Re: [RAUC] pass PEM passphrase in Yocto build

["Jan Lübbe" <jlu@pengutronix.de>]

Hi,

On Fri, 2022-03-18 at 10:32 +0000, Yazdani, Reyhaneh wrote:
> Hi everyone,
>  
> I am getting the below error when I was building the bundle by Yocto with
> encrypted Root CA and ICA certificate.
> 
…
> | 139843920926528:error:0906406D:PEM routines:PEM_def_callback:problems
> getting password:../openssl-1.1.1l/crypto/pem/pem_lib.c:59:
> | 139843920926528:error:0907B068:PEM routines:PEM_read_bio_PrivateKey:bad
> password read:../openssl-1.1.1l/crypto/pem/pem_pkey.c:64:
…
>  
> During my investigation, I found the below post from 6 months ago:
> https://github.com/rauc/meta-rauc/issues/200

My recommendations in
https://github.com/rauc/meta-rauc/issues/200#issuecomment-943085728 still stand.

> Based on this post, I cannot use any encrypted keys and Root-CA in building a
> bundle in Yocto. Am I right?

Yes. So far, nobody has implemented support for passing a private key password
to RAUC, as the security benefits are minimal compared to the effort. 

Regards,
Jan
-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |

_______________________________________________
RAUC mailing list