On 2009-11-20 00:24 PST, serval wrote:
> I need add my certificate into certdb with token "Builtin Object Token"
The "builtin object token" is a separate token from the token that holds the
cert DB. You can add your cert into the cert DB, or into the builtin object
token, or into both. See the diagram in figure 2.1 at
http://www.mozilla.org/projects/security/pki/nss/ref/ssl/gtstd.html#1... The "Builtin object token" is not shown there. If it was, it would look
like the box labeled "Fortezza", except that it would not have any explicit
physical slots and tokens, because the "builtin object token" is actually
a virtual token, whose contents are read only, compiled in to a shared library.
> I thought it is impossible but there have to exist some way because if I
> remove one of root certificates it is restored after firefox restart. But
> I can not find source code where this happen.
Right. It is actually a bug that Firefox appears to let you remove a root
cert. You cannot remove a root cert from the builtin object token because
it is read only, compiled in. When Firefox "deletes" it, Firefox merely
forgets about it for the remainder of that process lifetime, but the next
time the process restarts, it's right back again in the shared library,
because it never left the shared library.
> Could anyone help my? Maybe just point on part of code where firefox
> restores certificates on start up.
I hope my explanation has helped.
> thanks.
