Bug 524931

Description of problem:

NSS now supports a superior database format based on sqlite3 databases. CS should start using this new format.

NSS shared DB uses sqlite3 to store certs and keys rather than the old berkeley dbm. Sqlite has a vibrant upstream which is continuing to improve the database. The old berkeley DB is basically dead code. The developers moved on to sleepy cat long ago. The only bug fixing to that database format is what we have done.

Besides a more vibrant upstream, sqlite3 also provides the ability for multiple processes to safely share a single database instance. It supports transactions, reducing the risk of database corruption (even when used by a single database user). You can also use sqlite3 commands to examine the raw database when debugging issues.

The database is used just like the old DBM database. You can continue to open your own private databases, as well as allowing servers to share databases (so they could, for instance, use a single cert database to store all the keys and certs that may be shared by multiple servers). Even more useful for servers, however, is now you can make admin changes without rebooting. If you change the trust on a root cert, or you import a new cert and key, the server will be able to use that new cert and key, or will respond to the new trust attributes immediately without requiring a reboot.