mozroots - Online in the Cloud

PROGRAM:

NAME

mozroots - Download and import trusted root certificates from Mozilla's LXR into Mono's
certificate store

SYNOPSIS

mozroots [--import [--machine] [--sync | --ask | --ask-add | --ask-remove]]

DESCRIPTION

This program downloads the trusted root certificates from the Mozilla LXR web site into
the Mono certificate store.

Mono by default does not ship with any default certificates and allows the user to pick
its trusted certificates. The mozroots command will bring the Mozilla certificates into
your local machine.

OPTIONS

--import
Import the certificates into the trust store.

--sync Synchronize (add/remove) the trust store with the certificates. Synchronize is
useful for new Mono installations (no roots) and for automated updates (no user
confirmation for addition or removal).

--ask Always confirm before adding or removing trusted certificates. Note: The initial
import will likely add about 100 new trusted root certificates into your store.
You'll have to answer yes to every one of them if this option is specified.

--ask-add
Always confirm before adding a new trusted certificate. Note: The initial import
will likely add about 100 new trusted root certificates into your store. You'll
have to answer yes to every one of them if this option is specified.

--ask-remove
Always confirm before removing an existing trusted certificate.

ADVANCED OPTIONS

--url url
Specify an alternative URL for downloading the trusted certificates (LXR source
format). This should only be useful for testing or if the Mozilla's LXR web site
address is changed. It can also be used to cache a local copy of the LXR file into
your local intranet.

--file name
Do not download from LXR but use the specified file. This is useful if many
computers have to download the same file from the Internet. This way you can keep
a local copy on a file server (and minimize network traffic).

--pkcs7 name
Export the certificates into a PKCS#7 file. This is useful for debugging purpose or
for re-importing the same list into other software.

--machine
Import the certificate in the machine trust store. The default is to import all
trusted root certificates into the current user store.

--quiet
Limit console output to errors and confirmations messages. This is useful when
scripting.

EXAMPLES

After the initial Mono installation you'll have no trusted roots certificates pre-
installed. Neither will you have some root test certificates installed (your own or the
ones provided by using setreg ). In this case the simplest thing to do, if you want to
trust all those certificates, is to import and synchronize.
$ mozroots --import --sync
Mozilla Roots Importer - version 1.1.9.0
Download and import trusted root certificates from Mozilla's LXR.
Copyright 2002, 2003 Motus Technologies. Copyright 2004-2005 Novell. BSD licensed.

Downloading from 'http://lxr.mozilla.org/seamonkey/source/security/nss/lib/ckfw/builtins/certdata.txt'...
Importing certificates into user store...
93 new root certificates were added to your trust store.
Import process completed.

If you created some test certificates (e.g. for using SSL/TLS with XSP) and/or if your
enterprise requires some additional root certificates (e.g. intranet) then you may want to
skip the removal part of the process. You can do this by asking for a removal confirmation
(--ask-remove option) and answer no when prompted.
$ mozroots --import --ask-remove
Mozilla Roots Importer - version 1.1.9.0
Download and import trusted root certificates from Mozilla's LXR.
Copyright 2002, 2003 Motus Technologies. Copyright 2004-2005 Novell. BSD licensed.

Downloading from 'http://lxr.mozilla.org/seamonkey/source/security/nss/lib/ckfw/builtins/certdata.txt'...
Importing certificates into user store...
93 new root certificates were added to your trust store.
2 previously trusted certificates were not part of the update.

Issuer: CN=Mono Test Root Agency
Serial number: 69-B0-E1-4F-88-6E-C7-85-48-0E-74-91-38-76-F4-28
Valid from 9/1/2003 11:55:48 AM to 12/31/2039 1:59:59 PM
Thumbprint SHA-1: EF-26-C2-28-11-3F-79-ED-9D-EC-3F-3B-D5-7A-26-F2-7C-9F-FA-63
Thumbprint MD5: AE-19-3E-64-36-21-F2-A4-8B-69-38-CA-64-4B-2E-62
Are you sure you want to remove this certificate ? no

You can still use the synchronize option (--sync) if you have activated
the default test roots certificate on your system. They will be removed
at the end of the synchronization process but you can quickly add them
back with the
setreg
tool.
$ setreg 1 true

Another option to ease updates is to synchronize your machine trust store (using the
--machine option) and keep your customized (test) certificates in your personal store (or
vice versa). Note that every user on this computer will be trusting all the newly imported
certificates.
$ mozroots --import --machine --sync
Mozilla Roots Importer - version 1.1.9.0
Download and import trusted root certificates from Mozilla's LXR.
Copyright 2002, 2003 Motus Technologies. Copyright 2004-2005 Novell. BSD licensed.

Downloading from 'http://lxr.mozilla.org/seamonkey/source/security/nss/lib/ckfw/builtins/certdata.txt'...
Importing certificates into user store...
94 new root certificates were added to your trust store.
Import process completed.

Once the initial import is complete the number of changes (additions or removals) is
generally very low. In this case it makes sense to know about any changes (i.e. ask for
confirmation). No confirmation will be required if no changes are made to your trust
store.
$ mozroots --import --ask
Mozilla Roots Importer - version 1.1.9.0
Download and import trusted root certificates from Mozilla's LXR.
Copyright 2002, 2003 Motus Technologies. Copyright 2004-2005 Novell. BSD licensed.

Downloading from 'http://lxr.mozilla.org/seamonkey/source/security/nss/lib/ckfw/builtins/certdata.txt'...
Importing certificates into user store...
Import process completed.

Use mozroots online using onworks.net services