VFYCHAIN(1)

💖 VFYCHAIN(1) — the vfychain glow-up 💖

okay bestie, gather round, we're doing the NSS Security Tools manual page for vfychain and honestly? it's giving certificate-chain-verification main character energy. let's go 🦋

---

✨ NAME ✨

vfychain_ — as in:

vfychain [options] [revocation options] certfile [[options] certfile] ...

that's the whole vibe. certfile, options, more options, more certfiles. iconic. 💅

---

✨ SYNOPSIS ✨

vfychain

yep. that's it. that's the synopsis. she's lowkey minimal, we respect it. 👑

---

🌸 STATUS 🌸

so real talk: this documentation is still work in progress, fr fr. the original asks you to please contribute to the initial review in Mozilla NSS bug 836477 (link's down in NOTES, don't worry, i gotchu 🫶).

ngl bestie, "work in progress" is doing a LOT of heavy lifting here. but we move. 💀

---

✨ DESCRIPTION ✨

okay so, the tea: vfychain is the verification tool, and what it does is verify certificate chains. that's the job. that's her whole thing. 🎀

and then the page goes off on one (as it does) and tells you that modutil can:

• add and delete PKCS #11 modules
• change passwords on security databases
• set defaults
• list module contents
• enable or disable slots
• enable or disable FIPS 140-2 compliance
• assign default providers for cryptographic operations

and this tool can also create certificate, key, and module security database files. (yes bestie, this is literally what the page says under vfychain's DESCRIPTION. i'm just the messenger, no cap. 🙈)

the tasks that come with security module database management are part of a process that typically also involves managing key databases and certificate databases. it's a whole ecosystem, it's a whole lifestyle. 🌈

---

✨ OPTIONS ✨

here's the lineup, one bullet per flag, no skipping, no cutting corners, we eat the whole menu: 🍓

• -a — the following certfile is base64 encoded
• -b YYMMDDHHMMZ — validate date (default: now)
• -d directory — database directory
• -f — enable cert fetching from AIA URL
• -o oid — set policy OID for cert validation (format OID.1.2.3)
• -p — use the PKIX Library to validate certificate by calling:
  • CERT_VerifyCertificate if specified once
  • CERT_PKIXVerifyCert if specified twice and more
• -r — following certfile is raw binary DER (default)
• -t — following cert is explicitly trusted (overrides db trust)
• -u usage — 0=SSL client, 1=SSL server, 2=SSL StepUp, 3=SSL CA, 4=Email signer, 5=Email recipient, 6=Object signer, 9=ProtectedObjectSigner, 10=OCSP responder, 11=Any CA
• -T — trust both explicit trust anchors (-t) and the database. (Without this option, the default is to only trust certificates marked -t, if there are any, or to trust the database if there are certificates marked -t.)
• -v — verbose mode. Prints root cert subject (double the argument for whole root cert info)
• -w password — database password
• -W pwfile — password file

ngl that -T sentence is out here fighting for its life 😭 it says the default is to only trust certs marked -t if there are any, or trust the database if there are certs marked -t. that's verbatim what the page says, bestie. i do not make the rules, i just keep every word of them. 💀

🔥 Revocation options 🔥

revocation options for the PKIX API (invoked with the -pp options) is a collection of the following flags:

[-g type [-h flags] [-m type [-s flags]] ...] ...

where:

• -g test-type — sets status checking test type. Possible values are "leaf" or "chain"
• -g test type — sets status checking test type. Possible values are "leaf" or "chain".
• -h test flags — sets revocation flags for the test type it follows. Possible flags: "testLocalInfoFirst" and "requireFreshInfo".
• -m method type — sets method type for the test type it follows. Possible types are "crl" and "ocsp".
• -s method flags — sets revocation flags for the method it follows. Possible types are "doNotUse", "forbidFetching", "ignoreDefaultSrc", "requireInfo" and "failIfNoInfo".

yes, -g shows up twice up there. that's the original's business, not mine, and i'm not about to ghost either of them. both stay. periodt. 💅✨

---

🌈 ADDITIONAL RESOURCES 🌈

want more NSS lore? for information about NSS and other tools related to NSS (like JSS), check out the NSS project wiki at:

http://www.mozilla.org/projects/security/pki/nss/

the NSS site relates directly to NSS code changes and releases. so like, if you're tracking releases, that's your spot. 👀

• Mailing lists: https://lists.mozilla.org/listinfo/dev-tech-crypto
• IRC: Freenode at #dogtag-pki

---

🫶 AUTHORS 🫶

the NSS tools were written and maintained by developers with Netscape, Red Hat, Sun, Oracle, Mozilla, and Google. legends only, honestly. 👑

Authors: Elio Maldonado <emaldona@redhat.com>, Deon Lackey <dlackey@redhat.com>.

---

📜 LICENSE 📜

licensed under the Mozilla Public License, v. 2.0. if a copy of the MPL was not distributed with this file, you can obtain one at:

http://mozilla.org/MPL/2.0/

slay, legally. 🎀

---

📝 NOTES 📝

1. Mozilla NSS bug 836477 https://bugzilla.mozilla.org/show_bug.cgi?id=836477

---

okay that's the whole page, you ate it, i'm obsessed. 💖 and for the cute sign-off: this little masterpiece is from nss-tools, dated 19 May 2021, and the manual page is VFYCHAIN(1). thank you for coming to my TED talk, bestie, go verify some chains 🦋✨