12

I tried to import an ssl cert via the gui (i.e. I double-clicked a .cer file and clicked the "Import" button). I was prompted to unlock the "Gnome2 Key Storage" certificate/key store via one of those Gnome 3 full-screen auth prompts.

I couldn't unlock it. None of the passwords I've used on this machine have worked, so either I've been crafty and set it to some other password that I've now forgotten, or something is broken.

I get the same result from seahorse ("Passwords and Keys"): Certificates -> Gnome2 Key Storage will not unlock with any password I've got. I've tried running seahorse as root using gksu, which didn't work either.

How can I reset the password for this cert store? I'm happy for the contents to be deleted, so if there's a file I need to remove that's fine.

I'm aware of the answer in this question, but that resets the login keyring, not the Gnome2 Key Storage keyring. Maybe I could do the same thing for the Gnome2 Key Storage keyring, but I don't know where it lives on disk.

I'm running Gnome 3.12 on Ubuntu 14.10 (upgraded from 13.10 -> 14.04 -> 14.10).

Improve this question
4
  • Is the keyring in question under an encrypted algorithm?
    – Virusboy
    Feb 20, 2015 at 20:45
  • Do you mean, is that keyring encrypted? I assume yes, seeing as it's asking to be unlocked.
    – Ben Williams
    Feb 22, 2015 at 23:52
  • Is your drive encrypted at all?
    – Virusboy
    Feb 23, 2015 at 3:40
  • No, no drive encryption.
    – Ben Williams
    Feb 23, 2015 at 23:20

3 Answers 3

Reset to default
3

So I'm not entirely sure this is exactly what you want to do but I'm having the same problem so I resorted to CLI:

certutil -d sql:$HOME/.pki/nssdb -A -t "C,," -n <certificate nickname> -i <certificate filename>

Make sure you have libnss3-tools installed

sudo apt-get install libnss3-tools

This worked like a charm for me. It doesn't solve the GUI issue but at least I don't have to verify each one of my company's internal CA-based sites.

For the record, I got the info from here.

Improve this answer
2
  • Handy, thanks for the tip. Upvoted for general usefulness.
    – Ben Williams
    Feb 26, 2015 at 1:18
  • The command silently fails. When I use the -v flag then I get the error certutil: function failed: SEC_ERROR_LEGACY_DATABASE: The certificate/key database is in an old, unsupported format.
    – Elijah Lynn
    Oct 26, 2015 at 20:43
1

I had the same problem when attempting to import certificates for later use with tunderbird.

What solved the issue for me was the following:

  1. Open your account settings on thunderbird,
  2. select Security
  3. under CERTIFICATES click on the button SECURITY DEVICES
  4. In your Internal PKCS Module, select your SOFTWARE SECURITY DEVICE (not sure how that names might change by user/platform etc.)
  5. on the right you will find the option to CHANGE PASSWORD. When you click on it you might see that you haven't set a password yet, so give it a new one.

This can solve the issue for those who simply never set up the password before. In case you actually have set up the password but forgot it, this way won't help you.

Improve this answer
0

This worked for me on ubuntu 16.04 LTS.

rm ~/.local/share/keyrings/user.keystore

Restart
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .