Home / server / Questions / 414578
Accepted
Zim3r
Asked: 2012-08-07 00:50:06 +0800 CST

certutil: function failed: security library: bad database

  • 772

when I'm using certutil it returns this error: certutil: function failed: security library: bad database.

e.g. I can't list certs or keys

How Can I fix this?

centos

6 Answers

  1. Best Answer

    If it is new system, your certificate database might not be initialized. To fix this, perform:

    mkdir -p $HOME/.pki/nssdb
certutil -d $HOME/.pki/nssdb -N
    • 32

  2. In case database already has been initialised, but still is corrupted then it has to be rebuild:

    $ mv ~/.pki/nssdb ~/.pki/nssdb.corrupted
$ mkdir ~/.pki/nssdb
$ chmod 700 ~/.pki/nssdb
$ certutil -d sql:$HOME/.pki/nssdb -N

    Check if working alright

    $ certutil -d sql:$HOME/.pki/nssdb -L
Certificate Nickname                                         Trust Attributes
                                                             SSL,S/MIME,JAR/XPI

    Import certificate

    $ certutil -d sql:$HOME/.pki/nssdb -A -t "C,," -n GoAgent -i ~/programs/goagent/local/CA.crt
    • 4

  3. If you want to display certifications from a specific folder (for example, the folder which stores the cert8.db file for Firefox), you need to specify the folder with "-d":

    nss-certutil -d /Users/myuser/Library/Application\ Support/Firefox/Profiles/jii912uh.default -L

    Otherwise, nss-certutil may try to read *.db files from ~/.netscape folder, or maybe $HOME/.pki/nssdb as previous user mentioned.

    • 2

  4. Also check the -d directory path (must point to the directory) have any space or not. With space it gives the same error or bad file format error - old database format etc. Specially in Mac the folder is in "Application Support" which contains space. So have the path fully quoted:

    "/Users/myuser/Library/Application Support/Firefox/Profiles/jii912uh.default"

    or add the \ escape character. 

     /Users/myuser/Library/Application\ Support/Firefox/Profiles/jii912uh.default

    And check that the folder have the following files, cert8.db, key3.db and secmob.db.

    • 1

  5. In my case I solved problem using this solution (Windows XP, nss 3.15.1):

    cd /dir/with/database
C:/full/path/to/certutil.exe -L -d .
    • 0

  6. Quite an old question, but mentioned solutions did not work for me, because the error was caused by incorrect shell expansion.

    In my case, I had to replace ~ with $HOME, e.g.

    certutil -d sql:~/.pki/nssdb -A -t "C,," -n KEY_NAME -i ~/path_to_the_key/key.cert

    became

    certutil -d sql:$HOMR/.pki/nssdb -A -t "C,," -n KEY_NAME -i $HOME/path_to_the_key/key.cert
    • 0