dh/ima-evm-utils-mirror
1
0
Fork 0
mirror of https://git.code.sf.net/p/linux-ima/ima-evm-utils synced 2025-04-27 22:32:31 +02:00
Code Releases Activity

Update OpenSSL config files for support for .machine keyring

Browse Source 
Update the OpenSSL config files for support for loading certs onto
the .machine keyring where certain key usage flags must be set.

Also update the OpenSSL config files shown in the README.

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
This commit is contained in:
Stefan Berger 2023-04-26 18:35:57 -04:00 committed by Mimi Zohar
parent 6e1b9b1521
commit 9f669a6b38
3 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
README
View File

@ -235,6 +235,7 @@ Configuration file x509_evm.genkey:
[ myexts ]
basicConstraints=critical,CA:FALSE
keyUsage=digitalSignature
extendedKeyUsage=critical,codeSigning
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid
# EOF
@ -287,7 +288,7 @@ Configuration file ima-local-ca.genkey:
basicConstraints=CA:TRUE
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid:always,issuer
# keyUsage = cRLSign, keyCertSign
keyUsage = cRLSign, keyCertSign
# EOF
Generate private key and X509 public key certificate:

2
examples/ima-gen-local-ca.sh
View File

@ -19,7 +19,7 @@ emailAddress = ca@ima-ca
basicConstraints=CA:TRUE
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid:always,issuer
# keyUsage = cRLSign, keyCertSign
keyUsage = cRLSign, keyCertSign
__EOF__
openssl req -new -x509 -utf8 -sha256 -days 3650 -batch -config $GENKEY \

1
examples/ima-genkey.sh
View File

@ -20,6 +20,7 @@ basicConstraints=critical,CA:FALSE
#basicConstraints=CA:FALSE
keyUsage=digitalSignature
#keyUsage = nonRepudiation, digitalSignature, keyEncipherment
extendedKeyUsage=critical,codeSigning
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid
#authorityKeyIdentifier=keyid,issuer