć¾ććÆćććUTF-8ćØć³ć³ć¼ćć£ć³ć°ććććļ¼.....ļ¼ćØćć¦č”Øē¤ŗćććććØć§ććć¾ććppć¦ć¼ćć£ćŖćć£ć«-ućć©ć”ć¼ćæćććå “åļ¼utf-8ćØć³ć³ć¼ćć£ć³ć°ćååØććå “åļ¼ćććć§ćććåæćć¦ćć¾ćć¾ćļ¼certutilć¦ć¼ćć£ćŖćć£ćę¤čØćććØćć«ććć«åć³ē“é¢ćć¾ćļ¼ććććäæ®ę£ććć®ćÆé£ććććć¾ćććpk12util.cćć”ć¤ć«ć«ććP12U_ListPKCS12Fileé¢ę°ć«1č”čæ½å ććć ćć§ååć§ćć
PRIntn
P12U_ListPKCS12File(char *in_file, PK11SlotInfo *slot,
secuPWData *slotPw, secuPWData *p12FilePw)
{
SEC_PKCS12DecoderContext *p12dcx = NULL;
SECItem uniPwitem = { 0 };
SECStatus rv = SECFailure;
const SEC_PKCS12DecoderItem *dip;
/* UTF-8*/
SECU_EnableUtf8Display(PR_TRUE);
. . . . .
}
ćć®å¾ććć·ć¢čŖć®ęåć«åé”ćÆććć¾ććć
$ pk12util -l 1000.p12 -d "." -W 01234567
Certificate(has private key):
Data:
Version: 3 (0x2)
Serial Number: 4096 (0x1000)
Signature Algorithm: PKCS #1 SHA-256 With RSA Encryption
Issuer: Ā«E=ca@test.ru,OGRN=1111111111111,INN=222222222222,CN=
,OU=
,O= ,STR
EET=Ā». , . 0",L=,ST=
,C=RU"
Validity:
Not Before: Tue Jul 07 08:40:14 2020
Not After: Fri Aug 06 08:40:14 2021
Subject: Ā«E=test@rsa.ru,CN= Ā»
Subject Public Key Info:
Public Key Algorithm: PKCS #1 RSA Encryption
RSA Public Key:
Modulus:
9a:9f:6c:60:94:f7:ec:f7:94:b3:51:01:e2:1a:c5:25:
28:bb:02:77:49:52:4d:99:8a:6e:26:12:55:8f:71:34:
04:da:39:24:f9:b4:6b:d0:0a:42:27:1b:b2:d7:9b:d9:
c3:76:b0:e0:1c:7c:21:ce:79:9f:d5:2b:17:63:cb:94:
5b:d9:b2:53:ff:b9:bf:4f:3d:cf:b7:8d:8a:37:ba:02:
8c:da:d2:0d:fd:46:5b:45:1d:95:64:07:6e:fa:88:0d:
a4:bd:b3:4a:ed:99:f1:fd:73:c5:b6:05:a0:e5:ee:6b:
c3:83:5b:d0:64:05:77:6a:18:d8:c8:28:a1:d0:06:41:
23:0d:bb:87:8a:77:14:fb:6c:5d:af:db:2b:0b:11:a3:
16:1b:2b:05:18:26:a9:b5:00:4a:40:da:b3:05:aa:2a:
67:c0:18:0d:03:f7:d2:b9:ba:7c:36:f9:95:2e:56:81:
a3:09:99:5e:20:10:95:38:10:c9:c1:6f:c3:6c:a6:1b:
78:51:c6:e4:4f:11:bc:c0:22:4b:ca:59:16:f2:45:95:
0d:fd:7b:46:cf:c7:ac:1c:3d:d7:26:fc:ad:80:3e:2c:
21:93:29:32:a6:79:e2:a8:c6:e9:5e:45:34:d3:38:57:
8f:cd:95:5e:91:09:84:34:21:d2:16:29:69:75:4d:a3
Exponent: 65537 (0x10001)
Signed Extensions:
Name: Certificate Basic Constraints
Critical: True
Data: Is not a CA.
Name: Certificate Key Usage
Usages: Digital Signature
Key Encipherment
Key Agreement
Name: Certificate Type
Data: <SSL Client,S/MIME>
Name: Extended Key Usage
TLS Web Client Authentication Certificate
E-Mail Protection Certificate
Name: Certificate Subject Key ID
Data:
26:a1:b3:98:1c:fe:62:ba:23:81:96:37:3f:08:bd:70:
d6:f2:b1:46
Name: Certificate Authority Key Identifier
Key ID:
0a:b6:f6:87:64:1d:8e:b3:63:08:29:9f:21:59:ad:47:
d8:ea:07:f4
Issuer:
Directory Name: Ā«E=ca@test.ru,OGRN=1111111111111,INN=22222222
2222,CN= ,OU=
,O=
,STREET=Ā».
, . 0",L=,ST=
,C=RU"
Serial Number:
00:a2:9b:22:32:3e:a7:3d:d8
Name: Certificate Subject Alt Name
RFC822 Name: Ā«test@rsa.ruĀ»
Name: Certificate Issuer Alt Name
Error: Parsing extension: Certificate extension value is invalid.
Data: Sequence {
}
Signature Algorithm: PKCS #1 SHA-256 With RSA Encryption
Signature:
2f:75:7e:71:9e:15:5c:97:fe:a2:e1:2a:52:39:56:55:
e0:62:60:bc:5f:6d:c2:b6:ec:cd:8b:10:b3:b1:3f:e5:
d6:d1:5f:a5:fa:61:c1:ce:3e:db:6a:2f:b2:13:46:8d:
67:cf:18:09:61:97:01:45:bc:99:bb:0c:d6:0a:a3:03:
87:0a:8e:10:3a:d5:e3:94:6d:4a:24:fa:c3:40:0b:43:
c2:3b:00:56:06:c4:d2:fc:b2:7e:e9:00:e5:2f:4b:e2:
3a:91:49:ce:f8:c3:60:ec:01:74:d8:1a:3b:af:e6:f6:
91:db:c5:f1:d7:de:be:18:38:47:41:8a:e2:ef:80:91:
10:54:41:ae:55:22:6f:d7:8c:fa:46:b6:b6:2a:ee:6a:
0c:c9:03:18:af:4e:93:6c:61:f3:b4:78:0c:61:93:f1:
d8:1b:00:c3:e5:29:9a:08:0a:f8:31:67:88:3d:c3:88:
7a:60:c0:c4:52:94:25:56:e5:a3:df:7d:58:c5:df:9a:
c7:22:7e:2c:f6:fb:2c:bf:b7:7f:c5:ca:2b:0f:8c:20:
77:b9:1f:e0:62:5a:3d:d4:6f:12:ea:c8:51:67:a5:75:
ad:e9:ac:9e:4e:2e:2d:34:80:e7:d8:64:f6:8f:2f:33:
32:1f:8b:bc:9c:e8:77:4a:ee:7b:84:31:ec:28:e9:70
Fingerprint (SHA-256):
96:F4:A5:FA:6D:8A:F8:7E:A6:10:49:BD:43:34:C1:92:C6:7D:FF:63:41:8E:69:C0:AC:34:6B:CB:63:7B:56:31
Fingerprint (SHA1):
B6:91:9B:C6:7A:45:9C:92:FD:E7:C7:33:00:FA:91:DF:7D:5F:00:21
Friendly Name:
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
00:a2:9b:22:32:3e:a7:3d:d8
Signature Algorithm: PKCS #1 SHA-256 With RSA Encryption
Issuer: Ā«E=ca@test.ru,OGRN=1111111111111,INN=222222222222,CN=
,OU=
,O= ,STR
EET=Ā». , . 0",L=,ST=
,C=RU"
Validity:
Not Before: Tue Jul 07 08:08:11 2020
Not After: Fri Jul 05 08:08:11 2030
Subject: Ā«E=ca@test.ru,OGRN=1111111111111,INN=222222222222,CN=
,OU=
,O= ,STR
EET=Ā». , . 0",L=,ST=
,C=RU"
Subject Public Key Info:
Public Key Algorithm: PKCS #1 RSA Encryption
RSA Public Key:
Modulus:
e7:08:ed:83:08:10:7b:48:56:37:8b:e2:4a:31:1a:7b:
0d:4e:d2:a2:67:d7:04:60:a0:09:db:06:64:21:01:4e:
0d:41:d8:61:15:c6:58:83:66:7e:6b:65:72:0d:2b:c3:
50:26:11:04:82:4b:1a:12:d0:dc:e1:13:1c:76:69:0f:
c2:59:e2:5d:60:6d:fe:8a:48:fa:8b:1e:05:07:34:6d:
8a:e3:76:23:42:9e:7b:64:0b:6a:fb:36:63:31:96:df:
ed:d3:e8:7c:6e:39:d4:7d:da:b8:f4:ec:53:57:60:f1:
d8:a4:3a:3f:3b:4a:63:6c:2a:55:90:21:15:23:4a:37:
21:31:a0:c4:bb:84:0d:96:18:3c:3b:ba:92:e3:e2:17:
56:e5:d9:8c:58:24:8a:a3:53:b6:4f:02:4d:30:a6:0f:
34:ad:20:cf:6f:03:ca:23:1e:d3:15:bc:80:09:d8:1e:
90:07:da:90:a9:34:9e:6e:ed:6b:10:b7:a1:a4:a9:b4:
04:ac:6a:40:d8:00:52:d6:6a:28:f2:8c:c6:84:81:8a:
cd:63:a6:53:82:d2:4e:11:ec:94:81:d7:9c:79:8a:30:
9c:40:75:4d:d9:88:0b:cc:a4:0c:5d:6d:23:a6:ac:56:
8c:49:d9:1f:2b:63:cb:50:fc:a3:e0:3e:35:4e:f4:03
Exponent: 65537 (0x10001)
Signed Extensions:
Name: Certificate Basic Constraints
Critical: True
Data: Is a CA with no maximum path length.
Name: Certificate Subject Key ID
Data:
0a:b6:f6:87:64:1d:8e:b3:63:08:29:9f:21:59:ad:47:
d8:ea:07:f4
Signature Algorithm: PKCS #1 SHA-256 With RSA Encryption
Signature:
17:7d:29:dc:4d:6e:4c:99:7a:bc:b2:2a:a5:80:f9:5f:
0c:60:00:2b:f3:f4:ef:19:d7:ed:56:07:5d:24:e1:b3:
f6:43:e2:05:9b:75:ce:cd:cf:27:1e:1c:cd:d8:cc:43:
77:16:04:7e:8a:dd:89:c4:b2:75:ae:f4:84:23:53:18:
fe:be:c5:1d:40:55:aa:91:9f:f5:96:06:5d:07:22:a8:
1c:b9:29:c4:49:2e:75:10:75:22:95:36:16:58:2f:77:
f5:fa:6d:de:c4:67:ca:f3:e1:98:51:b4:ba:b7:2a:7f:
06:db:33:5a:a6:bb:53:57:f4:18:93:16:9c:0e:43:d0:
46:e6:84:55:bb:ff:68:fe:fa:32:d5:23:2a:d5:65:9b:
d9:63:45:6b:53:71:64:dd:da:e1:40:fa:89:30:b1:73:
8b:f8:7c:3c:2f:72:24:ad:e8:5c:07:89:2f:3a:0d:37:
48:29:1f:0d:5f:9e:11:73:56:b8:d9:24:eb:2d:2e:18:
c7:9b:90:62:09:20:61:75:b9:a1:9a:3f:99:34:8e:06:
30:ce:7d:60:42:7d:e0:14:f2:88:f2:41:a0:46:4d:55:
17:d4:c2:15:64:c9:3e:f5:cc:0a:41:f7:c0:d0:94:96:
ea:64:e0:45:3a:e0:a3:d6:22:a9:d1:e3:c4:51:e8:96
Fingerprint (SHA-256):
F5:DF:15:79:5E:1E:41:84:96:8C:8C:CA:37:0C:A6:BB:C3:21:AE:3D:32:42:8C:63:C2:64:BA:0A:74:DC:37:F8
Fingerprint (SHA1):
CF:C6:B9:D4:3C:16:6F:31:91:2A:09:2F:FE:4C:57:89:0F:5A:F1:DB
Friendly Name:
Key(shrouded):
Friendly Name:
Encryption algorithm: PKCS #12 V2 PBE With SHA-1 And 3KEY Triple DES-CBC
Parameters:
Salt:
c4:fa:4a:6a:4f:54:a1:7a
Iteration Count: 2048 (0x800)
$
Certificate(has private key):
Data:
Version: 3 (0x2)
Serial Number: 4096 (0x1000)
Signature Algorithm: PKCS #1 SHA-256 With RSA Encryption
Issuer: Ā«E=ca@test.ru,OGRN=1111111111111,INN=222222222222,CN=
,OU=
,O= ,STR
EET=Ā». , . 0",L=,ST=
,C=RU"
Validity:
Not Before: Tue Jul 07 08:40:14 2020
Not After: Fri Aug 06 08:40:14 2021
Subject: Ā«E=test@rsa.ru,CN= Ā»
Subject Public Key Info:
Public Key Algorithm: PKCS #1 RSA Encryption
RSA Public Key:
Modulus:
9a:9f:6c:60:94:f7:ec:f7:94:b3:51:01:e2:1a:c5:25:
28:bb:02:77:49:52:4d:99:8a:6e:26:12:55:8f:71:34:
04:da:39:24:f9:b4:6b:d0:0a:42:27:1b:b2:d7:9b:d9:
c3:76:b0:e0:1c:7c:21:ce:79:9f:d5:2b:17:63:cb:94:
5b:d9:b2:53:ff:b9:bf:4f:3d:cf:b7:8d:8a:37:ba:02:
8c:da:d2:0d:fd:46:5b:45:1d:95:64:07:6e:fa:88:0d:
a4:bd:b3:4a:ed:99:f1:fd:73:c5:b6:05:a0:e5:ee:6b:
c3:83:5b:d0:64:05:77:6a:18:d8:c8:28:a1:d0:06:41:
23:0d:bb:87:8a:77:14:fb:6c:5d:af:db:2b:0b:11:a3:
16:1b:2b:05:18:26:a9:b5:00:4a:40:da:b3:05:aa:2a:
67:c0:18:0d:03:f7:d2:b9:ba:7c:36:f9:95:2e:56:81:
a3:09:99:5e:20:10:95:38:10:c9:c1:6f:c3:6c:a6:1b:
78:51:c6:e4:4f:11:bc:c0:22:4b:ca:59:16:f2:45:95:
0d:fd:7b:46:cf:c7:ac:1c:3d:d7:26:fc:ad:80:3e:2c:
21:93:29:32:a6:79:e2:a8:c6:e9:5e:45:34:d3:38:57:
8f:cd:95:5e:91:09:84:34:21:d2:16:29:69:75:4d:a3
Exponent: 65537 (0x10001)
Signed Extensions:
Name: Certificate Basic Constraints
Critical: True
Data: Is not a CA.
Name: Certificate Key Usage
Usages: Digital Signature
Key Encipherment
Key Agreement
Name: Certificate Type
Data: <SSL Client,S/MIME>
Name: Extended Key Usage
TLS Web Client Authentication Certificate
E-Mail Protection Certificate
Name: Certificate Subject Key ID
Data:
26:a1:b3:98:1c:fe:62:ba:23:81:96:37:3f:08:bd:70:
d6:f2:b1:46
Name: Certificate Authority Key Identifier
Key ID:
0a:b6:f6:87:64:1d:8e:b3:63:08:29:9f:21:59:ad:47:
d8:ea:07:f4
Issuer:
Directory Name: Ā«E=ca@test.ru,OGRN=1111111111111,INN=22222222
2222,CN= ,OU=
,O=
,STREET=Ā».
, . 0",L=,ST=
,C=RU"
Serial Number:
00:a2:9b:22:32:3e:a7:3d:d8
Name: Certificate Subject Alt Name
RFC822 Name: Ā«test@rsa.ruĀ»
Name: Certificate Issuer Alt Name
Error: Parsing extension: Certificate extension value is invalid.
Data: Sequence {
}
Signature Algorithm: PKCS #1 SHA-256 With RSA Encryption
Signature:
2f:75:7e:71:9e:15:5c:97:fe:a2:e1:2a:52:39:56:55:
e0:62:60:bc:5f:6d:c2:b6:ec:cd:8b:10:b3:b1:3f:e5:
d6:d1:5f:a5:fa:61:c1:ce:3e:db:6a:2f:b2:13:46:8d:
67:cf:18:09:61:97:01:45:bc:99:bb:0c:d6:0a:a3:03:
87:0a:8e:10:3a:d5:e3:94:6d:4a:24:fa:c3:40:0b:43:
c2:3b:00:56:06:c4:d2:fc:b2:7e:e9:00:e5:2f:4b:e2:
3a:91:49:ce:f8:c3:60:ec:01:74:d8:1a:3b:af:e6:f6:
91:db:c5:f1:d7:de:be:18:38:47:41:8a:e2:ef:80:91:
10:54:41:ae:55:22:6f:d7:8c:fa:46:b6:b6:2a:ee:6a:
0c:c9:03:18:af:4e:93:6c:61:f3:b4:78:0c:61:93:f1:
d8:1b:00:c3:e5:29:9a:08:0a:f8:31:67:88:3d:c3:88:
7a:60:c0:c4:52:94:25:56:e5:a3:df:7d:58:c5:df:9a:
c7:22:7e:2c:f6:fb:2c:bf:b7:7f:c5:ca:2b:0f:8c:20:
77:b9:1f:e0:62:5a:3d:d4:6f:12:ea:c8:51:67:a5:75:
ad:e9:ac:9e:4e:2e:2d:34:80:e7:d8:64:f6:8f:2f:33:
32:1f:8b:bc:9c:e8:77:4a:ee:7b:84:31:ec:28:e9:70
Fingerprint (SHA-256):
96:F4:A5:FA:6D:8A:F8:7E:A6:10:49:BD:43:34:C1:92:C6:7D:FF:63:41:8E:69:C0:AC:34:6B:CB:63:7B:56:31
Fingerprint (SHA1):
B6:91:9B:C6:7A:45:9C:92:FD:E7:C7:33:00:FA:91:DF:7D:5F:00:21
Friendly Name:
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
00:a2:9b:22:32:3e:a7:3d:d8
Signature Algorithm: PKCS #1 SHA-256 With RSA Encryption
Issuer: Ā«E=ca@test.ru,OGRN=1111111111111,INN=222222222222,CN=
,OU=
,O= ,STR
EET=Ā». , . 0",L=,ST=
,C=RU"
Validity:
Not Before: Tue Jul 07 08:08:11 2020
Not After: Fri Jul 05 08:08:11 2030
Subject: Ā«E=ca@test.ru,OGRN=1111111111111,INN=222222222222,CN=
,OU=
,O= ,STR
EET=Ā». , . 0",L=,ST=
,C=RU"
Subject Public Key Info:
Public Key Algorithm: PKCS #1 RSA Encryption
RSA Public Key:
Modulus:
e7:08:ed:83:08:10:7b:48:56:37:8b:e2:4a:31:1a:7b:
0d:4e:d2:a2:67:d7:04:60:a0:09:db:06:64:21:01:4e:
0d:41:d8:61:15:c6:58:83:66:7e:6b:65:72:0d:2b:c3:
50:26:11:04:82:4b:1a:12:d0:dc:e1:13:1c:76:69:0f:
c2:59:e2:5d:60:6d:fe:8a:48:fa:8b:1e:05:07:34:6d:
8a:e3:76:23:42:9e:7b:64:0b:6a:fb:36:63:31:96:df:
ed:d3:e8:7c:6e:39:d4:7d:da:b8:f4:ec:53:57:60:f1:
d8:a4:3a:3f:3b:4a:63:6c:2a:55:90:21:15:23:4a:37:
21:31:a0:c4:bb:84:0d:96:18:3c:3b:ba:92:e3:e2:17:
56:e5:d9:8c:58:24:8a:a3:53:b6:4f:02:4d:30:a6:0f:
34:ad:20:cf:6f:03:ca:23:1e:d3:15:bc:80:09:d8:1e:
90:07:da:90:a9:34:9e:6e:ed:6b:10:b7:a1:a4:a9:b4:
04:ac:6a:40:d8:00:52:d6:6a:28:f2:8c:c6:84:81:8a:
cd:63:a6:53:82:d2:4e:11:ec:94:81:d7:9c:79:8a:30:
9c:40:75:4d:d9:88:0b:cc:a4:0c:5d:6d:23:a6:ac:56:
8c:49:d9:1f:2b:63:cb:50:fc:a3:e0:3e:35:4e:f4:03
Exponent: 65537 (0x10001)
Signed Extensions:
Name: Certificate Basic Constraints
Critical: True
Data: Is a CA with no maximum path length.
Name: Certificate Subject Key ID
Data:
0a:b6:f6:87:64:1d:8e:b3:63:08:29:9f:21:59:ad:47:
d8:ea:07:f4
Signature Algorithm: PKCS #1 SHA-256 With RSA Encryption
Signature:
17:7d:29:dc:4d:6e:4c:99:7a:bc:b2:2a:a5:80:f9:5f:
0c:60:00:2b:f3:f4:ef:19:d7:ed:56:07:5d:24:e1:b3:
f6:43:e2:05:9b:75:ce:cd:cf:27:1e:1c:cd:d8:cc:43:
77:16:04:7e:8a:dd:89:c4:b2:75:ae:f4:84:23:53:18:
fe:be:c5:1d:40:55:aa:91:9f:f5:96:06:5d:07:22:a8:
1c:b9:29:c4:49:2e:75:10:75:22:95:36:16:58:2f:77:
f5:fa:6d:de:c4:67:ca:f3:e1:98:51:b4:ba:b7:2a:7f:
06:db:33:5a:a6:bb:53:57:f4:18:93:16:9c:0e:43:d0:
46:e6:84:55:bb:ff:68:fe:fa:32:d5:23:2a:d5:65:9b:
d9:63:45:6b:53:71:64:dd:da:e1:40:fa:89:30:b1:73:
8b:f8:7c:3c:2f:72:24:ad:e8:5c:07:89:2f:3a:0d:37:
48:29:1f:0d:5f:9e:11:73:56:b8:d9:24:eb:2d:2e:18:
c7:9b:90:62:09:20:61:75:b9:a1:9a:3f:99:34:8e:06:
30:ce:7d:60:42:7d:e0:14:f2:88:f2:41:a0:46:4d:55:
17:d4:c2:15:64:c9:3e:f5:cc:0a:41:f7:c0:d0:94:96:
ea:64:e0:45:3a:e0:a3:d6:22:a9:d1:e3:c4:51:e8:96
Fingerprint (SHA-256):
F5:DF:15:79:5E:1E:41:84:96:8C:8C:CA:37:0C:A6:BB:C3:21:AE:3D:32:42:8C:63:C2:64:BA:0A:74:DC:37:F8
Fingerprint (SHA1):
CF:C6:B9:D4:3C:16:6F:31:91:2A:09:2F:FE:4C:57:89:0F:5A:F1:DB
Friendly Name:
Key(shrouded):
Friendly Name:
Encryption algorithm: PKCS #12 V2 PBE With SHA-1 And 3KEY Triple DES-CBC
Parameters:
Salt:
c4:fa:4a:6a:4f:54:a1:7a
Iteration Count: 2048 (0x800)
$
opensslć¦ć¼ćć£ćŖćć£ćä½æēØćć¦PKCSļ¼12ć³ć³ćććä½ęćććØććÆćCAFL63ć°ć©ćć£ć«ć«ć·ć§ć«ćä½æēØćć¾ććć
ä»ćććNSSćŖććøććŖć«ć¤ćć¦čŖ¬ęćććØćć§ćć
NSSć¹ćć¬ć¼ćø
NSSćŖććøććŖćÆć3ć¤ć®ćć¼ćæćć¼ć¹ćę ¼ē“ććć¦ćććć£ć¬ćÆććŖć§ćć
ćć¼ćæćć¼ć¹ļ¼DBļ¼ć«ćÆćcert8.db /cert9.dbčؼęęøćę ¼ē“ććć¾ćć key3.db / key4.dbćć¼ćæćć¼ć¹ć«ćÆćē§åÆéµćę ¼ē“ććć¾ććććć¦ęå¾ć«ćsecmod.db / pkcs11.txtćć¼ćæćć¼ć¹ć«ćÆćPKCSļ¼11ć¤ć³ćæć¼ćć§ć¤ć¹ćä½æēØćć¦ćµć¼ććć¼ćć£ć®ćć¼ćÆć³/ć¹ćć¼ćć«ć¼ć/ćÆć©ć¦ććęä½ć§ććććć«ććę å ±ļ¼äø»ć«ć©ć¤ćć©ćŖćøć®ćć¹ļ¼ćę ¼ē“ććć¾ćć
modutilć¦ć¼ćć£ćŖćć£ćÆćꬔć®å½¢å¼ć§NSSćŖććøććŖćä½ęććććć«čØčØććć¦ćć¾ćć
modutil -create -force [-dbdir < NSS>] ,
< NSS> := [< >:]< NSS>
< > := dbm|sql , :
$modutil -create -force -dbdir "sql:/~/TEST_NSS"
dbmćć¼ćæćć¼ć¹ćæć¤ććÆćBerkeleyćć¼ćæćć¼ć¹ļ¼cert8.dbćkey3.dbćććć³secmod.dbļ¼ć®ä½ęćåęćØćć¦ćć¾ććsqlćæć¤ććÆćSQLite3ćć¼ćæćć¼ć¹ļ¼cert9.dbćkey9.dbćććć³ććć¹ććć”ć¤ć«pkcs11.txtļ¼ć®ä½ęćåęćØćć¦ćć¾ććSQLite3ćć¼ćæćć¼ć¹ćÆććć©ć«ćć§ä½ęććć¾ććNSSćŖććøććŖćć£ć¬ćÆććŖćÆäŗåć«ä½ęććåæ č¦ćććć¾ććććć©ć«ćć§ćÆļ¼-dbdirć¾ććÆ-dćć©ć”ć¼ćæć¼ćęå®ććć¦ććŖćéćļ¼ćć¦ć¼ć¶ć¼ć®ćć¼ć ćć©ć«ćć¼ć«ććć.netscapećć¹ćć¢ćä½æēØććć¾ćććć®ć¹ćć¬ć¼ćøćÆćććØćć°google-chromećć©ć¦ć¶ć«ćć£ć¦ä½æēØććć¾ćć
å¤ćå½¢å¼ļ¼DBMļ¼ć®čؼęęøć¹ćć¢ļ¼cert8.dbćkey3.dbćsecmod.dbļ¼ććę°ććå½¢å¼ļ¼SQLite3ļ¼ļ¼cert9.dbćkey4.dbćpkcs11.txtļ¼ć§ć¹ćć¢ćä½ęććććØćē°”åć§ćććććč”ćć«ćÆććć¼ļ¼-Kļ¼ć¾ććÆ-Xćć©ć”ć¼ćæć¼ćęå®ććčؼęęøļ¼-Lļ¼ćč”Øē¤ŗććć¢ć¼ćć§čؼęęøcertutilćęä½ććććć®ć¦ć¼ćć£ćŖćć£ćå®č”ćć¾ććꬔć«ä¾ćē¤ŗćć¾ćć
$certutil -K -X -d ~/TEST_NSSć¾ććÆ
$certutil -L -X -d ~/TEST_NSSćć®ćććŖćŖććøććŖćÆćFirefoxćThunderbirdćSeamonkeyćGoogleChromećLibreOfficećŖć©ćNSSć§ę§ēÆććććć¹ć¦ć®ćććøć§ćÆćć§å©ēØć§ććććØć«ę³Øęćć¦ćć ććć
NSSć¹ćć¬ć¼ćøćä½ęćććØć2ć¤ć®ēµćæč¾¼ćæćć¼ćÆć³ćåććēµćæč¾¼ćæć®ćNSSå éØPKCSļ¼11ć¢ćøć„ć¼ć«ććčŖåēć«ä½æēØåÆč½ć«ćŖćć¾ćć
$modutil -list -dbdir ~/TEST_NSS
Listing of PKCS #11 Modules
-----------------------------------------------------------
1. NSS Internal PKCS #11 Module
uri: pkcs11:library-manufacturer=Mozilla%20Foundation;library-description=NSS%20Internal%20Crypto%20Services;library-version=3.52
slots: 2 slots attached
status: loaded
slot: NSS Internal Cryptographic Services
token: NSS Generic Crypto Services
uri: pkcs11:token=NSS%20Generic%20Crypto%20Services;manufacturer=Mozilla%20Foundation;serial=0000000000000000;model=NSS%203
slot: NSS User Private Key and Certificate Services
token: NSS Certificate DB
uri: pkcs11:token=NSS%20Certificate%20DB;manufacturer=Mozilla%20Foundation;serial=0000000000000000;model=NSS%203
-----------------------------------------------------------
$
ćNSSGenericCrypto Servicesććć¼ćÆć³ćÆęå·åę©č½ćØć”ć«ććŗć ćå®č£ ćććNSS Certificate DBććć¼ćÆć³ćÆćčؼęęøćØćć¼ćććć³ćć®ä»ć®čæ½å ę å ±ļ¼ććØćć°ćć«ć¼ćčؼęęøć®äæ”é ¼ć«é¢ććļ¼ćę ¼ē“ććććć«čØčØććć¦ćć¾ćććNSSčؼęęøDBććć¼ćÆć³ļ¼å éØNSSćć¼ćÆć³ļ¼ćÆćcert8.db / cert9.dbćć¼ćæćć¼ć¹ćä½æēØćć¦čؼęęøćę ¼ē“ććē§åÆéµćkey3.db /key4.dbćć¼ćæćć¼ć¹ć«ę ¼ē“ćć¾ćć
ꬔć®ć³ćć³ććå®č”ćććØćććć©ć«ćć§ćµćć¼ćććć¦ććęå·åć”ć«ććŗć ćŖć©ćNSSå éØPKCSļ¼11ć¢ćøć„ć¼ć«ć®ēµćæč¾¼ćæćć¼ćÆć³ć«é¢ććę å ±ćåå¾ć§ćć¾ćć
$ modutil -list'NSSå
éØPKCSļ¼11ć¢ćøć„ć¼ć« '-dbdirć / TEST_NSS
ā Name: NSS Internal PKCS #11 Module
Library file: **Internal ONLY module**
Manufacturer: Mozilla Foundation
Description: NSS Internal Crypto Services
PKCS #11 Version 3.0
Library Version: 3.52
Cipher Enable Flags: None
Default Mechanism Flags: RSA:ECC:DH:RC2:RC4:DES:AES:CAMELLIA:SEED:SHA1:SHA256:SHA512:MD5:MD2:SSL:TLS
Slot: NSS Internal Cryptographic Services
Slot Mechanism Flags: RSA:ECC:DH:RC2:RC4:DES:AES:CAMELLIA:SEED:SHA1:SHA256:SHA512:MD5:MD2:SSL:TLS
Manufacturer: Mozilla Foundation
Type: Software
Version Number: 3.52
Firmware Version: 1.0
Status: Enabled
Token Name: NSS Generic Crypto Services
Token Manufacturer: Mozilla Foundation
Token Model: NSS 3
Token Serial Number: 0000000000000000
Token Version: 4.0
Token Firmware Version: 0.0
Access: Write Protected
Login Type: Public (no login required)
User Pin: NOT Initialized
Slot: NSS User Private Key and Certificate Services
Slot Mechanism Flags: None
Manufacturer: Mozilla Foundation
Type: Software
Version Number: 3.52
Firmware Version: 1.0
Status: Enabled
Token Name: NSS Certificate DB
Token Manufacturer: Mozilla Foundation
Token Model: NSS 3
Token Serial Number: 0000000000000000
Token Version: 0.0
Token Firmware Version: 0.0
Access: NOT Write Protected
Login Type: Public (no login required)
User Pin: Initialized
ā $
Library file: **Internal ONLY module**
Manufacturer: Mozilla Foundation
Description: NSS Internal Crypto Services
PKCS #11 Version 3.0
Library Version: 3.52
Cipher Enable Flags: None
Default Mechanism Flags: RSA:ECC:DH:RC2:RC4:DES:AES:CAMELLIA:SEED:SHA1:SHA256:SHA512:MD5:MD2:SSL:TLS
Slot: NSS Internal Cryptographic Services
Slot Mechanism Flags: RSA:ECC:DH:RC2:RC4:DES:AES:CAMELLIA:SEED:SHA1:SHA256:SHA512:MD5:MD2:SSL:TLS
Manufacturer: Mozilla Foundation
Type: Software
Version Number: 3.52
Firmware Version: 1.0
Status: Enabled
Token Name: NSS Generic Crypto Services
Token Manufacturer: Mozilla Foundation
Token Model: NSS 3
Token Serial Number: 0000000000000000
Token Version: 4.0
Token Firmware Version: 0.0
Access: Write Protected
Login Type: Public (no login required)
User Pin: NOT Initialized
Slot: NSS User Private Key and Certificate Services
Slot Mechanism Flags: None
Manufacturer: Mozilla Foundation
Type: Software
Version Number: 3.52
Firmware Version: 1.0
Status: Enabled
Token Name: NSS Certificate DB
Token Manufacturer: Mozilla Foundation
Token Model: NSS 3
Token Serial Number: 0000000000000000
Token Version: 0.0
Token Firmware Version: 0.0
Access: NOT Write Protected
Login Type: Public (no login required)
User Pin: Initialized
ā $
å¤éØPKCSļ¼11ććć¤ć¹ćęä½ććććć®čæ½å ć¢ćøć„ć¼ć«ć®ę„ē¶ćÆćåćmodutilć¦ć¼ćć£ćŖćć£ćä½æēØćć¦č”ććć¾ćć
$modutil -add < > -libfile < > [-dbdir < NSS>]ććØćć°ććć·ć¢ć®ęå·åććµćć¼ćććRUTokenćć¼ćÆć³ćęä½ććć«ćÆćꬔć®ć³ćć³ććå®č”ććć ćć§ćć
$modutil -add "ruTokenECP" -libfile /usr/lib64/librtpkcs11ecp_2.0.so -dbdir $HOME/.netscape ē¹å®ć®NSSćŖććøććŖććµćć¼ćććć¢ćøć„ć¼ć«ć®ćŖć¹ććØćåć¢ćøć„ć¼ć«ć«é¢ććę å ±ļ¼ć©ć¤ćć©ćŖććµćć¼ćććć¦ććć¹ćććć®ćŖć¹ććććć³ćććć«ę„ē¶ććć¦ćććć¼ćÆć³ļ¼ćåå¾ććć«ćÆćꬔć®ć³ćć³ććå®č”ćć¾ćć
$modutil -list [-dbdir < NSS>]
ē¹å®ć®ć¢ćøć„ć¼ć«ć®ę„ē¶ććććć¼ćÆć³ć«é¢ććå®å ØćŖę å ±ćåå¾ććć«ćÆćꬔć®ć³ćć³ććå®č”ććåæ č¦ćććć¾ćć
$modutil -list < > [-dbdir < NSS>]ēµćæč¾¼ćæļ¼å éØļ¼NSSćć¼ćÆć³ć«é¢ććę å ±ćåćåć£ććØćć«ćć§ć«ä½æēØćć¾ććć
ć¾ććć¢ćøć„ć¼ć«ćčæ½å ć§ććå “åćÆććć¼ćæćć¼ć¹ććć¢ćøć„ć¼ć«ćåé¤ććććØćć§ćć¾ćć
$modutil -delete < > [-dbdir < NSS>] å¤éØćć¼ćÆć³ćøć®ć¢ćÆć»ć¹ćÆéåøøPINć§äæč·ććć¦ćć¾ćććć ććēµćæč¾¼ćæć®NSSčؼęęøDBćć¼ćÆć³ćøć®ć¢ćÆć»ć¹ćÆćććć©ć«ćć§ćÆćć¹ćÆć¼ćć§äæč·ććć¦ćć¾ććļ¼PINć³ć¼ćļ¼ććććććććē¢ŗē«ććććØćÆé£ććććć¾ćććä¾ćć°ļ¼
$modutil -dbdir $HOME/.netscape -changepw "NSS Certificate DB" åę§ć«ćå¤éØćć¼ćÆć³ć®PINć³ć¼ććå¤ę“ć§ćć¾ćć
ä»ććććć¼ćÆć³ććć®ć”ć«ććŗć ćććć³ćŖććøć§ćÆćć®ęä½ć«ē§»ććØćć§ćć
PKCSļ¼11ćć¼ćÆć³ćŖććøć§ćÆććøć®ć¢ćÆć»ć¹
certutilć¦ć¼ćć£ćŖćć£ćÆćPKCSļ¼11ćć¼ćÆć³ć®ćŖććøć§ćÆćļ¼ćć¼ćčؼęęøļ¼ć«ć¢ćÆć»ć¹ććććć«ä½æēØććć¾ććcertutilć¦ć¼ćć£ćŖćć£ćÆopensslć¦ć¼ćć£ćŖćć£ćØåćććć«ę©č½ććććØć«ę³Øęćć¦ćć ćććcertutilć¦ć¼ćć£ćŖćć£ć®ę©č½ćč”Øē¤ŗććć«ćÆćꬔć®ć³ćć³ććå®č”ććć ćć§ćć
$certutil -Hććććä»ćÆčؼęęøćØćć¼ćøć®ć¢ćÆć»ć¹ć«ć®ćæé¢åæćććć¾ćć PKCSļ¼11ćć¼ćÆć³ć«äæåććå “åćéåøøćäø”ę¹ć«CKA_IDå±ę§ćØCKA_LABELå±ę§ćå²ćå½ć¦ćććććØćęćåŗćć¦ćć ćććē¹å®ć®ćć¼ćÆć³ć®čؼęęøć®ćŖć¹ććč”Øē¤ŗććć«ćÆćꬔć®ć³ćć³ććå®č”ćć¾ćć
$certutil -L [-d < NSS>] [-h < >]å®éć®ćć¼ćÆć³ć©ćć«ć¾ććÆćć¼ćÆć¼ćć®1ć¤ļ¼allć¾ććÆinternalļ¼ććć¼ćÆć³ć©ćć«ćØćć¦ęå®ć§ćć¾ććęåć®ć±ć¼ć¹ļ¼ćć¼ćÆć³ć©ćć«allļ¼ć§ćÆćNSSć¹ćć¬ć¼ćøć«ę„ē¶ććć¦ćććć¹ć¦ć®ćć¼ćÆć³ćę¤ē“¢ććć2ēŖē®ć®ć±ć¼ć¹ļ¼å éØć¾ććÆćNSSčؼęęøDBćļ¼ć§ćÆććNSSčؼęęøDBćć¹ćć¬ć¼ćøć®å éØćć¼ćÆć³ćč”Øē¤ŗććć¾ćć
ććØćć°ćć¢ćÆć»ć¹ć¢ćøć„ć¼ć«ćNSSćŖććøććŖć/ home / a513 / tmp / TEST_NSSćć«ē»é²ććć¦ćććLS11SW2016ććØććć©ćć«ć®ä»ćććć¼ćÆć³ć®čؼęęøć®ćŖć¹ććåå¾ććć«ćÆćꬔć®ć³ćć³ććå®č”ćć¾ćć
$ certutil -L -d /home/a513/tmp/TEST_NSS -h "LS11SW2016"
Enter Password or Pin for "LS11SW2016":
Certificate Nickname Trust Attributes
SSL,S/MIME,JAR/XPI
LS11SW2016:TestCA_P11 u,u,u
LS11SW2016:clientnss from CryptoArmPKCS u,u,u
LS11SW2016: u,u,u
LS11SW2016:Thenderbird-60.3.0 from 32 u,u,u
LS11SW2016: from 12_512 u,u,u
LS11SW2016:Text4Key u,u,u
LS11SW2016:KmailKleopatra GnuPG-2001 u,u,u
LS11SW2016:setvernss from CryptoArmPKCS u,u,u
LS11SW2016: from 12_512 u,u,u
LS11SW2016:Test 12 512 u,u,u
LS11SW2016:Kleopatra GnuPG-2001 ,,
$ćć¼ćÆć³ć®čؼęęøć®ćŖć¹ććÆ2ć¤ć®åć«č”Øē¤ŗććć¾ććęåć®åć«ćÆčؼęęøć®ćććÆćć¼ć ćē¤ŗććć2ēŖē®ć®åć«ćÆćć®čؼęęøć®äæ”é ¼å±ę§ćå«ć¾ćć¦ćć¾ćć
ććć«ćčؼęęøćé ē½®ććć¦ćććć¼ćÆć³ć«ē§åÆéµćććå “åććć®åć«ćÆå¤ćućućuććå«ć¾ćć¾ćć
å±ę§ćčØå®ććć¦ććŖćå “åćåć«ćÆå¤ćććććå«ć¾ćć¾ćć
ćućućućć®äæ”é ¼å±ę§ćęć¤čؼęęøļ¼ē§åÆéµćęć£ć¦ććļ¼ćÆćčŖčؼć¾ććÆé»åē½²åć®ēęć«ä½æēØć§ćć¾ćć
ä»ć®äæ”é ¼å±ę§å¤ćÆćåćč¾¼ć¾ćććNSSčؼęęøDBććć¼ćÆć³ć«ććčؼęęøć«čØå®ć§ćć¾ććććććććć«ć¤ćć¦ćÆå¾ć§č©³ććčŖ¬ęćć¾ćć
NSSć®čؼęęøć®ćććÆćć¼ć ćÆä½ć§ććļ¼
<nickname> := [< >:]<CKA_LABEL>å éØćć¼ćÆć³ļ¼ćNSSčؼęęøDBćļ¼ć®å “åććććÆćć¼ć ć®ćć¼ćÆć³ć©ćć«ćę¬ č½ćć¦ććåÆč½ę§ćććć¾ćć
PKCSļ¼11ćć¼ćÆć³ć®ć”ć«ććŗć ćę¤čØćććØććć¼ć®ēęćčؼęęøćØćć¼ć®ć¤ć³ćć¼ćć®ęä½ć ćć§ćÆćCKA_IDå±ę§ćØCKA_LABELå±ę§ć®å¤ćčØå®ć§ććŖćććØććććć¾ćććććÆćć¹ć¦ć¢ććŖć±ć¼ć·ć§ć³ć½ććć¦ć§ć¢éēŗč ć«ē§»ććć¾ćććć ććNSSć¦ć¼ćć£ćŖćć£ćä½æēØćć¦ćć¼ćÆć³ćęä½ćććØćåé”ćå¼ćē¶ćććØććććć¾ćć
ꬔć®ć³ćć³ććä½æēØćć¦ćē§åÆéµć®ćŖć¹ććč”Øē¤ŗćć¾ćć
$certutil -K [-d < NSS>] [-h < >]ććć«ććććć¼ćæć¤ćććć¼CKA_IDććć³CKA_LABELćåŗåććć¾ćć
ććććčؼęęøć«ę»ćć¾ćććć¼ćÆć³ć®čؼęęøćććć¹ćå½¢å¼ć§č”Øē¤ŗććć«ćÆćꬔć®ć³ćć³ććå®č”ććć ćć§ćć
$certutil -L [-d < NSS>] -n <nickname >ä¾ćć°ļ¼
certutil -L -d '/ home / a513 / tmp / TEST_NSS' -n'NSSčؼęęøDBļ¼ćć¹ćčؼęęø '
$ certutil -L -d "/home/a513/tmp/TEST_NSS" -n Ā«NSS Certificate DB: Ā»
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 4096 (0x1000)
Signature Algorithm: PKCS #1 SHA-256 With RSA Encryption
Issuer: Ā«E=ca@test.ru,OGRN=1111111111111,INN=222222222222,CN=
,OU=
,O= ,STR
EET=Ā». , . 0",L=,ST=
,C=RU"
Validity:
Not Before: Tue Jul 07 08:40:14 2020
Not After: Fri Aug 06 08:40:14 2021
Subject: Ā«E=test@rsa.ru,CN= Ā»
Subject Public Key Info:
Public Key Algorithm: PKCS #1 RSA Encryption
RSA Public Key:
Modulus:
9a:9f:6c:60:94:f7:ec:f7:94:b3:51:01:e2:1a:c5:25:
28:bb:02:77:49:52:4d:99:8a:6e:26:12:55:8f:71:34:
04:da:39:24:f9:b4:6b:d0:0a:42:27:1b:b2:d7:9b:d9:
c3:76:b0:e0:1c:7c:21:ce:79:9f:d5:2b:17:63:cb:94:
5b:d9:b2:53:ff:b9:bf:4f:3d:cf:b7:8d:8a:37:ba:02:
8c:da:d2:0d:fd:46:5b:45:1d:95:64:07:6e:fa:88:0d:
a4:bd:b3:4a:ed:99:f1:fd:73:c5:b6:05:a0:e5:ee:6b:
c3:83:5b:d0:64:05:77:6a:18:d8:c8:28:a1:d0:06:41:
23:0d:bb:87:8a:77:14:fb:6c:5d:af:db:2b:0b:11:a3:
16:1b:2b:05:18:26:a9:b5:00:4a:40:da:b3:05:aa:2a:
67:c0:18:0d:03:f7:d2:b9:ba:7c:36:f9:95:2e:56:81:
a3:09:99:5e:20:10:95:38:10:c9:c1:6f:c3:6c:a6:1b:
78:51:c6:e4:4f:11:bc:c0:22:4b:ca:59:16:f2:45:95:
0d:fd:7b:46:cf:c7:ac:1c:3d:d7:26:fc:ad:80:3e:2c:
21:93:29:32:a6:79:e2:a8:c6:e9:5e:45:34:d3:38:57:
8f:cd:95:5e:91:09:84:34:21:d2:16:29:69:75:4d:a3
Exponent: 65537 (0x10001)
Signed Extensions:
Name: Certificate Basic Constraints
Critical: True
Data: Is not a CA.
Name: Certificate Key Usage
Usages: Digital Signature
Key Encipherment
Key Agreement
Name: Certificate Type
Data: <SSL Client,S/MIME>
Name: Extended Key Usage
TLS Web Client Authentication Certificate
E-Mail Protection Certificate
Name: Certificate Subject Key ID
Data:
26:a1:b3:98:1c:fe:62:ba:23:81:96:37:3f:08:bd:70:
d6:f2:b1:46
Name: Certificate Authority Key Identifier
Key ID:
0a:b6:f6:87:64:1d:8e:b3:63:08:29:9f:21:59:ad:47:
d8:ea:07:f4
Issuer:
Directory Name: Ā«E=ca@test.ru,OGRN=1111111111111,INN=22222222
2222,CN= ,OU=
,O=
,STREET=Ā».
, . 0",L=,ST=
,C=RU"
Serial Number:
00:a2:9b:22:32:3e:a7:3d:d8
Name: Certificate Subject Alt Name
RFC822 Name: Ā«test@rsa.ruĀ»
Name: Certificate Issuer Alt Name
Error: Parsing extension: Certificate extension value is invalid.
Data: Sequence {
}
Signature Algorithm: PKCS #1 SHA-256 With RSA Encryption
Signature:
2f:75:7e:71:9e:15:5c:97:fe:a2:e1:2a:52:39:56:55:
e0:62:60:bc:5f:6d:c2:b6:ec:cd:8b:10:b3:b1:3f:e5:
d6:d1:5f:a5:fa:61:c1:ce:3e:db:6a:2f:b2:13:46:8d:
67:cf:18:09:61:97:01:45:bc:99:bb:0c:d6:0a:a3:03:
87:0a:8e:10:3a:d5:e3:94:6d:4a:24:fa:c3:40:0b:43:
c2:3b:00:56:06:c4:d2:fc:b2:7e:e9:00:e5:2f:4b:e2:
3a:91:49:ce:f8:c3:60:ec:01:74:d8:1a:3b:af:e6:f6:
91:db:c5:f1:d7:de:be:18:38:47:41:8a:e2:ef:80:91:
10:54:41:ae:55:22:6f:d7:8c:fa:46:b6:b6:2a:ee:6a:
0c:c9:03:18:af:4e:93:6c:61:f3:b4:78:0c:61:93:f1:
d8:1b:00:c3:e5:29:9a:08:0a:f8:31:67:88:3d:c3:88:
7a:60:c0:c4:52:94:25:56:e5:a3:df:7d:58:c5:df:9a:
c7:22:7e:2c:f6:fb:2c:bf:b7:7f:c5:ca:2b:0f:8c:20:
77:b9:1f:e0:62:5a:3d:d4:6f:12:ea:c8:51:67:a5:75:
ad:e9:ac:9e:4e:2e:2d:34:80:e7:d8:64:f6:8f:2f:33:
32:1f:8b:bc:9c:e8:77:4a:ee:7b:84:31:ec:28:e9:70
Fingerprint (SHA-256):
96:F4:A5:FA:6D:8A:F8:7E:A6:10:49:BD:43:34:C1:92:C6:7D:FF:63:41:8E:69:C0:AC:34:6B:CB:63:7B:56:31
Fingerprint (SHA1):
B6:91:9B:C6:7A:45:9C:92:FD:E7:C7:33:00:FA:91:DF:7D:5F:00:21
Mozilla-CA-Policy: false (attribute missing)
Certificate Trust Flags:
SSL Flags:
User
Email Flags:
User
Object Signing Flags:
User
$
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 4096 (0x1000)
Signature Algorithm: PKCS #1 SHA-256 With RSA Encryption
Issuer: Ā«E=ca@test.ru,OGRN=1111111111111,INN=222222222222,CN=
,OU=
,O= ,STR
EET=Ā». , . 0",L=,ST=
,C=RU"
Validity:
Not Before: Tue Jul 07 08:40:14 2020
Not After: Fri Aug 06 08:40:14 2021
Subject: Ā«E=test@rsa.ru,CN= Ā»
Subject Public Key Info:
Public Key Algorithm: PKCS #1 RSA Encryption
RSA Public Key:
Modulus:
9a:9f:6c:60:94:f7:ec:f7:94:b3:51:01:e2:1a:c5:25:
28:bb:02:77:49:52:4d:99:8a:6e:26:12:55:8f:71:34:
04:da:39:24:f9:b4:6b:d0:0a:42:27:1b:b2:d7:9b:d9:
c3:76:b0:e0:1c:7c:21:ce:79:9f:d5:2b:17:63:cb:94:
5b:d9:b2:53:ff:b9:bf:4f:3d:cf:b7:8d:8a:37:ba:02:
8c:da:d2:0d:fd:46:5b:45:1d:95:64:07:6e:fa:88:0d:
a4:bd:b3:4a:ed:99:f1:fd:73:c5:b6:05:a0:e5:ee:6b:
c3:83:5b:d0:64:05:77:6a:18:d8:c8:28:a1:d0:06:41:
23:0d:bb:87:8a:77:14:fb:6c:5d:af:db:2b:0b:11:a3:
16:1b:2b:05:18:26:a9:b5:00:4a:40:da:b3:05:aa:2a:
67:c0:18:0d:03:f7:d2:b9:ba:7c:36:f9:95:2e:56:81:
a3:09:99:5e:20:10:95:38:10:c9:c1:6f:c3:6c:a6:1b:
78:51:c6:e4:4f:11:bc:c0:22:4b:ca:59:16:f2:45:95:
0d:fd:7b:46:cf:c7:ac:1c:3d:d7:26:fc:ad:80:3e:2c:
21:93:29:32:a6:79:e2:a8:c6:e9:5e:45:34:d3:38:57:
8f:cd:95:5e:91:09:84:34:21:d2:16:29:69:75:4d:a3
Exponent: 65537 (0x10001)
Signed Extensions:
Name: Certificate Basic Constraints
Critical: True
Data: Is not a CA.
Name: Certificate Key Usage
Usages: Digital Signature
Key Encipherment
Key Agreement
Name: Certificate Type
Data: <SSL Client,S/MIME>
Name: Extended Key Usage
TLS Web Client Authentication Certificate
E-Mail Protection Certificate
Name: Certificate Subject Key ID
Data:
26:a1:b3:98:1c:fe:62:ba:23:81:96:37:3f:08:bd:70:
d6:f2:b1:46
Name: Certificate Authority Key Identifier
Key ID:
0a:b6:f6:87:64:1d:8e:b3:63:08:29:9f:21:59:ad:47:
d8:ea:07:f4
Issuer:
Directory Name: Ā«E=ca@test.ru,OGRN=1111111111111,INN=22222222
2222,CN= ,OU=
,O=
,STREET=Ā».
, . 0",L=,ST=
,C=RU"
Serial Number:
00:a2:9b:22:32:3e:a7:3d:d8
Name: Certificate Subject Alt Name
RFC822 Name: Ā«test@rsa.ruĀ»
Name: Certificate Issuer Alt Name
Error: Parsing extension: Certificate extension value is invalid.
Data: Sequence {
}
Signature Algorithm: PKCS #1 SHA-256 With RSA Encryption
Signature:
2f:75:7e:71:9e:15:5c:97:fe:a2:e1:2a:52:39:56:55:
e0:62:60:bc:5f:6d:c2:b6:ec:cd:8b:10:b3:b1:3f:e5:
d6:d1:5f:a5:fa:61:c1:ce:3e:db:6a:2f:b2:13:46:8d:
67:cf:18:09:61:97:01:45:bc:99:bb:0c:d6:0a:a3:03:
87:0a:8e:10:3a:d5:e3:94:6d:4a:24:fa:c3:40:0b:43:
c2:3b:00:56:06:c4:d2:fc:b2:7e:e9:00:e5:2f:4b:e2:
3a:91:49:ce:f8:c3:60:ec:01:74:d8:1a:3b:af:e6:f6:
91:db:c5:f1:d7:de:be:18:38:47:41:8a:e2:ef:80:91:
10:54:41:ae:55:22:6f:d7:8c:fa:46:b6:b6:2a:ee:6a:
0c:c9:03:18:af:4e:93:6c:61:f3:b4:78:0c:61:93:f1:
d8:1b:00:c3:e5:29:9a:08:0a:f8:31:67:88:3d:c3:88:
7a:60:c0:c4:52:94:25:56:e5:a3:df:7d:58:c5:df:9a:
c7:22:7e:2c:f6:fb:2c:bf:b7:7f:c5:ca:2b:0f:8c:20:
77:b9:1f:e0:62:5a:3d:d4:6f:12:ea:c8:51:67:a5:75:
ad:e9:ac:9e:4e:2e:2d:34:80:e7:d8:64:f6:8f:2f:33:
32:1f:8b:bc:9c:e8:77:4a:ee:7b:84:31:ec:28:e9:70
Fingerprint (SHA-256):
96:F4:A5:FA:6D:8A:F8:7E:A6:10:49:BD:43:34:C1:92:C6:7D:FF:63:41:8E:69:C0:AC:34:6B:CB:63:7B:56:31
Fingerprint (SHA1):
B6:91:9B:C6:7A:45:9C:92:FD:E7:C7:33:00:FA:91:DF:7D:5F:00:21
Mozilla-CA-Policy: false (attribute missing)
Certificate Trust Flags:
SSL Flags:
User
Email Flags:
User
Object Signing Flags:
User
$
åććć¼ćÆć³ć§č”Øē¤ŗćććčؼęęøć«ē§åÆéµćććå “åćčؼęęøć®äæ”é ¼ćć©ć°ćÆć¦ć¼ć¶ć¼ć«ćŖćć¾ćć
čؼęęøć®äæ”é ¼ćć©ć°ļ¼
SSLćć©ć°ļ¼
ć¦ć¼ć¶ć¼
é»åć”ć¼ć«ćć©ć°ļ¼
ć¦ć¼ć¶ć¼
ćŖććøć§ćÆćē½²åćć©ć°ļ¼
ć¦ć¼ć¶ć¼
ćć¼ćÆć³ććęØęŗåŗåć«čؼęęøććØćÆć¹ćć¼ćććć«ćÆćć-aćć¾ććÆć-rććć©ć”ć¼ćæć¼ćčæ½å ććć ćć§ććć-aććŖćć·ć§ć³ćÆćčؼęęøćPEMå½¢å¼ć§åŗåććććć«ęē¤ŗćć¾ćć
$ certutil -L -d '/ home / a513 / tmp / TEST_NSS' -n'NSSčؼęęøDBļ¼ćć¹ćčؼęęø '-a
-----BEGIN CERTIFICATE-----
MIIGiTCCBXGgAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwggF2MQswCQYDVQQGEwJS
VTEsMCoGA1UECAwj0JzQvtGB0LrQvtCy0YHQutCw0Y8g0L7QsdC70LDRgdGC0Ywx
GzAZBgNVBAcMEtCl0LDQsdGA0LDQs9GA0LDQtDEqMCgGA1UECQwh0YPQuy4g0KXQ
sNCy0YDQvtCy0YHQutCw0Y8sINC0LiAwMTAwLgYDVQQKDCfQo9C00L7RgdGC0L7Q
stC10YDRj9GO0YjQuNC5INCm0LXQvdGC0YAxOzA5BgNVBAsMMtCe0YLQtNC10Lsg
0KPQtNC+0YHRgtC+0LLQtdGA0Y/RjtGI0LjQuSDQptC10L3RgtGAMTAwLgYDVQQD
DCfQo9C00L7RgdGC0L7QstC10YDRj9GO0YjQuNC5INCm0LXQvdGC0YAxGjAYBggq
hQMDgQMBARIMMjIyMjIyMjIyMjIyMRgwFgYFKoUDZAESDTExMTExMTExMTExMTEx
GTAXBgkqhkiG9w0BCQEWCmNhQHRlc3QucnUwHhcNMjAwNzA3MDg0MDE0WhcNMjEw
ODA2MDg0MDE0WjBMMS4wLAYDVQQDDCXQotC10YHRgtC+0LLRi9C5INGB0LXRgNGC
0LjRhNC40LrQsNGCMRowGAYJKoZIhvcNAQkBFgt0ZXN0QHJzYS5ydTCCASIwDQYJ
KoZIhvcNAQEBBQADggEPADCCAQoCggEBAJqfbGCU9+z3lLNRAeIaxSUouwJ3SVJN
mYpuJhJVj3E0BNo5JPm0a9AKQicbsteb2cN2sOAcfCHOeZ/VKxdjy5Rb2bJT/7m/
Tz3Pt42KN7oCjNrSDf1GW0UdlWQHbvqIDaS9s0rtmfH9c8W2BaDl7mvDg1vQZAV3
ahjYyCih0AZBIw27h4p3FPtsXa/bKwsRoxYbKwUYJqm1AEpA2rMFqipnwBgNA/fS
ubp8NvmVLlaBowmZXiAQlTgQycFvw2ymG3hRxuRPEbzAIkvKWRbyRZUN/XtGz8es
HD3XJvytgD4sIZMpMqZ54qjG6V5FNNM4V4/NlV6RCYQ0IdIWKWl1TaMCAwEAAaOC
AkcwggJDMAwGA1UdEwEB/wQCMAAwCwYDVR0PBAQDAgOoMBEGCWCGSAGG+EIBAQQE
AwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwHQYDVR0OBBYEFCah
s5gc/mK6I4GWNz8IvXDW8rFGMIIBsAYDVR0jBIIBpzCCAaOAFAq29odkHY6zYwgp
nyFZrUfY6gf0oYIBfqSCAXowggF2MQswCQYDVQQGEwJSVTEsMCoGA1UECAwj0JzQ
vtGB0LrQvtCy0YHQutCw0Y8g0L7QsdC70LDRgdGC0YwxGzAZBgNVBAcMEtCl0LDQ
sdGA0LDQs9GA0LDQtDEqMCgGA1UECQwh0YPQuy4g0KXQsNCy0YDQvtCy0YHQutCw
0Y8sINC0LiAwMTAwLgYDVQQKDCfQo9C00L7RgdGC0L7QstC10YDRj9GO0YjQuNC5
INCm0LXQvdGC0YAxOzA5BgNVBAsMMtCe0YLQtNC10Lsg0KPQtNC+0YHRgtC+0LLQ
tdGA0Y/RjtGI0LjQuSDQptC10L3RgtGAMTAwLgYDVQQDDCfQo9C00L7RgdGC0L7Q
stC10YDRj9GO0YjQuNC5INCm0LXQvdGC0YAxGjAYBggqhQMDgQMBARIMMjIyMjIy
MjIyMjIyMRgwFgYFKoUDZAESDTExMTExMTExMTExMTExGTAXBgkqhkiG9w0BCQEW
CmNhQHRlc3QucnWCCQCimyIyPqc92DAWBgNVHREEDzANgQt0ZXN0QHJzYS5ydTAJ
BgNVHRIEAjAAMA0GCSqGSIb3DQEBCwUAA4IBAQAvdX5xnhVcl/6i4SpSOVZV4GJg
vF9twrbszYsQs7E/5dbRX6X6YcHOPttqL7ITRo1nzxgJYZcBRbyZuwzWCqMDhwqO
EDrV45RtSiT6w0ALQ8I7AFYGxNL8sn7pAOUvS+I6kUnO+MNg7AF02Bo7r+b2kdvF
8dfevhg4R0GK4u+AkRBUQa5VIm/XjPpGtrYq7moMyQMYr06TbGHztHgMYZPx2BsA
w+UpmggK+DFniD3DiHpgwMRSlCVW5aPffVjF35rHIn4s9vssv7d/xcorD4wgd7kf
4GJaPdRvEurIUWelda3prJ5OLi00gOfYZPaPLzMyH4u8nOh3Su57hDHsKOlw
-----END CERTIFICATE-----
MIIGiTCCBXGgAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwggF2MQswCQYDVQQGEwJS
VTEsMCoGA1UECAwj0JzQvtGB0LrQvtCy0YHQutCw0Y8g0L7QsdC70LDRgdGC0Ywx
GzAZBgNVBAcMEtCl0LDQsdGA0LDQs9GA0LDQtDEqMCgGA1UECQwh0YPQuy4g0KXQ
sNCy0YDQvtCy0YHQutCw0Y8sINC0LiAwMTAwLgYDVQQKDCfQo9C00L7RgdGC0L7Q
stC10YDRj9GO0YjQuNC5INCm0LXQvdGC0YAxOzA5BgNVBAsMMtCe0YLQtNC10Lsg
0KPQtNC+0YHRgtC+0LLQtdGA0Y/RjtGI0LjQuSDQptC10L3RgtGAMTAwLgYDVQQD
DCfQo9C00L7RgdGC0L7QstC10YDRj9GO0YjQuNC5INCm0LXQvdGC0YAxGjAYBggq
hQMDgQMBARIMMjIyMjIyMjIyMjIyMRgwFgYFKoUDZAESDTExMTExMTExMTExMTEx
GTAXBgkqhkiG9w0BCQEWCmNhQHRlc3QucnUwHhcNMjAwNzA3MDg0MDE0WhcNMjEw
ODA2MDg0MDE0WjBMMS4wLAYDVQQDDCXQotC10YHRgtC+0LLRi9C5INGB0LXRgNGC
0LjRhNC40LrQsNGCMRowGAYJKoZIhvcNAQkBFgt0ZXN0QHJzYS5ydTCCASIwDQYJ
KoZIhvcNAQEBBQADggEPADCCAQoCggEBAJqfbGCU9+z3lLNRAeIaxSUouwJ3SVJN
mYpuJhJVj3E0BNo5JPm0a9AKQicbsteb2cN2sOAcfCHOeZ/VKxdjy5Rb2bJT/7m/
Tz3Pt42KN7oCjNrSDf1GW0UdlWQHbvqIDaS9s0rtmfH9c8W2BaDl7mvDg1vQZAV3
ahjYyCih0AZBIw27h4p3FPtsXa/bKwsRoxYbKwUYJqm1AEpA2rMFqipnwBgNA/fS
ubp8NvmVLlaBowmZXiAQlTgQycFvw2ymG3hRxuRPEbzAIkvKWRbyRZUN/XtGz8es
HD3XJvytgD4sIZMpMqZ54qjG6V5FNNM4V4/NlV6RCYQ0IdIWKWl1TaMCAwEAAaOC
AkcwggJDMAwGA1UdEwEB/wQCMAAwCwYDVR0PBAQDAgOoMBEGCWCGSAGG+EIBAQQE
AwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwHQYDVR0OBBYEFCah
s5gc/mK6I4GWNz8IvXDW8rFGMIIBsAYDVR0jBIIBpzCCAaOAFAq29odkHY6zYwgp
nyFZrUfY6gf0oYIBfqSCAXowggF2MQswCQYDVQQGEwJSVTEsMCoGA1UECAwj0JzQ
vtGB0LrQvtCy0YHQutCw0Y8g0L7QsdC70LDRgdGC0YwxGzAZBgNVBAcMEtCl0LDQ
sdGA0LDQs9GA0LDQtDEqMCgGA1UECQwh0YPQuy4g0KXQsNCy0YDQvtCy0YHQutCw
0Y8sINC0LiAwMTAwLgYDVQQKDCfQo9C00L7RgdGC0L7QstC10YDRj9GO0YjQuNC5
INCm0LXQvdGC0YAxOzA5BgNVBAsMMtCe0YLQtNC10Lsg0KPQtNC+0YHRgtC+0LLQ
tdGA0Y/RjtGI0LjQuSDQptC10L3RgtGAMTAwLgYDVQQDDCfQo9C00L7RgdGC0L7Q
stC10YDRj9GO0YjQuNC5INCm0LXQvdGC0YAxGjAYBggqhQMDgQMBARIMMjIyMjIy
MjIyMjIyMRgwFgYFKoUDZAESDTExMTExMTExMTExMTExGTAXBgkqhkiG9w0BCQEW
CmNhQHRlc3QucnWCCQCimyIyPqc92DAWBgNVHREEDzANgQt0ZXN0QHJzYS5ydTAJ
BgNVHRIEAjAAMA0GCSqGSIb3DQEBCwUAA4IBAQAvdX5xnhVcl/6i4SpSOVZV4GJg
vF9twrbszYsQs7E/5dbRX6X6YcHOPttqL7ITRo1nzxgJYZcBRbyZuwzWCqMDhwqO
EDrV45RtSiT6w0ALQ8I7AFYGxNL8sn7pAOUvS+I6kUnO+MNg7AF02Bo7r+b2kdvF
8dfevhg4R0GK4u+AkRBUQa5VIm/XjPpGtrYq7moMyQMYr06TbGHztHgMYZPx2BsA
w+UpmggK+DFniD3DiHpgwMRSlCVW5aPffVjF35rHIn4s9vssv7d/xcorD4wgd7kf
4GJaPdRvEurIUWelda3prJ5OLi00gOfYZPaPLzMyH4u8nOh3Su57hDHsKOlw
-----END CERTIFICATE-----
DERåŗåć«ćÆćć-rććć©ć”ć¼ćæć¼ćä½æēØćć¾ćć
ćć¼ćÆć³ć®čؼęęøćć¤ć³ć¹ćć¼ć«ćć
OpenSSLćä½æēØćć¦ēęććåäŗŗčؼęęøćØē§åÆéµćåććPKCSļ¼12ć³ć³ććććććØćć¾ććåäŗŗčؼęęøćNSSć¹ćć¢ć«ćØćÆć¹ćć¼ćććć«ćÆćꬔć®pk12utilć³ćć³ććä½æēØćć¾ćć
$pk12util -i < pkcs12> [-d < NSS>] [-h < >]ē¹å®ć®ćć¼ćÆć³ć®čؼęęøćć¤ć³ćć¼ćććå “åćÆććć®ć©ćć«ćčØå®ććåæ č¦ćććć¾ćććć1ć¤ć®ę©č½ć«ę³Øęćć¾ććććć³ć³ććć«ć«ć¼ćčؼęęøćå«ć¾ćć¦ććå “åćććććÆå éØćć¼ćÆć³ćNSSčؼęęøDBćć«äæåććć¾ćććććÆććć©ć«ćć§ćÆäæ”é ¼å±ę§ćčØå®ćć¾ćććä½ććć®ēē±ć§ćē»é²ę©é¢ć®ē¹å®ć®čؼęęøļ¼ć«ć¼ćčؼęęøļ¼ć¾ććÆSSLčؼęęøć«äæ”é ¼å±ę§ćčØå®ććåæ č¦ćććå “åćÆćꬔć®å½¢å¼ć®certutilć¦ć¼ćć£ćŖćć£ćä½æēØććć¾ćć
$certutil -M -n <nickname-> -t < > [-d < NSS>]čؼęęøććØć«ćSSLćS / MIMEćåäæ”é ¼čØå®ć®ć³ć¼ćē½²åć®é åŗć§č”Øććć3ć¤ć®å©ēØåÆč½ćŖäæ”é ¼ć«ćć“ćŖćććć¾ćć
< > := x,y,z , - x-SSLć®å±ę§ć
- y-S / MIMEć®å±ę§ć
- z-ć³ć¼ćē½²åć®å±ę§ć
xćyćzć®åä½ē½®ćÆćē©ŗć«ćććļ¼ććęē¤ŗēćŖäæ”é ¼ćä½æēØććŖćļ¼ć1ć¤ä»„äøć®å±ę§ćå«ććććØćć§ćć¾ćć
- p-ęå¹ćŖćć¢ć
- P-äæ”é ¼ć§ćććć¼ćļ¼pćęå³ćć¾ćļ¼
- c-ē»é²ę©é¢ć®ęå¹ćŖčؼęęøļ¼ęå¹ćŖCAļ¼
- T-ćÆć©ć¤ć¢ć³ćčؼęęøćēŗč”ććććć®äæ”é ¼ć§ććCAļ¼cćęē¤ŗććć¾ćļ¼
- C-ćµć¼ćć¼čؼęęøćēŗč”ććććć®äæ”é ¼ć§ććCAļ¼SSLć®ćæļ¼ļ¼ęé»ć®cļ¼
ćć¹ć¦ć®å¤éØćć¼ćÆć³ćē§åÆéµććć¼ćÆć³ć«ć¤ć³ćć¼ćććęä½ćčرåÆććććć§ćÆćŖć ććØć«ę³Øęćć¦ćć ććć
ćć”ć¤ć«ććåē“ćŖčؼęęøćć¤ć³ć¹ćć¼ć«ććć«ćÆćꬔć®å½¢å¼ć®certutilć¦ć¼ćć£ćŖćć£ćä½æēØćć¾ćć
$certutil -A -n < > -t < > [-d < NSS>] [-h < >] [-a] [-i < >]ę®åæµćŖććććć®ć³ć³ććć¹ćć§ćÆć<certificatelabel>ćÆäøčØć®čؼęęøć®ćććÆćć¼ć ćØåēć§ćÆććć¾ćććććć§ćčؼęęøć©ćć«ćÆCKA_LABELć®ćæć«äøč“ćććć¼ćÆć³ć©ćć«ćęå®ććć«ć©ćć«ć®ćæć«äøč“ćć¾ććććēØ®ć®ēē¾ć
ććć©ć«ćć§ćÆćčؼęęøćÆDERć§ćØć³ć³ć¼ćććććć”ć¤ć«ć«ćććØč¦ćŖććć¾ććčؼęęøćPEMć§ćØć³ć³ć¼ćććć¦ććå “åćÆćć-aććć©ć”ć¼ćæć¼ćęå®ććåæ č¦ćććć¾ćć ć-iććć©ć”ć¼ćæć¼ćęå®ććć¦ććŖćå “åćčؼęęøćÆęØęŗå „åļ¼stdinļ¼ććåå¾ććć¾ććććć©ć«ćć§ćÆćčؼęęøćÆćNSS Certificate DBććć¼ćÆć³ć«ć¤ć³ć¹ćć¼ć«ććć¾ćććčؼęęøćå¤éØćć¼ćÆć³ļ¼ć-hććć©ć”ć¼ćæć¼ļ¼ć«ć¤ć³ć¹ćć¼ć«ććććØćć§ćć¾ććå¤éØćć¼ćÆć³ć«čؼęęøćć¤ć³ć¹ćć¼ć«ććå “åćčؼęęøćÆå éØćć¼ćÆć³ļ¼ćNSSčؼęęøDBćļ¼ćØå¤éØćć¼ćÆć³ć®äø”ę¹ć«ć¤ć³ć¹ćć¼ć«ććć¾ćććć®å “åćå¤éØćć¼ćÆć³ć®äæ”é ¼å±ę§ćÆē”č¦ććććčؼęęøć®äæ”é ¼ćå¤ę“ć§ćć¾ććć§ććććØććč¦åćēŗč”ććć¾ćć
å éØćć¼ćÆć³ć®éč¤ććčؼęęøćÆćåæ č¦ć«åæćć¦åé¤ć§ćć¾ćć
ćć¼ćÆć³ććčؼęęøćåé¤ććć«ćÆćꬔć®ć³ćć³ććä½æēØćć¾ćć
$certutil -D [-d < NSS>] -n <nickname->ććØćć°ćć©ćć«ļ¼CKA_LABELļ¼ "User1"ć®čؼęęøćRuTokenECP20ćć¼ćÆć³ććåé¤ććć«ćÆćꬔć®ć³ćć³ććå®č”ććć ćć§ćć
$certutil -D -d /home/a513/tmp/TEST_NSS -n "RuTokenECP20:1"čؼęęøćåé¤ćć¦ćććć®ē§åÆéµćÆåé¤ććć¾ććļ¼ćć”ćććē§åÆéµćććå “åļ¼ćē§åÆéµćåé¤ććć«ćÆćꬔć®å½¢å¼ć®ć³ćć³ććå®č”ććåæ č¦ćććć¾ćć
$certutil -F [-k < >] [-d < NSS>] -n <nickname->,
< > := rsa|dsa|ec
NSSćŖććøććŖćåäŗŗčؼęęøä»ćć®ćć¼ćÆć³ćć§ććć®ć§ćé»åē½²åćä½æēØć§ćć¾ćć
é»åē½²åć®å½¢ęćØę¤čؼ
NSSććć±ć¼ćøć«ćÆćé»åē½²åćęä½ććććć®3ć¤ć®ć¦ć¼ćć£ćŖćć£ćććć¾ćć
p7signć¦ć¼ćć£ćŖćć£ćÆćé»åē½²åćēęććććć«ä½æēØććć¾ćć
$pksign -k <nickname > [-d < NSS>] [-e] [-i < >] [-o < >],
<nickname > := [< >:]<CKA_LABEL>
ę®åæµćŖćććć¦ć¼ćć£ćŖćć£ćÆććć®å½¢ęęå»ćåē §ććć«ē½²åćēęćć¾ćććććććććÆē°”åć«äæ®ę£ć§ćć¾ććē½²åēęęéćčæ½å ććććć®é¢ę°ćå¼ć³åŗćć¦ćp7sign.cć¦ć¼ćć£ćŖćć£ć®SignFileé¢ę°ć«č”ćčæ½å ććć ćć§ååć§ćć
SignFile(FILE *outFile, PRFileDesc *inFile, CERTCertificate *cert,
PRBool encapsulated)
{
. . .
/* XXX Need a better way to handle that usage stuff! */
cinfo = SEC_PKCS7CreateSignedData(cert, certUsageEmailSigner, NULL,
SEC_OID_SHA1,
encapsulated ? NULL : &digest,
NULL, NULL);
if (cinfo == NULL)
return -1;
/* */
SEC_PKCS7AddSigningTime(cinfo);
if (encapsulated) {
SEC_PKCS7SetContent(cinfo, (char *)data2sign.data, data2sign.len);
}
. . .
}ććć§ćé»åē½²åćCAdes-BESå½¢å¼ć§ēęććć¾ćć
NSSć§ćÆćčؼęęøćØćć®ē§åÆéµćåććć¼ćÆć³ć«äæåććććććć®ć©ćć«ļ¼CKA_LABELļ¼ćØCKA_IDćåćć§ććććØćčŖćććć¦ćć¾ćććććć£ć¦ćē§åÆéµć®ćććÆćć¼ć ćØčؼęęøčŖä½ć®ćććÆćć¼ć ćÆåćć§ććčؼęęøå ć®ē§åÆéµć®ååØćÆćč”Øē¤ŗćććčؼęęøć®äæ”é ¼å±ę§ć®å¤ "ućuću"ć«ćć£ć¦ę¤åŗć§ććććØćęćåŗćć¦ćć ććļ¼ć³ćć³ćcertutil -Lļ¼ć
ććć©ć«ćć§ćÆćp7signć¦ć¼ćć£ćŖćć£ćÆććæćććććē½²åćēęćć¾ććčæ½å ć®ē½²åćåæ č¦ćŖå “åćÆćć-eććć©ć”ć¼ćæć¼ćęå®ććåæ č¦ćććć¾ćć NSSć¹ćć¢ć®å éØćć¼ćÆć³ć«ćē½²åč ć®čؼęęøć®ć«ć¼ćčؼęęøćć§ć¼ć³ććŖćå “åćć¾ććÆē½²åč ć®äæ”é ¼å±ę§ćčØå®ććć¦ććŖćå “åćē½²åćÆēęćććŖćććØć«ę³Øęćć¦ćć ććć
p7verifyć¦ć¼ćć£ćŖćć£ćÆćé»åē½²åćę¤čؼććććć«ä½æēØććć¾ćć
$p7verify -c < > -s < > [-d < NSS>] [-u < >] ć-uććć©ć”ć¼ćæćéč¦ć§ććē½²åč ć®čؼęęøć®ćæć¤ććē¢ŗčŖććććć«ęē¤ŗććęå®ććććæć¤ććØäøč“ććŖćå “åćē½²åćÆē”å¹ć«ćŖćć¾ćć
å¤<certificateusage>ć«ćÆćꬔć®å¤ćęå®ć§ćć¾ćć
0 - certUsageSSLClient
1 - certUsageSSLServer
2 - certUsageSSLServerWithStepUp
3 - certUsageSSLCA
4 - certUsageEmailSigner
5 - certUsageEmailRecipient
6 - certUsageObjectSigner
7 - certUsageUserCertImport
8 - certUsageVerifyCA
9 - certUsageProtectedObjectSigner
10 - certUsageStatusResponder
11 - certUsageAnyCA
12 - certUsageIPsec
ććć©ć«ććÆcertUsageEmailSignerļ¼4ļ¼ć§ćć
p7contentć¦ć¼ćć£ćŖćć£ćä½æēØćććØćććć„ć”ć³ćć«ē½²åććęéćē½²åč ćććć³ē½²åč ć®é»åć”ć¼ć«ć¢ćć¬ć¹ć«é¢ććę å ±ćåå¾ć§ćć¾ććē½²åćę·»ä»ććć¦ććå “åćÆćē½²åćććć³ć³ćć³ćčŖä½ćåå¾ććć¾ćć
p7contentć¦ć¼ćć£ćŖćć£ć®å½¢å¼ćÆꬔć®ćØććć§ćć
$p7content [-d < NSS>] [-i < >] [-o < >]ä¾ćć°ļ¼
$ p7content -d "sql:/home/a513/tmp/TEST_NSS" -i "/home/a513/DATE_NSS.txt.p7s"
Content printed between bars (newline added before second bar):
# , "-" ()
#
---------------------------------------------
NSS
---------------------------------------------
Content was not encrypted.
Signature is valid.
The signer's common name is 1
The signer's email address is user1@mail.ru
Signing time: Fri Jul 17 10:00:45 2020
There were certs or crls included.
$ććććÆćNSSććć±ć¼ćøć«å«ć¾ćć¦ććć¦ć¼ćć£ćŖćć£ć®ć»ćć®äøéØć§ććå½ē¶ćOpenSSLćØNSSć®äø”ę¹ć«ćčؼęęøč¦ę±ćä½ęćć¦čؼęęøćēŗč”ć§ććć¦ć¼ćć£ćŖćć£ļ¼ć¾ććÆć³ćć³ćļ¼ćććć¾ćć opensslć®å “åćØåćććć«ćå®å Øć«ę©č½ććCAććććć¤ć§ćć¾ćć selfservć¦ć¼ćć£ćŖćć£ļ¼openssl s_serverć®ć¢ććć°ļ¼ćä½æēØćć¦tls-serverćčµ·åććtls-client tstclntļ¼openssl s-clientć®ć¢ććć°ļ¼ćŖć©ćä½æēØć§ćć¾ćć
ć”ćŖćæć«ćNSSć®ęå·ć¹ć¤ć¼ćć®ćŖć¹ććÆlistsuitesć¦ć¼ćć£ćŖćć£ć§åå¾ć§ćć¾ćć OpenSSLć§ćÆćopensslciphersć³ćć³ćććć®ē®ēćęććć¾ćć OpenSSLęå·ć¹ć¤ć¼ćåććIANAęå·ć¹ć¼ćåćøć®ćććć³ć°ćÆććć«ććć¾ćć
å®éćOpenSSLćØNSSćÆćåćć³ć¤ć³ć®2ć¤ć®å“é¢ļ¼åććććć³ć«ćØęØęŗć®2ēØ®é”ć®ć¤ć³ćæć¼ćć§ć¤ć¹ļ¼ć§ćććććŖććÆćć¼ć¤ć³ćć©ć¹ćć©ćÆćć£ć§ćć
ćć®ććććÆć«čå³ćććć°ć話ćÆē¶ćć¾ćć
ēµč«ćØćć¦ćNSSć®ć°ć©ćć£ć«ć«ć·ć§ć«ć«ć¤ćć¦ćč©³ććčŖ¬ęććććØęćć¾ććOpenSSLć«ćÆćć¾ćć¾ćŖć°ć©ćć£ć«ć«ć·ć§ć«ćććć¾ććXCAćØCAFL63ć®2ć¤ć ćć«ę³Øęćć¾ćć
NSSććć±ć¼ćøēØć®GuinsspyGUI
ęåć®č³ŖåćÆä½ćéēŗćććć§ććPythonć§ę±ŗå®ććć¾ććć
2ēŖē®ć®č³ŖåćÆćć°ć©ćć£ć«ć«ć¤ć³ćæć¼ćć§ć¤ć¹ćä½ć«ęøćč¾¼ććć§ććēććÆTkinterć§ćć
guićÆććØććØPAGEć§éēŗććć¾ććććććććć®å¾ćå½¼ććÆå½¼ććé¢ćć¾ćććććććęčćÆę®ć£ćć
ć¦ć¼ćć£ćŖćć£ć®ę©č½ćÆćäøčØć®ć¦ć¼ćć£ćŖćć£ćØć³ćć³ćć«åŗć„ćć¦ćć¾ćććććć«å ćć¦ććcertutil -Rćć³ćć³ćć«åŗć„ćå„ć®ę©č½ćčؼęęøćŖćÆćØć¹ćć®ä½ęććčæ½å ććć¾ć
ććć¦ć£ćøć§ććć®ćć¼ććØćć¦ćpython3ć®Breezećć¼ććØpython2ć®Arcćć¼ććä½æēØććććØć«ćć¾ćććå¾č ć«ćÆćBreezećć¼ćććŖćććć§ćććććč”ćć«ćÆćpythonać®ćć¼ććå«ćććć±ć¼ćøćć¤ć³ć¹ćć¼ć«ććåæ č¦ćććć¾ćć
$pip install ttkthemesčؼęęøćå¦ē ććć«ćÆćfsb795ććć±ć¼ćøćåæ č¦ć§ćć
$pip install fsb795guinsspyćåŗć„ćć¦ććNSSć¦ć¼ćć£ćŖćć£ćÆćć³ć³ć½ć¼ć«ćä»ćć¦ćć¹ćÆć¼ćć¾ććÆPINćč¦ę±ććććØćććććć¾ććGUIćä»ćć¦ććććØåÆ¾č©±ććåÆäøć®ę¹ę³ćÆćpexpectććć±ć¼ćøćä½æēØććććØć§ćć
$pip install pexpectpexpectććć±ć¼ćøć®ä½æēØä¾ćØćć¦ćPKCSļ¼12ć³ć³ćććć¤ć³ćć¼ćććććć®ć³ć¼ććꬔć«ē¤ŗćć¾ćć
importP12
def importP12(frameManager):
global readpw
global filename
tokname = frameManager.STCombobox1.get()
fp12 = frameManager.SEntry1.get()
if (fp12 == () or fp12 == ''):
tkMessageBox.showinfo(title=" PKCS#12", message=' \n')
return (-1, "", "")
filename = fp12
if sys.platform != "win32":
cmd_import_p12 = '"' + patch_win + 'pk12util" -i "' + fp12 + '" -h "' + tokname + '" -d "' + NSSname + '"'
id = pexpect.spawn(cmd_import_p12, timeout=1)
else:
cmd_import_p12 = '"' + patch_win + 'pk12util" -i "' + fp12 + '" -h "' + tokname + '" -d "' + NSSname + '"'
id = pexpect.popen_spawn.PopenSpawn(cmd_import_p12, timeout=10)
while(True):
ret = id.expect(["Enter Password or Pin", "Enter password for PKCS12 file",pexpect.EOF, pexpect.TIMEOUT])
if (ret == 0 or ret == 1):
root.update()
if (ret == 0):
password('', tokname, 0)
pasP11 = readpw
else:
password('', os.path.basename(fp12), 1)
pasP12 = readpw
if (readpwok == 0):
if sys.platform != "win32":
id.close()
return (-3, fp12, "")
if sys.platform != "win32":
id.send(readpw)
id.send("\r")
else:
id.sendline(readpw)
lseek = 1
elif (ret == 2):
break
elif (ret == 3):
break
if sys.platform != "win32":
id.close()
return (-1, fp12, "")
if sys.platform != "win32":
res = id.before.decode('UTF-8')
id.close()
else:
res = id.before.decode('UTF-8')
if (res.find("PKCS12 IMPORT SUCCESSFUL") != -1):
ret = 0
elif (res.find("SEC_ERROR_BAD_PASSWORD") != -1):
ret = -1
return (ret, fp12, "")
else:
ret = -2
return (ret, fp12, res)ććć·ć¼ćøć£å ć®ćØć³ćć¬ć¹ć«ć¼ćļ¼whileļ¼Trueļ¼:)ćÆćꬔć®4ć¤ć®ć¤ćć³ćć®ćććććēŗēććć®ćå¾ ć”ć¾ćć
ret = id.expect(["Enter Password or Pin", "Enter password for PKCS12 file",pexpect.EOF, pexpect.TIMEOUT])ęåć®ć¤ćć³ććÆććć¹ćÆć¼ćć¾ććÆPINć®å „åļ¼ććć¹ćÆć¼ćć¾ććÆćć³ć®å „åćļ¼ćøć®ęå¾ ć«é¢é£ä»ćććć¦ćć¾ćć
ćććēŗēćććØćPINć³ć¼ććå „åććććć®ć¦ć£ć³ćć¦ćē»é¢ć«č”Øē¤ŗććć¾ćļ¼ć¹ćÆćŖć¼ć³ć·ć§ććć®å·¦å“ć®ć¦ć£ć³ćć¦ļ¼
ć2ēŖē®ć®ć¤ćć³ććÆćPKCSļ¼12ć³ć³ććć¼ć®ćć¹ćÆć¼ćć®å „åļ¼ćPKCS12ćć”ć¤ć«ć®ćć¹ćÆć¼ćć®å „åćļ¼ć«é¢é£ćć¦ćć¾ććēŗēćććØćPKCSļ¼12ć³ć³ćććå«ććć”ć¤ć«ć®ćć¹ćÆć¼ććå „åććććć®ć¦ć£ć³ćć¦ćē»é¢ć«č”Øē¤ŗććć¾ćļ¼ć¹ćÆćŖć¼ć³ć·ć§ććć®å³å“ć®ć¦ć£ć³ćć¦ļ¼ć
3ēŖē®ć®ć¤ćć³ććÆpk12utilć¦ć¼ćć£ćŖćć£ļ¼pexpect.EOFļ¼ć®ēµäŗć«é¢é£ä»ćććć4ēŖē®ć®ć¤ćć³ććÆćæć¤ć ć¢ć¦ćļ¼pexpect.TIMEOUTļ¼ć«ććć¦ć¼ćć£ćŖćć£ć®ēµäŗć«é¢é£ä»ćććć¾ćć
guinsspyć®ć½ć¼ć¹ć³ć¼ććÆććć«ććć¾ćć Linux x86_64ćć©ćććć©ć¼ć ēØć®ćć·ć¢ęå·åć§PKCSļ¼11ćć¼ćÆć³ćęä½ććććć®NSSććć±ć¼ćøć®é åøććććććć«ććć¾ćć
ćć·ć¢ć®ęå·ćć¼ćÆć³ććć¹ćććć«ćÆćNSS_GOST_3.52.1_Linux_x86_64ćć©ć«ćć¼ććć¼ć ćć£ć¬ćÆććŖć«ć³ćć¼ćć¾ććguinsspy_gost.shć¹ćÆćŖćććä½ęćć¾ćć
export LD_LIBRARY_PATH=~/NSS_GOST_3.52.1_Linux_x86_64:$LD_LIBRARY_PATH
export PATH=~/NSS_GOST_3.52.1_Linux_x86_64:$PATH
python3 guinsspy.py
ꬔć«ććć®ć¹ćÆćŖćććå®č”ćć¦ććć·ć¢ć®ćć¼ćÆć³ćęä½ćć¾ćć
ćć·ć¢ć®ęå·åćä½æēØćććć¼ćÆć³ćęå ć«ćŖćå “åćÆć[ć½ććć¦ć§ć¢/ćÆć©ć¦ććć¼ćÆć³ć®ä½ę]ćæćć«ē§»åćć¾ćććć®ćæćć§ćÆćć³ć³ćć„ć¼ćæć¼ć§ć½ććć¦ć§ć¢ćć¼ćÆć³ćä½ęććę¹ę³ćć¾ććÆćÆć©ć¦ććć¼ćÆć³ć«ę„ē¶ććę¹ę³ćčŖ¬ęćć¾ćć
ęå¾ć«ćčؼęęø
ćŖćÆćØć¹ćć®ä½ęć®ć¹ćÆćŖć¼ć³ć·ć§ććļ¼åäæ”ćććŖćÆćØć¹ćććććØćć§ćCAFL63ć«č»¢éććććć«ćÆē§åÆéµćä½ęććććć¼ćÆć³ć«ć¤ć³ć¹ćć¼ć«ćććčؼęęøćēŗč”ćć¾ćććꬔć«ććć®čؼęęøćä½æēØćć¦ćććØćć°ćććć„ć”ć³ćć«ē½²åćć¾ćć