NSS tools certutil

Use certutil utility provided with NSS to manage your certificates.

listing certificates

list of all certificates:
certutil -d sql:$HOME/.pki/nssdb -L
details about certificate:
certutil -d sql:$HOME/.pki/nssdb -L -n _certificate_nickname_

signing

generate an RSA private key
certutil -G -d _database_directory_ -g _keysize_ -n _nickname_
generate a certificate signing request
certutil -S -s _subject_ -n _nickname_ -x -t C,C,C -o _file_
generate a self-signed certificate
certutil -S -s _subject_ -n _nickname_ -x -t C,C,C -o _file_

Import certificate

To add a certificate specify the -A option:
certutil -d sql:$HOME/.pki/nssdb -A -t "_TRUSTARGS_" -n _certificate_nickname_ -i _/path/to/cert/filename_

The TRUSTARGS are three strings of zero or more alphabetic characters, separated by commas, for example: "TCu,Cu,Tuw". They define how the certificate should be trusted for SSL, email, and object signing, and are explained in the certutil documentation or Meena’s blog post on trust flags.

To add a personal certificate and private key for SSL client authentication use the command:
pk12util -d sql:$HOME/.pki/nssdb -i _/path/to/PKCS12/cert/filename.p12_
This will import a personal certificate and private key stored in a PKCS #12 file. The TRUSTARGS of the personal certificate will be set to "u,u,u".

Edit certificate

Call certutil with -M option to edit the certificate. For example, to edit the TRUSTARGS:
certutil -d sql:$HOME/.pki/nssdb -M -t "_TRUSTARGS_" -n _certificate_nickname_

Delete certificate

Use -D option to remove the certificate:
certutil -d sql:$HOME/.pki/nssdb -D -n _certificate_nickname_