1 <?xml version="1.0" encoding="utf-8"?>

     2 <!-- Copyright (c) 2007-2010 Nokia Corporation and/or its subsidiary(-ies) All rights reserved. -->

     3 <!-- This component and the accompanying materials are made available under the terms of the License 

     4 "Eclipse Public License v1.0" which accompanies this distribution, 

     5 and is available at the URL "http://www.eclipse.org/legal/epl-v10.html". -->

     6 <!-- Initial Contributors:

     7     Nokia Corporation - initial contribution.

     8 Contributors: 

     9 -->

    10 <!DOCTYPE concept

    11   PUBLIC "-//OASIS//DTD DITA Concept//EN" "concept.dtd">

    12 <concept id="GUID-DD7D5D55-A2F1-54FB-AA38-B4A7C920B6A6-GENID-1-12-1-26-1-1-10-1-6-1-4-1-4-1-7-1" xml:lang="en"><title>Manipulating

    13 Applicability and Trust Settings for a Certificate</title><prolog><metadata><keywords/></metadata></prolog><conbody>

    14 <p>A certificate can be trusted for a certain task or application. Currently,

    15 the following applications are defined: </p>

    16 <ul>

    17 <li id="GUID-7AA1F386-C411-5C87-B234-9FEC74ADE9A0"><p>Software installation

    18 (SWInstall) </p> </li>

    19 <li id="GUID-7C7932B0-CF2F-5A07-9873-FC24BDAFBA29"><p>Signature verification

    20 of OCSP response (SWInstallOCSP) </p> </li>

    21 <li id="GUID-24224A47-76A0-578E-8FCD-7658640B568A"><p>TLS/SSL authentication

    22 (TLS/SSL) </p> </li>

    23 </ul>

    24 <p>The SWInstall application allows us to use a given certificate to verify

    25 the signature of the signed sis files you want to install. A certificate with

    26 SWInstallOCSP applicability can be used to verify the signature of OCSP responses. </p>

    27 <p>Certificate can be used to perform TLS and SSL authentication. Certificates

    28 are trusted to do that with the TLS/SSL application. </p>

    29 <p> <codeph>certtool</codeph> offers three commands to manipulate the applications

    30 of a given certificate: setapps, addapps and removeapps. </p>

    31 <p>For this to work, <filepath>certclients.dat</filepath> should exist in <filepath>c:\private\101f72a6\</filepath> with

    32 the required application. </p>

    33 <p><b>The setapps command </b> </p>

    34 <p>The setapps command can be used to set the applications a specific certificate

    35 can be used for. For instance, update the applications of the CertCA certificate.

    36 Initially it is trusted for SWInstall: </p>

    37 <p><userinput>certtool –list CertCA</userinput> </p>

    38 <codeblock id="GUID-A38ABE67-FDCD-547B-A3C7-0949FDC5D950" xml:space="preserve">Symbian CertStore Manipulation Tool

    39 Copyright (c) 2004-2009 Nokia Corporation and/or its subsidiary(-ies).  All rights reserved.

    40 Label: TCA            Format: X509     Owner Type: Root (CA)

    41 Issuer Name: CertCA        Subject Name: CertCA

    42 Valid From: 16:36:00 Tue 12th May 2009 Valid Until: 16:36:00 Tue 11th May 2010

    43 Trusted for Applications: SWInstall</codeblock>

    44 <p>Change the applications using the setapps command. Set the applications

    45 to SSL/TLS: </p>

    46 <p><userinput>certtool –setapps –apps SSL/TLS TestCA</userinput> </p>

    47 <codeblock id="GUID-3B74BA88-9944-599A-AE9C-B8EEF7D57070" xml:space="preserve">Symbian CertStore Manipulation Tool

    48 Copyright (c) 2004-2009 Nokia Corporation and/or its subsidiary(-ies).  All rights reserved.

    49 Certificate applications set successfully

    50 Label: TestCA            Format: X509     Owner Type: Root (CA)

    51 Issuer Name: CertCA        Subject Name: CertCA

    52 Valid From: 16:36:00 Tue 12th May 2009 Valid Until: 16:36:00 Tue 11th May 2010

    53 Trusted for Applications: SSL/TLS</codeblock>

    54 <p>The TestCA certificate is now trusted for server authentication with SSL

    55 and TLS. If the specified applications are not recognized, an error will occur: </p>

    56 <codeblock id="GUID-10F4F705-5B67-58C4-9C0A-964DF78C77A1" xml:space="preserve">Symbian CertStore Manipulation Tool

    57 Copyright (c) 2004-2009 Nokia Corporation and/or its subsidiary(-ies).  All rights reserved.

    58 No valid applications specified, try one of: 

    59 [SWInstall, SWInstallOCSP, SSL/TLS]</codeblock>

    60 <p>Remember that applications are case sensitive. </p>

    61 <p>You can also set the applications using UIDs, for example: </p>

    62 <p><userinput>certtool –setapps –uids 0x100042AB abc</userinput> </p>

    63 <p><b>The addapps command </b> </p>

    64 <p>If you want to add again SWInstall to the applications TestCA is trusted

    65 for, you can use the setapps command to accomplish our goal. But you would

    66 need to specify all the applications, for example: </p>

    67 <p><userinput>certtool –setapps –apps SSL/TLS SWInstall TestCA</userinput> </p>

    68 <p>The addapps command gives a shortcut. It enables you to specify an application

    69 which will be added to the existing ones: </p>

    70 <p><userinput>certtool –addapps –apps SWInstall TestCA</userinput> </p>

    71 <p>You can also add the applications using UIDs, for example: </p>

    72 <p><userinput>certtool –addapps -uids 0x101F9B28 abc</userinput> </p>

    73 <p><b>The removeapps command </b> </p>

    74 <p>The removeapps command is essentially dual to addapps. It helps to remove

    75 apps from those a certificate is trusted for. </p>

    76 <p><userinput>certtool –removeapps –apps SWInstall TestCA</userinput> </p>

    77 <p>You can also remove the applications using UIDs, for example: </p>

    78 <p><userinput>certtool -removeapps –apps 0x101F9B28 abc </userinput> </p>

    79 <p>Remember that applications and labels are case sensitive. </p>

    80 </conbody><related-links>

    81 <link href="GUID-F6C20181-0F03-5B8A-B548-C81FF8824503.dita"><linktext>Working with

    82 Multiple Certificate Store Implementations</linktext></link>

    83 <link href="GUID-88EC0D74-5595-5FA8-B7BA-B914CC8022FB.dita"><linktext>Listing Contents

    84 of Certificate Stores</linktext></link>

    85 <link href="GUID-6CDB86E4-89BB-5266-8CEC-7353B664D638.dita"><linktext>Importing

    86 Certificates</linktext></link>

    87 <link href="GUID-DCC2060B-BFEC-5ECF-8154-5AE9C8513F75.dita"><linktext>Removing

    88 Certificates</linktext></link>

    89 </related-links></concept>