All geek questions in one place

Access to Mozilla Certificates from Delphi

I would like to access the certificates stored in Mozilla products (Firefox and Thunderbird) from the Delphi (XE) application. To begin with, I would like to list them, the next time it would be nice to manage them (import, export, delete) and use them (sign). A software token would be sufficient, although using all the tokens supported by mozilla would be great.

So far, I have been trying to use XPCOM with the http://d-gecko.svn.sourceforge.net/viewvc/d-gecko/trunk/ delphi binding. However, there is little documentation around, and I am confused by all the terminology and concepts. The best I could do was:

var ns:nsIX509CertDB; servMgr:nsIServiceManager; p:Pchar; begin GRE_Startup; NS_GetServiceManager(servmgr); servMgr.GetServiceByContractID('@mozilla.org/security/x509certdb;1',NS_IX509CERTDB_IID,ns); ns.FindCertNicknames(nil,1,count,p); GRE_Shutdown; end;

Using this code, I got an instance of the certdb object, and I was able to request it for certificates. However, it seems completely empty (the count from FindCertNicknames is 0), and it also does not respond to an OCSP change (IsOcspOn always returns true). I think I either created a new certstore, or I need to somehow activate the default user profile.

I also tried to access softokn.dll as a PKCS # 11 library. Since this seems to have some PKCS # 11 API, it does not respond well. That is, CKR_BAD_ARGUMENTS in C_Inititialize.

The last and very bad way is to access the certificate files directly, since it should be the "standard" NSS, but I don't like it.

+6
source share
2 answers

I studied PKCS # 11 a little more, and I really got it to do something. The softokn.dll library is an "almost" standard PKCS # 11 library, see https://developer.mozilla.org/en/PKCS11_Module_Specs . The main thing is that you need to initialize it with special arguments (the structure is described in the associated URL).

It is also useful to check the return values ​​of NOR erorr: see CKR_NETSCAPE _... at http://people.mozilla.com/~chofmann/l10n/tree/mozilla/security/nss/cmd/pk11mode/pk11mode.c .

The last key thing is that you need to specify tokens manually, since the documentation is unclear in using secmod.db - in the word "Invalid word", it may be "supported", "MOD DB function is not through standard PKCS # 11".

This is all pretty low-level coding and still needs to work a lot, so it's best to use SecureBalackbox, as suggested by Eugene, if you are starting from scratch.

0
source

Our SecureBlackbox works with softtokn.dll through PKCS # 11, and you can use the interfaces provided by SecureBlackbox for convenient certificate management.

+1
source

Source: https://habr.com/ru/post/901835/

More articles:


All Articles