Red Hat Training

A Red Hat training course is available for Red Hat Enterprise Linux

12.4. Storing Certificates in NSS Databases

By default, certmonger uses .pem files to store the key and the certificate. To store the key and the certificate in an NSS database, specify the -d and -n with the command you use for requesting the certificate.
  • -d sets the security database location
  • -n gives the certificate nickname which is used for the certificate in the NSS database

Note

The -d and -n options are used instead of the -f and -k options that give the .pem file.
For example: 
[root@server ~]# selfsign-getcert request -d /export/alias -n ServerCert ...
Requesting a certificate using ipa-getcert and local-getcert allows you to specify another two options:
  • -F gives the file where the certificate of the CA is to be stored.
  • -a gives the location of the NSS database where the certificate of the CA is to be stored.

Note

If you request a certificate using selfsign-getcert, there is no need to specify the -F and -a options because generating a self-signed certificate does not involve any CA.
Supplying the -F option, the -a option, or both with local-getcert allows you to obtain a copy of the CA certificate that is required in order to verify a certificate issued by the local signer. For example: 
[root@server ~]# local-getcert request -F /etc/httpd/conf/ssl.crt/ca.crt -n ServerCert -f /etc/httpd/conf/ssl.crt/server.crt -k /etc/httpd/conf/ssl.key/server.key