Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

certutil: unable to generate key(s)

1 view
Skip to first unread message

Jay Hennessy

unread,
Sep 26, 2002, 8:27:47 AM9/26/02
to
Hi,

I've just downloaded the distribution of the NSS tools. I am trying to
create a CA to sign my own XUL applications. When I run certutil as follows:

./certutil -S -s "CN=my.domain, O=my.domain" -n "my.domain" -t ",,C" -x
-d . -1 -2 -5

I generate the seed as requested, and then I get the following message:

certutil: unable to generate key(s)
: An I/O error occurred during security authorization.

If anyone has any ideas I'd be grateful.

Jay

Jay Hennessy

unread,
Sep 30, 2002, 12:02:13 PM9/30/02
to
In answering my own question: whilst following instructions in Chapter
12 of the new Mozilla book (http://books.mozdev.org) it suggests
deleting the key3.db and secmod.db files after creating the certificate
database. That was the problem - you mustn't.

Jay

Nelson B. Bolyard

unread,
Sep 30, 2002, 4:46:36 PM9/30/02
to
> Jay Hennessy wrote:

> > I've just downloaded the distribution of the NSS tools. I am trying to
> > create a CA to sign my own XUL applications. When I run certutil as
> > follows:
> >
> > ./certutil -S -s "CN=my.domain, O=my.domain" -n "my.domain" -t ",,C" -x
> > -d . -1 -2 -5
> >
> > I generate the seed as requested, and then I get the following message:
> >
> > certutil: unable to generate key(s)
> > : An I/O error occurred during security authorization.
> >
> > If anyone has any ideas I'd be grateful.

Jay Hennessy wrote:
>
> In answering my own question: whilst following instructions in Chapter
> 12 of the new Mozilla book (http://books.mozdev.org) it suggests
> deleting the key3.db and secmod.db files after creating the certificate
> database. That was the problem - you mustn't.

Yes, it seems that NSS will not let you generate a key pair in a crypto
token (key DB, in this case) that has no password. If you deleted the
key DB after it was created, then when you ran certutil, it would
create another key DB, but the new key DB would have no password.

If the book you bought has any way to report errors to the authors,
please report this error to them. Thanks.

--
Nelson Bolyard
Disclaimer: I speak for myself, not for Netscape

Nelson B. Bolyard

unread,
Sep 30, 2002, 4:50:11 PM9/30/02
to
Perhaps you can report the error using this link:

http://books.mozdev.org/corrections.html

Jay Hennessy

unread,
Oct 1, 2002, 3:52:32 AM10/1/02
to
Thanks, I already had in fact - for those interested, see comments at
the bottom of the relevant Chapter (12).
0 new messages