'\" t
.\"     Title: NSS-POLICY-CHECK
.\"    Author: [see the "Authors" section]
.\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
.\"      Date: Nov 13 2013
.\"    Manual: NSS Security Tools
.\"    Source: nss-tools 3.101.0
.\"  Language: English
.\"
.TH "NSS\-POLICY\-CHECK" "1" "Nov 13 2013" "nss-tools 3.101.0" "NSS Security Tools"
.\" -----------------------------------------------------------------
.\" * Define some portability stuff
.\" -----------------------------------------------------------------
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.\" http://bugs.debian.org/507673
.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.ie \n(.g .ds Aq \(aq
.el       .ds Aq '
.\" -----------------------------------------------------------------
.\" * set default formatting
.\" -----------------------------------------------------------------
.\" disable hyphenation
.nh
.\" disable justification (adjust text to left margin only)
.ad l
.\" -----------------------------------------------------------------
.\" * MAIN CONTENT STARTS HERE *
.\" -----------------------------------------------------------------
.SH "NAME"
nss-policy-check \- nss\-policy\-check policy\-file
.SH "SYNOPSIS"
.HP \w'\fBnss\-policy\-check\fR\ 'u
\fBnss\-policy\-check\fR
.SH "DESCRIPTION"
.PP
\fBnss\-policy\-check\fR
verifies crypto\-policy configuration that controls certain crypto algorithms are allowed/disallowed to use in the NSS library\&.
.PP
The crypto\-policy configuration can be stored in either a system\-wide configuration file, specified with the POLICY_PATH and POLICY_FILE build options, or in the pkcs11\&.txt in NSS database\&.
.SH "USAGE AND EXAMPLES"
.PP
To check the global crypto\-policy configuration in
/etc/crypto\-policies/back\-ends/nss\&.config:
.sp
.if n \{\
.RS 4
.\}
.nf
$ nss\-policy\-check /etc/crypto\-policies/back\-ends/nss\&.config
NSS\-POLICY\-INFO: LOADED\-SUCCESSFULLY
NSS\-POLICY\-INFO: PRIME256V1 is enabled for KX
NSS\-POLICY\-INFO: PRIME256V1 is enabled for CERT\-SIGNATURE
NSS\-POLICY\-INFO: SECP256R1 is enabled for KX
NSS\-POLICY\-INFO: SECP256R1 is enabled for CERT\-SIGNATURE
NSS\-POLICY\-INFO: SECP384R1 is enabled for KX
NSS\-POLICY\-INFO: SECP384R1 is enabled for CERT\-SIGNATURE
\&.\&.\&.
NSS\-POLICY\-INFO: NUMBER\-OF\-SSL\-ALG\-KX: 13
NSS\-POLICY\-INFO: NUMBER\-OF\-SSL\-ALG: 9
NSS\-POLICY\-INFO: NUMBER\-OF\-CERT\-SIG: 9
\&.\&.\&.
NSS\-POLICY\-INFO: ciphersuite TLS_AES_128_GCM_SHA256 is enabled
NSS\-POLICY\-INFO: ciphersuite TLS_CHACHA20_POLY1305_SHA256 is enabled
NSS\-POLICY\-INFO: ciphersuite TLS_AES_256_GCM_SHA384 is enabled
\&.\&.\&.
NSS\-POLICY\-INFO: NUMBER\-OF\-CIPHERSUITES: 24
NSS\-POLICY\-INFO: NUMBER\-OF\-TLS\-VERSIONS: 3
NSS\-POLICY\-INFO: NUMBER\-OF\-DTLS\-VERSIONS: 2
    
.fi
.if n \{\
.RE
.\}
.PP
If there is a failure or warning, it will be prefixed with NSS\-POLICY\-FAIL or NSS\-POLICY_WARN\&.
.PP
\fBnss\-policy\-check\fR
exits with 2 if any failure is found, 1 if any warning is found, or 0 if no errors are found\&.
.SH "ADDITIONAL RESOURCES"
.PP
For information about NSS and other tools related to NSS (like JSS), check out the NSS project wiki at
\m[blue]\fBhttp://www\&.mozilla\&.org/projects/security/pki/nss/\fR\m[]\&. The NSS site relates directly to NSS code changes and releases\&.
.PP
Mailing lists: https://lists\&.mozilla\&.org/listinfo/dev\-tech\-crypto
.PP
IRC: Freenode at #dogtag\-pki
.SH "AUTHORS"
.PP
The NSS tools were written and maintained by developers with Netscape, Red Hat, Sun, Oracle, Mozilla, and Google\&.
.PP
Authors: Elio Maldonado <emaldona@redhat\&.com>, Deon Lackey <dlackey@redhat\&.com>\&.
.SH "LICENSE"
.PP
Licensed under the Mozilla Public License, v\&. 2\&.0\&. If a copy of the MPL was not distributed with this file, You can obtain one at http://mozilla\&.org/MPL/2\&.0/\&.
