ListingKeys and Certicates
■Tolist the keys and certicates in the congured PKCS#11 tokens, run the following
command:
certutil -L -d AS_NSS_DB [-h tokenname]
Forexample, to list the contents of the default NSS soft token, type:
certutil -L -d AS_NSS_DB
Thestandard output will be similar to the following:
verisignc1g1 T,c,c
verisignc1g2 T,c,c
verisignc1g3 T,c,c
verisignc2g3 T,c,c
verisignsecureserver T,c,c
verisignc2g1 T,c,c
verisignc2g2 T,c,c
verisignc3g1 T,c,c
verisignc3g2 T,c,c
verisignc3g3 T,c,c
s1as u,u,u
Theoutput displays the name of the token in the left column and a set of three trust
attributesin the right column. For Enterprise Server certicates, it is usually T,c,c. Unlike
theJ2SE java.security.KeyStore API, which contains only one level of trust, the NSS
technologycontains several levels of trust. Enterprise Server is primarily interested in the
rsttrust attribute, which describes how this token uses SSL. For this attribute:
Tindicatesthat the Certicate Authority (CA) is trusted for issuing client certicates.
uindicatesthat you can use the certicates (and keys) for authentication or signing.
Theattribute combination of u,u,u indicates that a private key exists in the database.
■Tolist the contents of the hardware token, mytoken, run the following command:
certutil -L -d AS_NSS_DB -h mytoken
Youwill be prompted for the password for the hardware token. The standard output is
similarto the following:
Enter Password or Pin for "mytoken":
mytoken:Server-Cert 	u,u,u
UsingHardwareCrypto Accelerator With Enterprise Server
Chapter9 • Conguring Security 123