{"record":{"id":"de4f2da3a87d1b0d","repo":"XX-net/XX-Net","slug":"please-install-libnss3-tools-package-to-import-g","errorCode":null,"errorMessage":"please install *libnss3-tools* package to import GoAgent root ca","messagePattern":"please install \\*libnss3-tools\\* package to import GoAgent root ca","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"code/default/gae_proxy/local/cert_util.py","lineNumber":339,"sourceCode":"        if not os.path.isdir(firefox_path):\n            return\n\n        for filename in os.listdir(firefox_path):\n            if filename.endswith(\".default\") and os.path.isdir(os.path.join(firefox_path, filename)):\n                config_path = os.path.join(firefox_path, filename)\n                #xlog.debug(\"Got Firefox path: %s\", config_path)\n                return config_path\n\n    @staticmethod\n    def import_linux_firefox_ca(common_name, ca_file):\n        xlog.debug(\"Begin importing CA to Firefox\")\n        firefox_config_path = CertUtil.get_linux_firefox_path()\n        if not firefox_config_path:\n            #xlog.debug(\"Not found Firefox path\")\n            return False\n\n        if not any(os.path.isfile('%s/certutil' % x) for x in os.environ['PATH'].split(os.pathsep)):\n            xlog.warn('please install *libnss3-tools* package to import GoAgent root ca')\n            return False\n\n        xlog.info(\"Removing old cert to Firefox in %s\", firefox_config_path)\n        cmd_line = 'certutil -L -d %s |grep \"GoAgent\" &&certutil -d %s -D -n \"%s\" ' % (firefox_config_path, firefox_config_path, common_name)\n        os.system(cmd_line) # remove old cert first\n\n        xlog.info(\"Add new cert to Firefox in %s\", firefox_config_path)\n        cmd_line = 'certutil -d %s -A -t \"C,,\" -n \"%s\" -i \"%s\"' % (firefox_config_path, common_name, ca_file)\n        os.system(cmd_line) # install new cert\n        return True\n\n    @staticmethod\n    def import_linux_ca(common_name, ca_file):\n\n        def get_linux_ca_sha1(nss_path):\n            commonname = \"GoAgent XX-Net - GoAgent\" #TODO: here should be GoAgent - XX-Net\n\n            cmd = ['certutil', '-L','-d', 'sql:%s' % nss_path, '-n', commonname]","sourceCodeStart":321,"sourceCodeEnd":357,"githubUrl":"https://github.com/XX-net/XX-Net/blob/cfa5bc17b67676e467f37ec50766127e0ab5f0aa/code/default/gae_proxy/local/cert_util.py#L321-L357","documentation":"On Linux, import_linux_firefox_ca wants to run NSS certutil to import the GoAgent root CA into Firefox, but the certutil binary is not on PATH (missing libnss3-tools). It warns and returns False without importing.","triggerScenarios":"import_ca() running on Linux with Firefox installed but without the libnss3-tools package providing /usr/bin/certutil.","commonSituations":"Fresh Linux installs where NSS tools were never installed; minimal/container distros; certutil installed only for another user/path.","solutions":["Install the package: sudo apt install libnss3-tools (Debian/Ubuntu) or sudo dnf install nss-tools (Fedora)","Re-run CA import from the XX-Net status page","Alternatively import goagent-ca.crt manually via Firefox Settings -> Certificates -> Import","Ensure /usr/bin is on PATH for the XX-Net process"],"exampleFix":"// before: certutil missing\nsudo apt-get install -y libnss3-tools\n// after: re-run import_ca(); certutil found on PATH and CA imported into Firefox","handlingStrategy":"validation","validationCode":"import shutil\nassert shutil.which('certutil'), 'install libnss3-tools first'","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Install libnss3-tools/nss-tools before first run on Linux","Import the CA manually via Firefox settings if automation fails"],"tags":["certificates","firefox","linux","nss","installation"],"backgroundTag":"missing-system-dependency","analyzedSha":"cfa5bc17b67676e467f37ec50766127e0ab5f0aa","analyzedAt":"2026-08-27T19:28:28.225Z","schemaVersion":2},"datasetVersion":"2026-08-28T00:17:15.603Z"}