Parameters:

• algtag (int) - algorithm tag (e.g. SEC_OID_*)

Returns: mechanism

Convert the base64 encoded data to binary data.

The text is assumed to contain base64 text. The base64 text may optionally be wrapped in a PEM header and footer.

Returns a SecItem containg the binary data.

Note, a SecItem can be initialized directly from base64 text by utilizing the ascii parameter to the SecItem constructor, thus the two are equivalent:

sec_item = nss.base64_to_binary(text) sec_tiem = nss.SecItem(text, ascii=True)

Parameters:

• text (string) - string containing base64 data.

Returns: SecItem

Parameters:

• name (string) - name of CERTCRLEntryReasonCode constant

Returns: int

Parameters:

• reason (int) - CERTCRLEntryReasonCode constant

Returns: string

Parameters:

• name (string) - name of CERTGeneralNameType constant

Returns: int

Parameters:

• type (int) - CERTGeneralNameType constant

Returns: string

Parameters:

• flags (int) - KU_* bit flags

• repr_kind (RepresentationKind constant) - Specifies what the contents of the returned list will be. May be one of:

  AsEnum

  The enumerated constant as an integer value.

  AsEnumName

  The name of the enumerated constant as a string.

  AsEnumDescription

  A friendly human readable description of the enumerated constant as a string.

Returns: ['flag_name', ...]

Parameters:

• flags (int) - certificateUsage* bit flags

• repr_kind (RepresentationKind constant) - Specifies what the contents of the returned list will be. May be one of:

  AsEnum

  The enumerated constant as an integer value.

  AsEnumName

  The name of the enumerated constant as a string.

  AsEnumDescription

  A friendly human readable description of the enumerated constant as a string.

Returns: ['flag_name', ...]

Parameters:

• mechanism (int) - key mechanism enumeration constant (CKM_*)
• operation (int) - type of operation this context will be doing. A (CKA_*) constant (e.g. CKA_ENCRYPT, CKA_DECRYPT, CKA_SIGN, CKA_VERIFY, CKA_DIGEST)
• sym_key (PK11SymKey object) - symmetric key
• sec_param (SecItem object or None) - mechanism parameters used to build this context or None.

Returns: PK11Context

Parameters:

• hash_alg (int) - hash algorithm enumeration (SEC_OID_*) e.g.: SEC_OID_MD5, SEC_OID_SHA1, SEC_OID_SHA256, SEC_OID_SHA512, etc.

Returns: PK11Context

The default values are appropriate for most users desiring a PKCS5v2 PBE symmetric key.

The pbe, cipher and prf algorithms may be specified in any of the following manners:

• integer:: A SEC OID enumeration constant, also known as a tag (i.e. SEC_OID_*) for example SEC_OID_PKCS5_PBKDF2.

• string:: A string for the tag name (e.g. 'SEC_OID_PKCS5_PBKDF2') The 'SEC_OID_' prefix is optional. A string in dotted decimal representation, for example 'OID.1.2.840.113549.1.5.12'. The 'OID.' prefix is optional. Case is not significant.

• SecItem:: A SecItem object encapsulating the OID in

  DER format.

Parameters:

• pbe_alg (may be one of integer, string or SecItem (see below)) - password based encryption algorithm
• cipher_alg (may be one of integer, string or SecItem (see below)) - cipher algorithm
• prf_alg (may be one of integer, string or SecItem (see below)) - pseudo-random function algorithm
• key_length (int) - Number of octets in derived key DK. Must be a valid value for the cipher_alg. If zero then NSS will select the longest key length appropriate for the cipher
• iterations (int) - Number of times the pseudo-random function is applied to generate the symmetric key.
• salt (SecItem or str or any buffer compatible object or None) - Cyrptographic salt. If None a random salt will be generated.

Returns: AlgorithmID

Format the binary data as hex string(s). Either a list of strings is returned or a single string.

If octets_per_line is greater than zero then a list of strings will be returned where each string contains octets_per_line number of octets (except for the last string in the list which will contain the remainder of the octets). Returning a list of "lines" makes it convenient for a caller to format a block of hexadecimal data with line wrapping. If octets_per_line is greater than zero indicating a list result is desired a list is always returned even if the number of octets would produce only a single line.

If octets_per_line is zero then a single string is returned, (no line splitting is performed). This is the default.

The separator string is used to separate each octet. If None it will be as if the empty string had been passed and no separator will be used.

Parameters:

• data (buffer) - Binary data
• octets_per_line (integer) - Number of octets formatted on one line, if 0 then return a single string instead of an array of lines
• separator (string) - String used to seperate each octet If None it will be as if the empty string had been passed and no separator will be used.

Returns: string or list of strings

Parameters:

• der_crl (SecItem object) - DER encoded CRL data encapsulated in a SECItem.

• type (int) - revocation list type

  may be one of:

  • SEC_CRL_TYPE
  • SEC_KRL_TYPE

• decode_options (int) -

  bit-wise OR of the following flags:

  • CRL_DECODE_DONT_COPY_DER
  • CRL_DECODE_SKIP_ENTRIES
  • CRL_DECODE_KEEP_BAD_CRL
  • CRL_DECODE_ADOPT_HEAP_DER

  or use CRL_DECODE_DEFAULT_OPTIONS

Returns: SignedCRL

Parameters:

• sec_item (SecItem object) - A SecItem containing a DER encoded ASN1 universal type
• level (integer) - Initial indentation level, all subsequent indents are relative to this starting level.
• octets_per_line (integer) - Number of octets formatted on one line, if 0 then return a single string instead of an array of lines
• separator (string) - String used to seperate each octet If None it will be as if the empty string had been passed and no separator will be used.

Returns: list of (indent, string) tuples

Parameters:

• certdb (CertDB object or None) - CertDB certificate database object, if None then the default certdb will be supplied by calling nss.get\_default\_certdb().

Parameters:

• certdb (CertDB object or None) - CertDB certificate database object, if None then the default certdb will be supplied by calling nss.get\_default\_certdb().

Dump the contents of the certificate cache and the temporary cert store to stdout.

Use this as a debugging aid to detect leaked references of certs at shutdown time. For example if nss.nss\_shutdown() throws a SEC_ERROR_BUSY exception.

Parameters:

• certdb (CertDB object or None) - CertDB certificate database object, if None then the default certdb will be supplied by calling nss.get\_default\_certdb().

Parameters:

• certdb (CertDB object or None) - CertDB certificate database object, if None then the default certdb will be supplied by calling nss.get\_default\_certdb().

find_cert_from_nickname(nickname, [user_data1, ...]) -> Certificate

A nickname is an alias for a certificate subject. There may be multiple certificates with the same subject, and hence the same nickname. This function will return the newest certificate that matches the subject, based on the NotBefore / NotAfter fields of the certificate.

Parameters:

• nickname (string) - certificate nickname to search for
• user_dataN (object ...) - zero or more caller supplied parameters which will be passed to the password callback function

find_certs_from_email_addr(email, [user_data1, ...]) -> (Certificate, ...)

Given an email address return a tuple of Certificate objects containing that address.

Parameters:

• email (string) - email address.
• user_dataN (object ...) - zero or more caller supplied parameters which will be passed to the password callback function

find_certs_from_nickname(email, [user_data1, ...]) -> (Certificate, ...)

Given a certificate nickname return a tuple of Certificate objects matching that nickname.

Parameters:

• nickname (string) - certificate nickname.
• user_dataN (object ...) - zero or more caller supplied parameters which will be passed to the password callback function

find_key_by_any_cert(cert, [user_data1, ...]) -> Certificate

Finds the private key associated with a specified certificate in any available slot.

Parameters:

• cert (Certificate object) - certificate whose private key is being searched for
• user_dataN (object ...) - zero or more caller supplied parameters which will be passed to the password callback function

Parameters:

• name (string) - slot name

Returns: PK11Slot

data : SecItem or str or any buffer compatible object

Data to initialize the certificate request from, must be in DER format

level : integer

Initial indentation level, all subsequent indents are relative to this starting level.

Generates digests of data (i.e. fingerprint) and formats it into line tuples for text output.

Returns:

Parameters:

Parameters:

• mechanism (int) - key mechanism enumeration constant (CKM_*)
• sym_key (PK11SymKey object or None) - symmetric key or None

Returns: SecItem

Parameters:

• num_bytes (integer) - Number of num_bytes to generate (must be non-negative)

Returns: string

Return a tuple of PK11Slot objects.

Example:

import nss.nss as nss
nss.nss_init_nodb()

slots = nss.get_all_tokens()
for slot in slots:
    print slot
    print

Slot Name:                         NSS User Private Key and Certificate Services
Token Name:                        NSS Certificate DB
Is Hardware:                       False
Is Present:                        True
Is Read Only:                      True
Is Internal:                       True
Needs Login:                       False
Needs User Init:                   True
Is Friendly:                       True
Is Removable:                      False
Has Protected Authentication Path: False
Is Disabled:                       False (no reason)
Has Root Certs:                    False
Best Wrap Mechanism:               CKM_DES3_ECB (0x132)

Slot Name:                         NSS Internal Cryptographic Services
Token Name:                        NSS Generic Crypto Services
Is Hardware:                       False
Is Present:                        True
Is Read Only:                      True
Is Internal:                       True
Needs Login:                       False
Needs User Init:                   True
Is Friendly:                       True
Is Removable:                      False
Has Protected Authentication Path: False
Is Disabled:                       False (no reason)
Has Root Certs:                    False
Best Wrap Mechanism:               CKM_DES3_ECB (0x132)

Parameters:

• mechanism (int) - key mechanism enumeration constant (CKM_*). Use CKM_INVALID_MECHANISM to get all tokens.
• need_rw (boolean) - need read/write
• load_certs (boolean) - load certificates
• pin_args (tuple) - Extra parameters which will be passed to the password callback function.

Returns: (PK11Slot, ...)

get_best_slot(mechanism, [user_data1, ...]) -> PK11Slot

Find the best slot which supports the given mechanism.

Parameters:

• mechanism (int) - key mechanism enumeration constant (CKM_*)
• user_dataN (object ...) - zero or more caller supplied parameters which will be passed to the password callback function