XPI signing linux no gui

Question

I'm trying to sign an XPI on linux (no gui) using the NSS cert db (cert8.db and key3.db) i copied from another server of mine, on which I can sign XPI's just fine.

On the new box I can sign with a brand new test certificate ok, but when i try to use the old cert db, it complains with:

signtool: PROBLEM signing data (Unknown issuer)

Certutil lists the cert im trying to use with a * and the CA is present in there as well.

Is this cert db transferable between computers like this? Or are there any other files I have to setup?

TIA Mike

Answer 1

im not sure if this is what you need, but here it is: http://www.mercille.org/snippets/xpiSigning.php

Answer 2

If the certificate chain has an intermediate CA that also needs to be there.

NSS is rather picky when it comes to the chain and also needs the certs to have been marked as trusted.