From 36530cee371164702dc213bf571f49dfaaf5332e Mon Sep 17 00:00:00 2001 From: Vitezslav Cizek Date: Mar 05 2018 16:48:56 +0000 Subject: Change the default certificate database format to SQLite. Since version 3.35, NSS uses by default the SQLite format for certificate database. Adjust the documentation accordingly. --- diff --git a/Makefile.am b/Makefile.am index c57cd09..1ab1486 100644 --- a/Makefile.am +++ b/Makefile.am @@ -102,8 +102,8 @@ check: rm -rf work; \ nosetests -v test_cipher.py; \ if [ `id -u` != 0 ]; then \ - ./setup.sh -s 1; \ - nosetests -v test.py; \ + ./setup.sh -s 1 dbm:; \ + DBPREFIX=dbm: nosetests -v test.py; \ sleep 5; \ rm -rf work; \ ./setup.sh -s 1 sql:; \ diff --git a/docs/mod_nss.html b/docs/mod_nss.html index d648b51..a86c292 100644 --- a/docs/mod_nss.html +++ b/docs/mod_nss.html @@ -221,17 +221,17 @@ Generating key. This may take a few moments... [ Lots of output removed ] You should now have the following files:
-
/etc/httpd/nss/cert8.db
-/etc/httpd/nss/key3.db
-/etc/httpd/nss/secmod.db
+
/etc/httpd/nss/cert9.db
+/etc/httpd/nss/key4.db
+/etc/httpd/nss/pkcs11.txt
 

 These 3 files make up an NSS certificate database.

 

-If you have a sql: prefix on the path, like sql:/etc/httpd/nss, then it
-will generate an SQLite NSS database consisting of the following files:

-
/etc/httpd/nss/cert9.db
-/etc/httpd/nss/key4.db
-/etc/httpd/nss/pkcs11.txt

+If you have a dbm: prefix on the path, like dbm:/etc/httpd/nss, then it
+will generate an Berkeley DB NSS database consisting of the following files:

+
/etc/httpd/nss/cert8.db
+/etc/httpd/nss/key3.db
+/etc/httpd/nss/secmod.db

 
 
 
Server Startup

@@ -383,10 +383,12 @@ password.

 NSSCertificateDatabase

 

 Specifies the location of the NSS certificate database to be used. An
-NSS certificate database consists of 3 files: cert8.db, key3.db and
-secmod.db. cert8.db stores certificates and Certificate Revocation
-Lists (CRLs), key3.db stores keys and secmod.db stores information
+NSS certificate database consists of 3 files: cert9.db, key4.db and
+pkcs11.txt. cert9.db stores certificates and Certificate Revocation
+Lists (CRLs), key4.db stores keys and pkcs11.txt stores information
 about available PKCS#11 modules.

+Before version 3.35, NSS used a Berkeley DB format by default.
+It consisted of files cert8.db, key3.db and secmod.db.

 

 This directive specifies a path, not a filename. To use a sqlite
 NSS database include the prefix sql: in the path.

@@ -398,16 +400,16 @@ NSS database include the prefix sql: in the path.

 

 NSSDBPrefix

 

-Normally a certificate database consists of 3 files: cert8.db, key3.db
-and secmod.db. This directive allows you to add a named prefix to the
-filenames of cert8.db and key3.db so you can store multiple databases
+Normally a certificate database consists of 3 files: cert9.db, key4.db
+and pkcs11.txt. This directive allows you to add a named prefix to the
+filenames of cert9.db and key4.db so you can store multiple databases
 in one directory. 

 

 Example

 

 NSSDBPrefix my-prefix-

 

-You would then need: my-prefix-cert8.db, my-prefix-key3.db and secmod.db

+You would then need: my-prefix-cert9.db, my-prefix-key4.db and secmod.db

 

 In order to work with files with a prefix using the NSS command-line
 tools use the -P flag.

@@ -1553,14 +1555,14 @@ itself).

 

 
 
Database Management

-NSS stores it's certificates and keys in a set of files referred to as
-the "certificate database." The files by default (with NSS 3.x) are
-named cert8.db, key3.db and secmod.db. See the NSS documentation at http://www.mozilla.org/projects/security/pki/nss/
+NSS stores its certificates and keys in a set of files referred to as
+the "certificate database." The files by default (with NSS >= 3.35) are
+named cert9.db, key4.db and pkcs11.txt. See the NSS documentation at http://www.mozilla.org/projects/security/pki/nss/
 for more information on these specific files.

-By default the NSS databases use the Berkeley Database format (cert8 and
-key3). To use the sqlite format (cert9 and key4) either include sql: in
-all references to the database (-d sql:/path/to/database) or
-export NSS_DEFAULT_DB_TYPE="sql".
+Before version 3.35 the NSS databases used the Berkeley Database format by default
+(cert8 and key3). To use the old format either include dbm: in
+all references to the database (-d dbm:/path/to/database) or
+export NSS_DEFAULT_DB_TYPE="dbm".
 

 For more details see
 https://wiki.mozilla.org/NSS_Shared_DB

diff --git a/nss.conf.in b/nss.conf.in
index 09402a8..e0e2f71 100644
--- a/nss.conf.in
+++ b/nss.conf.in
@@ -122,14 +122,14 @@ NSSNickname Server-Cert
 
 #   Server Certificate Database:
 #   The NSS security database directory that holds the certificates and
-#   keys. The database consists of 3 files: cert8.db, key3.db and secmod.db.
+#   keys. The database consists of 3 files: cert9.db, key4.db and pkcs11.txt
 #   Provide the directory that these files exist.
 NSSCertificateDatabase @apache_conf@
 
 #   Database Prefix:
 #   In order to be able to store multiple NSS databases in one directory
 #   they need unique names. This option sets the database prefix used for
-#   cert8.db and key3.db.
+#   cert9.db and key4.db.
 #NSSDBPrefix my-prefix-
 
 #   Client Authentication (Type):
diff --git a/nss_engine_init.c b/nss_engine_init.c
index 0fd44da..774874b 100644
--- a/nss_engine_init.c
+++ b/nss_engine_init.c
@@ -191,9 +191,9 @@ static void nss_init_SSLLibrary(server_rec *base_server, apr_pool_t *p)
     }
 
     /* Strip the known prefixes */
-    if (strncasecmp(mc->pCertificateDatabase, "sql:", 4) == 0)
+    if (strncasecmp(mc->pCertificateDatabase, SQLDB, 4) == 0)
         dbdir = (char *)mc->pCertificateDatabase + 4;
-    else if (strncasecmp(mc->pCertificateDatabase, "dbm:", 4) == 0)
+    else if (strncasecmp(mc->pCertificateDatabase, LEGACY, 4) == 0)
         dbdir = (char *)mc->pCertificateDatabase + 4;
     else
         dbdir = (char *)mc->pCertificateDatabase;