Converting Netscape cert7.db file to PEM format

Question

Does anyone know of a recommended way to convert a Netscape cert7.db file to PEM format so that clients can connect to the Sun Directory securely over TSL/SSL using, for example, Perl/Net::LDAPS. Net::LDAPS and other client ldap implementations often need to refer to a certificate store in PEM format.
I figured out how to do this with the old iPlanet Directory 4.16 series,
but with the new Sun 5.2 series, I'm hitting an interesting wall.
First, I install my campus CA's cert as well as the server cert (oldsage.berkeley.edu) to be used for TLS/SSL connections...
%/opt/sunone/lib/nss/bin/certutil -A -n "UCB-CA" -t "CT,," -a -i /home/staff/robreid/ssl-certs/ucb-ca.cer -d /directoryServerPath/alias -P 'slapd-oldsage-'
%/opt/sunone/lib/nss/bin/certutil -A -n "oldsage.berkeley.edu" -t "u,," -a -i /home/staff/robreid/ssl-certs/oldsage.cer -d /directoryServerPath/alias -P slapd-oldsage-
I can verity that the certs are installed properly...
%/opt/sunone/lib/nss/bin/certutil -L -d /directoryServerPath/alias -P slapd-oldsage-
Certificate Name Trust Attributes
server-cert u,,
UCB Issuing Certificate Authority 02 CT,,
Now, the conversion to PEM is interesting.
First I have to convert the cert7.db and key3.db files to a PKCS12 format, and this is where the problem begins... (Note, I do strip out the private key(s) as well but I'm not going to document those steps here)
%/opt/sunone/lib/nss/bin/pk12util -o /home/staff/robreid/ssl-certs/oldsage-alias/oldage.pkcs12.cert2 -n "server-cert" -d /directoryServerPath/alias -P 'slapd-oldsage-'
Notice that I have to refer to the certificate as 'server-cert' rather then
'oldsage.berkeley.edu'. This will cause problems after the next steps, where I convert the PCKS12 file to PEM format...
%/usr/local/openssl/bin/openssl pkcs12 -in /home/staff/robreid/ssl-certs/oldsage-alias/oldage.pkcs12.cert2 -out /home/staff/robreid/ssl-certs/oldsage-alias/oldsage.pem.cert
%ln -s oldsage.pem.cert `/usr/local/openssl/bin/openssl x509 -hash -noout < oldsage.pem.cert`.0
And the problem is that the certificate baggage in the PEM file is named
'server-cert' and not 'oldsage.berkeley.edu', which then causes client to encounter the 'hostname mismatch' error when attempting to verify the certificate as it tries to connect securely to the Directory.
Does anyone know where I'm going wrong and of a better technique to use?
Also, does the Sun Directory Proxy Server also use the same Netscape cert7/key3.db system for it's certificate database/store?
Thanks a bunch for any insights,
Rob Chevalier
University of California, Berkeley

Answer 1

Hi,
The necessary certificates have been sent to me
me in .cer file format.....can someone fill me in on
how to create this database file? I'm currently
working in a Win2K environment, incase that is
relevant.You have several options. The easiest way to create the certificate database if you import the certificate using a Netscape Communicator or Mozilla browser.
Alternatively, you can use certutil from NSS (http://www.mozilla.org/projects/security/pki/nss/tools/certutil.html)
to create an empty database:
certutil -N -d .
(this creates an empty database in the current directory)
Next, you will have to add the certificates to the database:
certutil -A -d . -n <an arbitrary name for your certificate> -t C,, -i <certificate-file>
Check the above referenced manual for the description of these options.
Also, chapter 30 of the Directory Server Resource Kit Reference (http://docs.sun.com/source/816-6400-10/pkcsutil.html) has pointers to various tools that can be useful during development.
I hope this helps.
Bertold