Troubleshooting improvement for ClientCertValidateCLI.

The ClientCertValidateCLI has been modified to display the NSS
error code and error message for invalid certificates.

1 files changed, 6 insertions, 3 deletions

diff --git a/base/java-tools/src/com/netscape/cmstools/client/ClientCertValidateCLI.java b/base/java-tools/src/com/netscape/cmstools/client/ClientCertValidateCLI.java
index 22bddcf32..a3f1deb36 100644
--- a/base/java-tools/src/com/netscape/cmstools/client/ClientCertValidateCLI.java
+++ b/base/java-tools/src/com/netscape/cmstools/client/ClientCertValidateCLI.java
@@ -18,6 +18,7 @@
 
 package com.netscape.cmstools.client;
 
+import java.security.cert.CertificateException;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.List;
@@ -97,11 +98,13 @@ public class ClientCertValidateCLI extends CLI {
 
         CryptoManager cm = CryptoManager.getInstance();
         if (cu.getUsage() != CryptoManager.CertificateUsage.CheckAllUsages.getUsage()) {
-            if (cm.isCertValid(nickname, true, cu)) {
+            try {
+                cm.verifyCertificate(nickname, true, cu);
                 System.out.println("Valid certificate: " + nickname);
                 return true;
-            } else {
-                System.out.println("Invalid certificate: " + nickname);
+            } catch (CertificateException e) {
+                // Invalid certificate: (<code>) <message>
+                System.out.println(e.getMessage());
                 return false;
             }