Removing one of two certificates with equal nicknames

Question

I have two certificates installed:

kirrun@kirNote ~ [1197]% certutil -d sql:/home/kirrun/.pki/nssdb -L

Certificate Nickname                                         Trust Attributes
                                                             SSL,S/MIME,JAR/XPI

CAcert WoT User's CA Cert Signing Authority ID               u,u,u
CAcert WoT User's CA Cert Signing Authority ID               u,u,u

As you can see both certificates have the same nickname, but they obviously have different serial numbers. So, I want to remove one of them. It seems to me that certutil can only remove certificates by nickname.

The question is: how do I remove exactly one of those two certificates (and not a random one but the one I want to remove)?

Ram · Answer 1 · 2014-02-11T23:43:15.550

0

Easiest way? Remove both and reinstall the one you want?

https://developer.mozilla.org/en-US/docs/NSS_reference/NSS_tools_:_certutil

edited Feb 11 '14 at 23:43

answered Feb 11 '14 at 20:22

Ram

1,087
1
7
24

A bit more detail might make this a better answer – Dave M Feb 11 '14 at 20:38
What if I don't have them elsewhere? And I can't export just one of them using `pk12util` because… well… same issue =). – kirelagin Feb 14 '14 at 09:03
Duplicate the DB. Export one from the DB, delete one from the DB [these will most likely be the same one], export one from the DB, delete one from the DB. Compare the two and add back the one you want. For further help please answer two questions: 1) Where did you get them from in the first place? 2) Why do you think you need to delete one of them? - ram – Ram Feb 14 '14 at 18:49

score 0 · Answer 2 · answered Feb 14 '14 at 09:13

So, I finally managed to do this using Chromium's GUI (it's in Settings > Show advanced settings > HTTPS/SSL > Manage certificates).

This works if using a GUI is an option for you and if the database in question is sql:~/.pki/nssdb. If it's elsewhere you'll probably have to move directories around. If it's not sql, then using Firefox's GUI might be an option, but note that it stores its cert db in ~/.mozilla/firefox/<profile> (moving files around again) and, unfortunatelly, it's not working for me: when I click “delete” the record disappears from the list but, actually, nothing changes in the db.

I'm still looking for a distro-agnostic way to do this from the console.

Removing one of two certificates with equal nicknames

2 Answers2