The certutil -C command is supposed to issue a certificate given a CSR. In non-FIPS mode the command does not require any password, but in FIPS mode it does require a password to the internal token (no HSM is used in this case). The problem is the password specified with the -f parameter is always ignored. Instead, the command will always prompt for the password on the console, so it cannot be automated. This problem affects current RHCS testing automation and may affect future RHCS development.

Steps to reproduce:

1. Prepare a FIPS-enabled machine.
2. Store the NSS database password in password.txt.
3. Create an NSS database with the password file:

 $ mkdir nssdb
 $ certutil -N -d nssdb -f password.txt

4. Generate a random noise file:

 $ openssl rand -out noise.bin 2048

5. Generate a root CA certificate:

 $ echo -e "y\n\ny\n" | \
  certutil -S \
  -d nssdb \
  -f password.txt \
  -z noise.bin \
  -n "Root CA" \
  -s "CN=Root CA,O=EXAMPLE" \
  -x \
  -t "CT,C,C" \
  -m $RANDOM\
  -2 \
  --keyUsage certSigning \
  --nsCertType sslCA,smimeCA,objectSigningCA

6. Issue a certificate with an existing CSR:

 $ echo -e "0\n1\n5\n6\n9\ny\ny\n\ny\n" | \
  certutil -C \
  -d nssdb \
  -f password.txt \
  -m $RANDOM \
  -a \
  -i example.csr \
  -o example.crt \
  -c "Root CA" \
  -1 \
  -2
 Enter Password or Pin for "NSS FIPS 140-2 Certificate DB":

Actual result: In step #6 the command prompts for the internal token password although the password file is already specified with the -f parameter. After entering the password manually, the certificate is issued correctly.

Expected result: The command in step #6 should not prompt for the password since it's already specified with the -f parameter.