dh/ima-evm-utils-mirror
1
0
Fork 0
mirror of https://git.code.sf.net/p/linux-ima/ima-evm-utils synced 2025-04-28 06:33:36 +02:00
Code Releases Activity

Update OpenSSL config files for support for .machine keyring

Browse Source 
Update the OpenSSL config files for support for loading certs onto
the .machine keyring where certain key usage flags must be set.

Also update the OpenSSL config files shown in the README.

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
This commit is contained in:
Stefan Berger 2023-04-26 18:35:57 -04:00 committed by Mimi Zohar
parent 6e1b9b1521
commit 9f669a6b38
3 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
README
View File

@ -235,6 +235,7 @@ Configuration file x509_evm.genkey:
[ myexts ] [ myexts ]
basicConstraints=critical,CA:FALSE basicConstraints=critical,CA:FALSE
keyUsage=digitalSignature keyUsage=digitalSignature
extendedKeyUsage=critical,codeSigning
subjectKeyIdentifier=hash subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid authorityKeyIdentifier=keyid
# EOF # EOF
@ -287,7 +288,7 @@ Configuration file ima-local-ca.genkey:
basicConstraints=CA:TRUE basicConstraints=CA:TRUE
subjectKeyIdentifier=hash subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid:always,issuer authorityKeyIdentifier=keyid:always,issuer
# keyUsage = cRLSign, keyCertSign keyUsage = cRLSign, keyCertSign
# EOF # EOF
Generate private key and X509 public key certificate: Generate private key and X509 public key certificate:

2
examples/ima-gen-local-ca.sh
View File

@ -19,7 +19,7 @@ emailAddress = ca@ima-ca
basicConstraints=CA:TRUE basicConstraints=CA:TRUE
subjectKeyIdentifier=hash subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid:always,issuer authorityKeyIdentifier=keyid:always,issuer
# keyUsage = cRLSign, keyCertSign keyUsage = cRLSign, keyCertSign
__EOF__ __EOF__
openssl req -new -x509 -utf8 -sha256 -days 3650 -batch -config $GENKEY \ openssl req -new -x509 -utf8 -sha256 -days 3650 -batch -config $GENKEY \

1
examples/ima-genkey.sh
View File

@ -20,6 +20,7 @@ basicConstraints=critical,CA:FALSE
#basicConstraints=CA:FALSE #basicConstraints=CA:FALSE
keyUsage=digitalSignature keyUsage=digitalSignature
#keyUsage = nonRepudiation, digitalSignature, keyEncipherment #keyUsage = nonRepudiation, digitalSignature, keyEncipherment
extendedKeyUsage=critical,codeSigning
subjectKeyIdentifier=hash subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid authorityKeyIdentifier=keyid
#authorityKeyIdentifier=keyid,issuer #authorityKeyIdentifier=keyid,issuer