XX-net/XX-Net · warning

please install *libnss3-tools* package to import GoAgent roo

Error message

please install *libnss3-tools* package to import GoAgent root ca

What it means

On Linux, import_linux_firefox_ca wants to run NSS certutil to import the GoAgent root CA into Firefox, but the certutil binary is not on PATH (missing libnss3-tools). It warns and returns False without importing.

Source

Thrown at code/default/gae_proxy/local/cert_util.py:339

        if not os.path.isdir(firefox_path):
            return

        for filename in os.listdir(firefox_path):
            if filename.endswith(".default") and os.path.isdir(os.path.join(firefox_path, filename)):
                config_path = os.path.join(firefox_path, filename)
                #xlog.debug("Got Firefox path: %s", config_path)
                return config_path

    @staticmethod
    def import_linux_firefox_ca(common_name, ca_file):
        xlog.debug("Begin importing CA to Firefox")
        firefox_config_path = CertUtil.get_linux_firefox_path()
        if not firefox_config_path:
            #xlog.debug("Not found Firefox path")
            return False

        if not any(os.path.isfile('%s/certutil' % x) for x in os.environ['PATH'].split(os.pathsep)):
            xlog.warn('please install *libnss3-tools* package to import GoAgent root ca')
            return False

        xlog.info("Removing old cert to Firefox in %s", firefox_config_path)
        cmd_line = 'certutil -L -d %s |grep "GoAgent" &&certutil -d %s -D -n "%s" ' % (firefox_config_path, firefox_config_path, common_name)
        os.system(cmd_line) # remove old cert first

        xlog.info("Add new cert to Firefox in %s", firefox_config_path)
        cmd_line = 'certutil -d %s -A -t "C,," -n "%s" -i "%s"' % (firefox_config_path, common_name, ca_file)
        os.system(cmd_line) # install new cert
        return True

    @staticmethod
    def import_linux_ca(common_name, ca_file):

        def get_linux_ca_sha1(nss_path):
            commonname = "GoAgent XX-Net - GoAgent" #TODO: here should be GoAgent - XX-Net

            cmd = ['certutil', '-L','-d', 'sql:%s' % nss_path, '-n', commonname]

View on GitHub (pinned to cfa5bc17b6)

Solutions

1. Install the package: sudo apt install libnss3-tools (Debian/Ubuntu) or sudo dnf install nss-tools (Fedora)
2. Re-run CA import from the XX-Net status page
3. Alternatively import goagent-ca.crt manually via Firefox Settings -> Certificates -> Import
4. Ensure /usr/bin is on PATH for the XX-Net process

Example fix

// before: certutil missing
sudo apt-get install -y libnss3-tools
// after: re-run import_ca(); certutil found on PATH and CA imported into Firefox

import shutil
assert shutil.which('certutil'), 'install libnss3-tools first'

When it happens

Trigger: import_ca() running on Linux with Firefox installed but without the libnss3-tools package providing /usr/bin/certutil.

Common situations: Fresh Linux installs where NSS tools were never installed; minimal/container distros; certutil installed only for another user/path.

Related errors

• Enable auto start, create path:%s fail:%r
• load gi fail:%r, SysTray will not show.
• get ip address e:%r
• remove local DNS server %s from upstream

AI-assisted analysis of XX-net/XX-Net@cfa5bc17b6 (2026-08-27). Data as JSON: /api/errors/de4f2da3a87d1b0d. Report an issue: GitHub.