dh/ima-evm-utils-mirror
1
0
Fork 0
mirror of https://git.code.sf.net/p/linux-ima/ima-evm-utils synced 2025-04-27 14:22:31 +02:00
Code Releases Activity

Add example scripts for EC key and certs generation

Browse Source 
Add example scripts for EC key and certificate creation and reference
them from the README and Makefile.am.

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
This commit is contained in:
Stefan Berger 2023-04-26 18:35:59 -04:00 committed by Mimi Zohar
parent ce9bfdd091
commit 14bce8a97c
5 changed files with 99 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
Makefile.am
View File

@ -7,7 +7,13 @@ if MANPAGE_DOCBOOK_XSL
dist_man_MANS = evmctl.1
endif
doc_DATA = examples/ima-genkey-self.sh examples/ima-genkey.sh examples/ima-gen-local-ca.sh
doc_DATA = \
examples/ima-genkey-self.sh \
examples/ima-genkey.sh \
examples/ima-gen-local-ca.sh \
examples/ima-genkey-self-ecc.sh \
examples/ima-genkey-ecc.sh \
examples/ima-gen-local-ca-ecc.sh
EXTRA_DIST = autogen.sh $(doc_DATA)
CLEANFILES = *.html *.xsl

3
README
View File

@ -470,6 +470,9 @@ Examples of scripts to generate X509 public key certificates:
/usr/share/doc/ima-evm-utils/ima-genkey-self.sh
/usr/share/doc/ima-evm-utils/ima-genkey.sh
/usr/share/doc/ima-evm-utils/ima-gen-local-ca.sh
/usr/share/doc/ima-evm-utils/ima-genkey-self-ecc.sh
/usr/share/doc/ima-evm-utils/ima-genkey-ecc.sh
/usr/share/doc/ima-evm-utils/ima-gen-local-ca-ecc.sh
AUTHOR

28
examples/ima-gen-local-ca-ecc.sh Executable file
View File

@ -0,0 +1,28 @@
#!/bin/sh
GENKEY=ima-local-ca.genkey
cat << __EOF__ >$GENKEY
[ req ]
distinguished_name = req_distinguished_name
prompt = no
string_mask = utf8only
x509_extensions = v3_ca
[ req_distinguished_name ]
O = IMA-CA
CN = IMA/EVM certificate signing key
emailAddress = ca@ima-ca
[ v3_ca ]
basicConstraints=CA:TRUE
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid:always,issuer
keyUsage = cRLSign, keyCertSign
__EOF__
openssl req -new -x509 -utf8 -sha256 -days 3650 -batch -config $GENKEY \
-outform DER -out ima-local-ca.x509 -keyout ima-local-ca.priv \
-newkey ec -pkeyopt ec_paramgen_curve:prime256v1
openssl x509 -inform DER -in ima-local-ca.x509 -out ima-local-ca.pem

33
examples/ima-genkey-ecc.sh Executable file
View File

@ -0,0 +1,33 @@
#!/bin/sh
GENKEY=ima.genkey
cat << __EOF__ >$GENKEY
[ req ]
distinguished_name = req_distinguished_name
prompt = no
string_mask = utf8only
x509_extensions = v3_usr
[ req_distinguished_name ]
O = `hostname`
CN = `whoami` signing key
emailAddress = `whoami`@`hostname`
[ v3_usr ]
basicConstraints=critical,CA:FALSE
#basicConstraints=CA:FALSE
keyUsage=digitalSignature
#keyUsage = nonRepudiation, digitalSignature, keyEncipherment
extendedKeyUsage=critical,codeSigning
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid
#authorityKeyIdentifier=keyid,issuer
__EOF__
openssl req -new -nodes -utf8 -sha256 -days 365 -batch -config $GENKEY \
-out csr_ima.pem -keyout privkey_ima.pem \
-newkey ec -pkeyopt ec_paramgen_curve:prime256v1
openssl x509 -req -in csr_ima.pem -days 365 -extfile $GENKEY -extensions v3_usr \
-CA ima-local-ca.pem -CAkey ima-local-ca.priv -CAcreateserial \
-outform DER -out x509_ima.der

28
examples/ima-genkey-self-ecc.sh Executable file
View File

@ -0,0 +1,28 @@
#!/bin/sh
GENKEY=x509_evm.genkey
cat << __EOF__ >$GENKEY
[ req ]
distinguished_name = req_distinguished_name
prompt = no
string_mask = utf8only
x509_extensions = myexts
[ req_distinguished_name ]
O = `hostname`
CN = `whoami` signing key
emailAddress = `whoami`@`hostname`
[ myexts ]
basicConstraints=critical,CA:FALSE
keyUsage=digitalSignature
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid
__EOF__
openssl req -x509 -new -nodes -utf8 -sha256 -days 3650 -batch -config $GENKEY \
-outform DER -out x509_evm.der -keyout privkey_evm.pem \
-newkey ec -pkeyopt ec_paramgen_curve:prime256v1
openssl ec -pubout -in privkey_evm.pem -out pubkey_evm.pem