Using Certutil; Creating Directory Server Certificates Through The Command Line - Red Hat DIRECTORY SERVER 8.0 - ADMINISTRATION Administration Manual

Chapter 11. Managing SSL
NOTE
When renewing a certificate using the Certificate Wizard, the text on the introduction
screen does not clearly indicate that the process is renewal and not requesting a new
certificate. Also, the requester information is not filled in automatically.

11.3. Using certutil

The Directory Server has a command-line tool, certutil, which locally creates self-signed CA and
client certificates, certificate databases, and keys. The default location for the Directory Server certutil
1
tool is /usr/bin/.
certutil can also be downloaded from ftp://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/.
11.3.1. Creating Directory Server Certificates through the Command
Line
The following steps outline how to make the databases, key, CA certificate, server/client certificate,
and convert the certificates into pkcs12 format.
1. Open the directory where the Directory Server certificate databases are stored.
cd /etc/dirsrv/slapd-instance_name
2. Make a backup copy of all of the filed in the directory as a precaution. If something goes awry with
while managing certificates, the databases can then be restored. For example:
tar -cf /tmp/db-backup.tar *
3. Create a password file for the security token password.
vi /tmp/pwdfile
secretpw
This password locks the server's private key in the key database and is used when the keys and
certificates are first created. The password in this file is also the default password to encrypt PK12
files used by pk12util. Because this password is stored in plaintext, the password file should be
owned by the user as which Directory Server runs, by default nobody, and it must be set as read-
only for the Directory Server user and allow no access to anyone else (mode 0400). It's a good
idea to have a secure backup of this file.
4. Set the environment variable for the shell to include the certutil directory path. For example:
export PATH=/usr/bin/:$PATH
The command varies depending on the shell.
This is the location for Red Hat Enterprise Linux 5 (32-bit). File locations for other platforms are listed in
Server File Locations".
350
Section 1.1, "Directory