I tried to import an ssl cert via the gui (i.e. I double-clicked a .cer file and clicked the "Import" button). I was prompted to unlock the "Gnome2 Key Storage" certificate/key store via one of those Gnome 3 full-screen auth prompts.

I couldn't unlock it. None of the passwords I've used on this machine have worked, so either I've been crafty and set it to some other password that I've now forgotten, or something is broken.

I get the same result from seahorse ("Passwords and Keys"): Certificates -> Gnome2 Key Storage will not unlock with any password I've got. I've tried running seahorse as root using gksu, which didn't work either.

How can I reset the password for this cert store? I'm happy for the contents to be deleted, so if there's a file I need to remove that's fine.

I'm aware of the answer in this question, but that resets the login keyring, not the Gnome2 Key Storage keyring. Maybe I could do the same thing for the Gnome2 Key Storage keyring, but I don't know where it lives on disk.

I'm running Gnome 3.12 on Ubuntu 14.10 (upgraded from 13.10 -> 14.04 -> 14.10).

  • Is the keyring in question under an encrypted algorithm?
    – Virusboy
    Feb 20 '15 at 20:45
  • Do you mean, is that keyring encrypted? I assume yes, seeing as it's asking to be unlocked. Feb 22 '15 at 23:52
  • Is your drive encrypted at all?
    – Virusboy
    Feb 23 '15 at 3:40
  • No, no drive encryption. Feb 23 '15 at 23:20

So I'm not entirely sure this is exactly what you want to do but I'm having the same problem so I resorted to CLI:

certutil -d sql:$HOME/.pki/nssdb -A -t "C,," -n <certificate nickname> -i <certificate filename>

Make sure you have libnss3-tools installed

sudo apt-get install libnss3-tools

This worked like a charm for me. It doesn't solve the GUI issue but at least I don't have to verify each one of my company's internal CA-based sites.

For the record, I got the info from here.

  • Handy, thanks for the tip. Upvoted for general usefulness. Feb 26 '15 at 1:18
  • The command silently fails. When I use the -v flag then I get the error certutil: function failed: SEC_ERROR_LEGACY_DATABASE: The certificate/key database is in an old, unsupported format. Oct 26 '15 at 20:43

I had the same problem when attempting to import certificates for later use with tunderbird.

What solved the issue for me was the following:

  1. Open your account settings on thunderbird,
  2. select Security
  3. under CERTIFICATES click on the button SECURITY DEVICES
  4. In your Internal PKCS Module, select your SOFTWARE SECURITY DEVICE (not sure how that names might change by user/platform etc.)
  5. on the right you will find the option to CHANGE PASSWORD. When you click on it you might see that you haven't set a password yet, so give it a new one.

This can solve the issue for those who simply never set up the password before. In case you actually have set up the password but forgot it, this way won't help you.


This worked for me on ubuntu 16.04 LTS.

rm ~/.local/share/keyrings/user.keystore


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.