Re: [RAUC] resign a bundle with new intermediate certificate

["Yazdani, Reyhaneh" <RYazdani@data-modul.com>]

Hi Enrico,

Now my problem is solved by using Root CA.

Best regards,
Reyhaneh

> -----Ursprüngliche Nachricht-----
> Von: Enrico Jörns <ejo@pengutronix.de>
> Gesendet: Mittwoch, 16. März 2022 13:26
> An: Yazdani, Reyhaneh <RYazdani@data-modul.com>; Jan Lübbe
> <jlu@pengutronix.de>; rauc@pengutronix.de
> Betreff: Re: [RAUC] resign a bundle with new intermediate certificate
> 
> Hi,
> 
> Am Mittwoch, dem 16.03.2022 um 11:56 +0000 schrieb Yazdani, Reyhaneh:
> > Maybe it would be better that I ask my question in this way:
> >
> > If I have an ICA certificate and a pair of signed certificate (not self-signed)
> and key, how should I prepare the rauc bundle command? Is the below
> command correct?
> >
> > $ rauc bundle --cert=certificate.pem --key=key.pem
> > --intermediate=ica-certificate.pem  input-dir output.bundle
> >
> > Or still I need --keyring argument? If yes, then --keyring=certificate.pem is
> right?
> 
> --keyring is optional for 'rauc bundle' and used only for post-signing
> verification.
> 
> >
> > What should I copy in rootfs (/etc/rauc/), certificate or ica-certificate?
> >
> 
> The purpose of putting the intermediate certificate into the CMS/signature is
> to not require this to be present in the keyring.
> 
> Thus you only need to place the (root) certificate there.
> 
> 
> Best regards, Enrico
> 
> > Best regards,
> > Reyhaneh
> >
> > > -----Ursprüngliche Nachricht-----
> > > Von: Jan Lübbe <jlu@pengutronix.de>
> > > Gesendet: Mittwoch, 16. März 2022 11:11
> > > An: Yazdani, Reyhaneh <RYazdani@data-modul.com>;
> rauc@pengutronix.de
> > > Betreff: Re: [RAUC] resign a bundle with new intermediate
> > > certificate
> > >
> > > Hi,
> > >
> > > On Wed, 2022-03-16 at 08:36 +0000, Yazdani, Reyhaneh wrote:
> > > > Hello,
> > > >
> > > > I have a bundle, which is signed with keys in the past.
> > > > Now, I have new keys, which are created with a new ica-certificate.
> > > > When I want to resign the bundle with new keys, I face this error:
> > > >
> > > > Failed to resign bundle: failed signing bundle: signature verification
> failed:
> > > > Verify error:unable to get local issuer certificate
> > >
> > > Please don't trim the log output. You can also use -d to get more output.
> > >
> > > > This is the command which is applied:
> > > >
> > > > rauc resign --cert=new-certificate-1.pem --key=new-key-1.pem
> > > > --keyring=old- rauc.cert.pem
> > >
> > > This is only correct if the old certificate was self-signed.
> > > Otherwise it must be the old root CA certificate.
> > >
> > > > --signing-keyring=new-certificate-1.pem
> > >
> > > If your using intermediate certificates, the new-certificate-1.pem
> > > can't be self-signed. Accordingly, using it as the --signing-keyring can't be
> correct.
> > >
> > > You need to use the *new* root CA certificate here.
> > >
> > > > --intermediate=new-ica-certificate.pem  old-bundle.raucb
> > > > new-bundle.raucb
> > > >
> > > > Can I resign a bundle with new ica-certificate?
> > >
> > > It uses the same code paths as the normal bundle creation for
> > > singing, so I don't see why it should behave differently.
> > >
> > > Regards,
> > > Jan
> > > --
> > > Pengutronix e.K.                           |                             |
> > > Steuerwalder Str. 21                       | https://imsva91-
> ctp.trendmicro.com:443/wis/clicktime/v1/query?url=http%3a%2f%2fhttps://imsva91-ctp.trendmicro.com:443/wis/clicktime/v1/query?url=www.p&umid=A3FC4124-DA66-5705-81ED-2AA0CD9CD367&auth=162296ff492f363ddb29ca454338bb84627996db-1193a338e35e2c8a62a53d02d18e2bdd0a8c8e19
> engutronix.de&umid=DB2EF41C-DA55-0405-A659-
> D93C59E4F43F&auth=162296ff492f363ddb29ca454338bb84627996db-
> 720366fbf4a4efd66b15d9a78b7735ab01aac3b9  |
> > > 31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
> > > Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |
> > _______________________________________________
> > RAUC mailing list
> 
> --
> Pengutronix e.K.                           | Enrico Jörns                | Embedded Linux
> Consulting & Support        | https://imsva91-
> ctp.trendmicro.com:443/wis/clicktime/v1/query?url=https%3a%2f%2fhttps://imsva91-ctp.trendmicro.com:443/wis/clicktime/v1/query?url=www.p&umid=A3FC4124-DA66-5705-81ED-2AA0CD9CD367&auth=162296ff492f363ddb29ca454338bb84627996db-1193a338e35e2c8a62a53d02d18e2bdd0a8c8e19
> engutronix.de&umid=DB2EF41C-DA55-0405-A659-
> D93C59E4F43F&auth=162296ff492f363ddb29ca454338bb84627996db-
> f06d7e8dba9176f16855942234dee15395e94b35 | Steuerwalder Str.
> 21                       | Phone: +49-5121-206917-180  |
> 31137 Hildesheim, Germany                  | Fax:   +49-5121-206917-9    |

_______________________________________________
RAUC mailing list