Create/Update Signed CA

This document describes how to create/update Signed CA data that is used at an example program.

Signed CA Creation

Generate RSA Key pair

2048 bit RSA key pair
$ openssl genrsa 2048 2> /dev/null > rsa_private.pem
$ openssl rsa -in rsa_private.pem -pubout -out rsa_public.pem 2> /dev/null

Sign to CA certificate

Signed by 2048-bit RSA
$ openssl dgst -sha256 -sign rsa_private.pem -sigopt rsa_padding_mode:pss -sigopt rsa_pss_saltlen:-1-out <signed-CA>.sign <CA-file-for-Signed>

For an example program, it assumes that wolfSSL example CA cert is to be signed.
e.g.
$ openssl dgst -sha256 -sign rsa_private.pem -sigopt rsa_padding_mode:pss -sigopt rsa_pss_saltlen:-1-out Signed-CA.sign /path/for/wolfssl/certs/ca-cert.der

Convert Signed CA to C source

It is able to use dertoc.pl to generate c-source data from signed-ca binary data.

$ /path/to/wolfssl/scripts/dertoc.pl ./ca-cert.der.sign ca_cert_der_sig example.c

Appendix

Example Keys

There are multiple example keys for testing in the example_keys folder.

<example_keys>
|
+----+ rsa_private.pem  an example 2048-bit rsa private key for signing CA cert
     + rsa_public.pem   an example 2048-bit rsa public key for verifying CA cert
     + generate_signCA.sh an example script to generate signed-certificate data for the example program

1.4 KiB 原始文件 Blame 文件歷史