<?xml version="1.0" encoding="utf-8"?>

<!-- Copyright (c) 2007-2010 Nokia Corporation and/or its subsidiary(-ies) All rights reserved. -->

<!-- This component and the accompanying materials are made available under the terms of the License 

"Eclipse Public License v1.0" which accompanies this distribution, 

and is available at the URL "http://www.eclipse.org/legal/epl-v10.html". -->

<!-- Initial Contributors:

    Nokia Corporation - initial contribution.

Contributors: 

-->

<!DOCTYPE concept

  PUBLIC "-//OASIS//DTD DITA Concept//EN" "concept.dtd">

<concept id="GUID-DD7D5D55-A2F1-54FB-AA38-B4A7C920B6A6-GENID-1-12-1-26-1-1-10-1-6-1-4-1-4-1-7-1" xml:lang="en"><title>Manipulating

Applicability and Trust Settings for a Certificate</title><prolog><metadata><keywords/></metadata></prolog><conbody>

<p>A certificate can be trusted for a certain task or application. Currently,

the following applications are defined: </p>

<ul>

<li id="GUID-7AA1F386-C411-5C87-B234-9FEC74ADE9A0"><p>Software installation

(SWInstall) </p> </li>

<li id="GUID-7C7932B0-CF2F-5A07-9873-FC24BDAFBA29"><p>Signature verification

of OCSP response (SWInstallOCSP) </p> </li>

<li id="GUID-24224A47-76A0-578E-8FCD-7658640B568A"><p>TLS/SSL authentication

(TLS/SSL) </p> </li>

</ul>

<p>The SWInstall application allows us to use a given certificate to verify

the signature of the signed sis files you want to install. A certificate with

SWInstallOCSP applicability can be used to verify the signature of OCSP responses. </p>

<p>Certificate can be used to perform TLS and SSL authentication. Certificates

are trusted to do that with the TLS/SSL application. </p>

<p> <codeph>certtool</codeph> offers three commands to manipulate the applications

of a given certificate: setapps, addapps and removeapps. </p>

<p>For this to work, <filepath>certclients.dat</filepath> should exist in <filepath>c:\private\101f72a6\</filepath> with

the required application. </p>

<p><b>The setapps command </b> </p>

<p>The setapps command can be used to set the applications a specific certificate

can be used for. For instance, update the applications of the CertCA certificate.

Initially it is trusted for SWInstall: </p>

<p><userinput>certtool –list CertCA</userinput> </p>

<codeblock id="GUID-A38ABE67-FDCD-547B-A3C7-0949FDC5D950" xml:space="preserve">Symbian CertStore Manipulation Tool

Copyright (c) 2004-2009 Nokia Corporation and/or its subsidiary(-ies).  All rights reserved.

Label: TCA            Format: X509     Owner Type: Root (CA)

Issuer Name: CertCA        Subject Name: CertCA

Valid From: 16:36:00 Tue 12th May 2009 Valid Until: 16:36:00 Tue 11th May 2010

Trusted for Applications: SWInstall</codeblock>

<p>Change the applications using the setapps command. Set the applications

to SSL/TLS: </p>

<p><userinput>certtool –setapps –apps SSL/TLS TestCA</userinput> </p>

<codeblock id="GUID-3B74BA88-9944-599A-AE9C-B8EEF7D57070" xml:space="preserve">Symbian CertStore Manipulation Tool

Copyright (c) 2004-2009 Nokia Corporation and/or its subsidiary(-ies).  All rights reserved.

Certificate applications set successfully

Label: TestCA            Format: X509     Owner Type: Root (CA)

Issuer Name: CertCA        Subject Name: CertCA

Valid From: 16:36:00 Tue 12th May 2009 Valid Until: 16:36:00 Tue 11th May 2010

Trusted for Applications: SSL/TLS</codeblock>

<p>The TestCA certificate is now trusted for server authentication with SSL

and TLS. If the specified applications are not recognized, an error will occur: </p>

<codeblock id="GUID-10F4F705-5B67-58C4-9C0A-964DF78C77A1" xml:space="preserve">Symbian CertStore Manipulation Tool

Copyright (c) 2004-2009 Nokia Corporation and/or its subsidiary(-ies).  All rights reserved.

No valid applications specified, try one of: 

[SWInstall, SWInstallOCSP, SSL/TLS]</codeblock>

<p>Remember that applications are case sensitive. </p>

<p>You can also set the applications using UIDs, for example: </p>

<p><userinput>certtool –setapps –uids 0x100042AB abc</userinput> </p>

<p><b>The addapps command </b> </p>

<p>If you want to add again SWInstall to the applications TestCA is trusted

for, you can use the setapps command to accomplish our goal. But you would

need to specify all the applications, for example: </p>

<p><userinput>certtool –setapps –apps SSL/TLS SWInstall TestCA</userinput> </p>

<p>The addapps command gives a shortcut. It enables you to specify an application

which will be added to the existing ones: </p>

<p><userinput>certtool –addapps –apps SWInstall TestCA</userinput> </p>

<p>You can also add the applications using UIDs, for example: </p>

<p><userinput>certtool –addapps -uids 0x101F9B28 abc</userinput> </p>

<p><b>The removeapps command </b> </p>

<p>The removeapps command is essentially dual to addapps. It helps to remove

apps from those a certificate is trusted for. </p>

<p><userinput>certtool –removeapps –apps SWInstall TestCA</userinput> </p>

<p>You can also remove the applications using UIDs, for example: </p>

<p><userinput>certtool -removeapps –apps 0x101F9B28 abc </userinput> </p>

<p>Remember that applications and labels are case sensitive. </p>

</conbody><related-links>

<link href="GUID-F6C20181-0F03-5B8A-B548-C81FF8824503.dita"><linktext>Working with

Multiple Certificate Store Implementations</linktext></link>

<link href="GUID-88EC0D74-5595-5FA8-B7BA-B914CC8022FB.dita"><linktext>Listing Contents

of Certificate Stores</linktext></link>

<link href="GUID-6CDB86E4-89BB-5266-8CEC-7353B664D638.dita"><linktext>Importing

Certificates</linktext></link>

<link href="GUID-DCC2060B-BFEC-5ECF-8154-5AE9C8513F75.dita"><linktext>Removing

Certificates</linktext></link>

</related-links></concept>