certutil
NSS certificate database management
TLDR
SYNOPSIS
certutil [options]
DESCRIPTION
certutil manages keys and certificates in NSS (Network Security Services) databases. It creates, modifies, lists, and deletes certificates and key pairs used by applications built on the NSS library, including Firefox, Thunderbird, and Chromium-based browsers.NSS databases store certificates in a directory-based format, with modern versions using SQLite (specified with the `sql:` prefix). The tool handles the full certificate lifecycle including generating key pairs, creating self-signed certificates, importing CA certificates, and managing trust flags that control how certificates are used for SSL, email signing, and code signing.Trust flags follow the format "SSL,Email,Object Signing" where `C` marks a trusted CA and `T` marks a certificate trusted for client authentication.
PARAMETERS
-A
Add certificate to database-D
Delete certificate from database-L
List certificates-G
Generate new key pair-S
Create and add self-signed certificate-R
Generate certificate request-C
Create certificate from request-K
List keys in database-d dir
Database directory (use sql: prefix for SQLite)-n name
Certificate nickname/alias-t trust
Trust flags (e.g., "CT,,")-i file
Input file-o file
Output file-x
Self-sign certificate-s subject
Subject DN string-v months
Validity period in months
DATABASE TYPES
sql:dir: SQLite database (preferred)dbm:dir: Legacy BerkeleyDB format
TRUST FLAGS
Format: "SSL,Email,Object Signing" (e.g., "CT,,")C: Trusted CAT: Trusted for client authp: Valid peer
INSTALL
CAVEATS
Requires nss-tools package. Use sql: prefix for modern databases. Handles sensitive keys; run with minimal privileges.