certutil: function failed: SEC_ERROR_LEGACY_DATABASE: The certificate/key database is in an old, unsupported format

certificate smime nss certificate-store certutil
stelios picture stelios · Dec 27, 2014 · Viewed 47.9k times · Source

I had downloaded a verified (not self-signed) S/MIME certificate with iceweasel (firefox) which was stored in cert8.db

Then I used:

certutil -L -d <path_to_folder_that_cert8.db_resides>

in order to list the certificates, and then I extracted the .p12 file using the name of my certificate that certutil gave me:

pk12util -o mycertfile.p12 -n "<name_found_from_certutil>" -d <path_to_folder_that_cert8.db_resides>

The problem is that I lost the access to the PC that the p12 was stored and now I have only a cert8.db copy to another PC. Thus I repeated the certutil && pk12util commands, but certutil fails with:

certutil: function failed: SEC_ERROR_LEGACY_DATABASE: The certificate/key database is in an old, unsupported format.

I have desperately tried at 3 different computers, including one with identical kernel and libnss3-tools version, (like the initial desktop where I extracted the p12 successfully) which is:

$ uname -a 
Linux commander 3.16.0-4-amd64 #1 SMP Debian 3.16.7-2 (2014-11-06) x86_64 GNU/Linux

libnss3-tools version: 2:3.17.2-1

Any thoughts?

Thanks

Answer

rjt picture rjt · May 23, 2016

The database has migrated over the years from flat files to Berkeley DB to now SQLite in 3.12. Prefix the directory name with sql and enclose in quotes to get around spaces: 

certutil -L -d sql:${HOME}/.pki/nssdb

For reference, here's the Mozilla NSS roadmap.

Related questions

How to create a self-signed certificate with OpenSSL

I'm adding HTTPS support to an embedded Linux device. I have tried to generate a self-signed certificate with these steps: openssl req -new > cert.csr openssl rsa -in privkey.pem -out key.pem openssl x509 -in cert.csr -out …

Read More
Getting Chrome to accept self-signed localhost certificate

I have created a self-signed SSL certificate for the localhost CN. Firefox accepts this certificate after initially complaining about it, as expected. Chrome and IE, however, refuse to accept it, even after adding the certificate to the system certificate store …

Read More
How to import a .cer certificate into a java keystore?

During the development of a Java webservice client I ran into a problem. Authentication for the webservice is using a client certificate, a username and a password. The client certificate I received from the company behind the webservice is in .…

Read More