failed to execute "certutil -A"

[Yahatix]

This error appears when i do "mkcert -install"

ERROR: failed to execute "certutil -A": exit status 255

certutil: function failed: SEC_ERROR_LEGACY_DATABASE: The certificate/key database is in an old, unsupported format.

[adamdecaf]

What version of Firefox are you on? IIRC it was Firefox 57/58 that switched to the cert9.db format.

Edit: I see mkcert is trying to operate on any cert*.db file found, which I haven't been able to get NSS 3.35+ to support.

[adamdecaf]

@Yahatix Could you try out #13 and see if you still get an error?

Have you tried with this change 1bc392c ?

[Yahatix]

@adamdecaf I just tried with the newest commit and it doesnt work. I am using the latest Firefox beta so 62.0b3

[adamdecaf]

@Yahatix Does the user running mkcert have permissions for that file?

Oddly and confusingly, this error is also what you get if you're trying to query a certificate database in a location you don't have access to and you didn't use sudo.

https://stackoverflow.com/a/39356437

[Yahatix]

if you mean the cert9.db file then yes and the user has access to all the other files in this folder also

[FiloSottile]

I added some debug output, if you could rerun the latest build and report its output it would be helpful. @Cui-Y @Yahatix

[Yahatix]

OK so the debug output says:

Using the local CA at "/Users/myUsername/Library/Application Support/mkcert" ✨
!!! You've hit a known issue. Please report the entire command output at https://github.com/FiloSottile/mkcert/issues/12
Profile path: dbm:/Users/myUsername/Library/Application Support/Firefox/Profiles/.DS_Store
OS: darwin/amd64
certutil: /usr/local/opt/nss/bin/certutil
-rw-r--r--@ 1 myUsername  staff  6148  4 Jul 05:14 /Users/myUsername/Library/Application Support/Firefox/Profiles/.DS_Store
ERROR: failed to execute "certutil -A": exit status 255

certutil: function failed: SEC_ERROR_LEGACY_DATABASE: The certificate/key database is in an old, unsupported format.

I think this happened when i opened the Folder in the Finder.
Upon deleting the .DS_Store file it now is working as it should.

[ansemjo]

I have also hit this issue just now:

$ uname -srvmo
Linux 4.17.3-1-ARCH #1 SMP PREEMPT Tue Jun 26 04:42:36 UTC 2018 x86_64 GNU/Linux
$ firefox --version
Mozilla Firefox 61.0
$ mkcert -install
Created a new local CA at "/home/ansemjo/.local/share/mkcert" 💥
Installing to the system store is not yet supported on this Linux 😣 but Firefox and/or Chrome/Chromium will still work.
You can also manually install the root certificate at "/home/ansemjo/.local/share/mkcert/rootCA.pem".
!!! You've hit a known issue. Please report the entire command output at https://github.com/FiloSottile/mkcert/issues/12
Profile path: dbm:/home/ansemjo/.mozilla/firefox/profiles.ini
OS: linux/amd64
certutil: /usr/bin/certutil
-rw-r--r-- 1 ansemjo users 172 Jun 28 16:51 /home/ansemjo/.mozilla/firefox/profiles.ini
ERROR: failed to execute "certutil -A": exit status 255

certutil: function failed: SEC_ERROR_LEGACY_DATABASE: The certificate/key database is in an old, unsupported format.

$ ls -l .mozilla/firefox/profiles.ini 
-rw-r--r-- 1 ansemjo users 172 Jun 28 16:51 .mozilla/firefox/profiles.ini

However, when adding the certificate manually through Firefox' certitifcate manager it says the certificate authority is already installed .. during certificate installation mkcert still warns that it is not installed in the trust store. (I have verified that it is.)

$ mkcert example.org
Using the local CA at "/home/ansemjo/.local/share/mkcert" ✨
Warning: the local CA is not installed in the system trust store! ⚠️
Warning: the local CA is not installed in the Firefox and/or Chrome/Chromium trust store! ⚠️
Run "mkcert -install" to avoid verification errors ‼️

Created a new certificate valid for the following names 📜
 - "example.org"

The certificate is at "./example.org.pem" and the key at "./example.org-key.pem" ✅