"NSS Certificate DB" password fails to get verified

[GHNewbiee]

Hi, after typing

$ mkcert -install
The local CA is already installed in the system trust store! 👍
Enter Password or Pin for "NSS Certificate DB":

entering my password, pressing 'enter' I get again and again

Enter Password or Pin for "NSS Certificate DB":
Enter Password or Pin for "NSS Certificate DB":
Enter Password or Pin for "NSS Certificate DB":

Notes: My password

• is accepted as Primary Password,
• does contain special characters in various positions including begin and end, and
• is accepted when I type certutil -N -d ~/.pki/nssdb

I wonder if mkcert -install passes the password in correct manner to certutil, especially those special characters positioned at the edges or accidentally omits some.

Tia

[GHNewbiee]

In addition, when I enter a wrong password I continue taking Enter Password or Pin for "NSS Certificate DB": instead of a kind of error, as reasonably expected.

[gyst]

Confirmed here. mkcert -install takes neither the correct FF master password, nor an empty string:

❯❯ mkcert -install
The local CA is already installed in the system trust store! 👍
Enter Password or Pin for "NSS Certificate DB":
Enter Password or Pin for "NSS Certificate DB":
Enter Password or Pin for "NSS Certificate DB":
Enter Password or Pin for "NSS Certificate DB":
Enter Password or Pin for "NSS Certificate DB":
Enter Password or Pin for "NSS Certificate DB":
Enter Password or Pin for "NSS Certificate DB":
Enter Password or Pin for "NSS Certificate DB":
Enter Password or Pin for "NSS Certificate DB":

certutil -N -d ~/.pki/nssdb is more helpful:

• it gives an error that it doesn't accept the password
• when entering no password, it prompts to set up one

✗   certutil -N -d ~/.pki/nssdb
Enter Password or Pin for "NSS Certificate DB":
Invalid password.  Try again.
Enter Password or Pin for "NSS Certificate DB":
Invalid password.  Try again.
Enter Password or Pin for "NSS Certificate DB":
Invalid password.  Try again.
Enter Password or Pin for "NSS Certificate DB":
Enter a password which will be used to encrypt your keys.
The password should be at least 8 characters long,
and should contain at least one non-alphabetic character.

Enter new password: 
Re-enter password: 
Password changed successfully.

Not that even after all this, mkcert -install still does not work.

❯❯ mkcert -install
The local CA is already installed in the system trust store! 👍
Enter Password or Pin for "NSS Certificate DB":
Enter Password or Pin for "NSS Certificate DB":
Enter Password or Pin for "NSS Certificate DB":

gyst@saiph ~ 
✗  mkcert bla.cosent.net
Note: the local CA is not installed in the Firefox and/or Chrome/Chromium trust store.
Run "mkcert -install" for certificates to be trusted automatically ⚠️

I used curl -JLO "https://dl.filippo.io/mkcert/latest?for=linux/amd64" as of today.

[gyst]

Damn and now my FF password store is nuked.

[olivier-briat]

For the record, I fixed this problem by going to Firefox > Parameters > Security Devices > NSS, and setting Personal security's password to "empty"

The keys file seems to be into ~/.mozilla/firefox/XXXXX.default-release/ and not ~/.pki/nssdb