mail archive of the rauc mailing list
 help / color / mirror / Atom feed
From: "Enrico Jörns" <ejo@pengutronix.de>
To: "Yazdani, Reyhaneh" <RYazdani@data-modul.com>,
	"Jan Lübbe" <jlu@pengutronix.de>,
	"rauc@pengutronix.de" <rauc@pengutronix.de>
Subject: Re: [RAUC] resign a bundle with new intermediate certificate
Date: Wed, 16 Mar 2022 13:25:59 +0100	[thread overview]
Message-ID: <a674ab6402891bb596d34b7acbbbf2becbe2cbd5.camel@pengutronix.de> (raw)
In-Reply-To: <7b9b885f99264f8a99489f7a47093217@data-modul.com>

Hi,

Am Mittwoch, dem 16.03.2022 um 11:56 +0000 schrieb Yazdani, Reyhaneh:
> Maybe it would be better that I ask my question in this way:
> 
> If I have an ICA certificate and a pair of signed certificate (not self-signed) and key, how should I prepare the rauc bundle command? Is the below command correct?
> 
> $ rauc bundle --cert=certificate.pem --key=key.pem --intermediate=ica-certificate.pem  input-dir output.bundle
> 
> Or still I need --keyring argument? If yes, then --keyring=certificate.pem is right?

--keyring is optional for 'rauc bundle' and used only for post-signing
verification.

> 
> What should I copy in rootfs (/etc/rauc/), certificate or ica-certificate?
> 

The purpose of putting the intermediate certificate into the CMS/signature is to
not require this to be present in the keyring.

Thus you only need to place the (root) certificate there.


Best regards, Enrico

> Best regards,
> Reyhaneh 
> 
> > -----Ursprüngliche Nachricht-----
> > Von: Jan Lübbe <jlu@pengutronix.de>
> > Gesendet: Mittwoch, 16. März 2022 11:11
> > An: Yazdani, Reyhaneh <RYazdani@data-modul.com>; rauc@pengutronix.de
> > Betreff: Re: [RAUC] resign a bundle with new intermediate certificate
> > 
> > Hi,
> > 
> > On Wed, 2022-03-16 at 08:36 +0000, Yazdani, Reyhaneh wrote:
> > > Hello,
> > > 
> > > I have a bundle, which is signed with keys in the past.
> > > Now, I have new keys, which are created with a new ica-certificate.
> > > When I want to resign the bundle with new keys, I face this error:
> > > 
> > > Failed to resign bundle: failed signing bundle: signature verification failed:
> > > Verify error:unable to get local issuer certificate
> > 
> > Please don't trim the log output. You can also use -d to get more output.
> > 
> > > This is the command which is applied:
> > > 
> > > rauc resign --cert=new-certificate-1.pem --key=new-key-1.pem
> > > --keyring=old- rauc.cert.pem
> > 
> > This is only correct if the old certificate was self-signed. Otherwise it must be
> > the old root CA certificate.
> > 
> > > --signing-keyring=new-certificate-1.pem
> > 
> > If your using intermediate certificates, the new-certificate-1.pem can't be
> > self-signed. Accordingly, using it as the --signing-keyring can't be correct.
> > 
> > You need to use the *new* root CA certificate here.
> > 
> > > --intermediate=new-ica-certificate.pem  old-bundle.raucb
> > > new-bundle.raucb
> > > 
> > > Can I resign a bundle with new ica-certificate?
> > 
> > It uses the same code paths as the normal bundle creation for singing, so I
> > don't see why it should behave differently.
> > 
> > Regards,
> > Jan
> > --
> > Pengutronix e.K.                           |                             |
> > Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
> > 31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
> > Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |
> _______________________________________________
> RAUC mailing list

-- 
Pengutronix e.K.                           | Enrico Jörns                |
Embedded Linux Consulting & Support        | https://www.pengutronix.de/ |
Steuerwalder Str. 21                       | Phone: +49-5121-206917-180  |
31137 Hildesheim, Germany                  | Fax:   +49-5121-206917-9    |

_______________________________________________
RAUC mailing list

  reply	other threads:[~2022-03-16 12:26 UTC|newest]

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
     [not found] <55847245da1d4554889701ddd9071a67@data-modul.com>
2022-03-16 10:10 ` Jan Lübbe
2022-03-16 11:45   ` Yazdani, Reyhaneh
2022-03-16 11:56   ` Yazdani, Reyhaneh
2022-03-16 12:25     ` Enrico Jörns [this message]
2022-03-17  9:06       ` Yazdani, Reyhaneh

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=a674ab6402891bb596d34b7acbbbf2becbe2cbd5.camel@pengutronix.de \
    --to=ejo@pengutronix.de \
    --cc=RYazdani@data-modul.com \
    --cc=jlu@pengutronix.de \
    --cc=rauc@pengutronix.de \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox