Unterschiede

Hier werden die Unterschiede zwischen zwei Versionen angezeigt.

--- lx:ucs:ca [07.03.2025 22:11] – für RDS Server die extendedKeyUsage setzen Andy Haubenschmid
+++ lx:ucs:ca [02.04.2025 21:06] (aktuell) – [CodeSigning] Andy Haubenschmid
@@ Zeile 62: / Zeile 62: @@
 Danach den Zertifikatsrequest mit ''openssl req -new -config openssl.cnf -key private.key -out req.pem'' erstellen und dann von der CA unterschreiben lassen: ''univention-certificate renew -name ${ServerName} -days 1825''
-=== .p12 Datei erzeugen ===
+===== .p12 Datei erzeugen =====
 <code>
 export ServerName=my.domain.name
@@ Zeile 68: / Zeile 68: @@
 </code>
 [[https://help.hcltechsw.com/appscan/Standard/9.0.3/en-US/t_ConvertthepfxCertificatetopemFormat068.html|Quelle]]
+===== CodeSigning =====
+To be recognized as a CodeSigning Certificate, it is needed to set also the following extended Key Usage 'EKU' Property: Extended Use key flag -eku ''1.3.6.1.5.5.7.3.3'' so the cert can be used for code signing by Powershell.
+To generate a CodeSigning Cert with the Univention CA, follow these steps:
+  - create a new cert by using univention-certificate new, use a name you recognize as CS Cert
+  - create a special extension file
+  - generate the cert again manually by the CA with the extension
+  - use this cert for signing
+<code>
+declare -x CertName=CodeSign-YourName
+declare -x ExportPassword=SuperSecurePasswordForP12File
+echo \(`date -d 18-Oct-2027 +'%s'` - `date +'%s'`\) /86400 |bc > days
+declare -x days=`cat days`
+. /usr/share/univention-ssl/make-certificates.sh
+univention-certificate new -name "${CertName}" -days ${days}
+cd /etc/univention/ssl/${CertName}
+echo "
+authorityKeyIdentifier = keyid,issuer
+basicConstraints       = CA:FALSE
+subjectAltName         = @alt_names
+extendedKeyUsage       = codeSigning
+[alt_names]
+DNS.1 = ${CertName}
+" > code_sign_cert.conf
+grep output_password /etc/univention/ssl/openssl.cnf
+openssl x509 -req -CA ../ucsCA/CAcert.pem -CAkey ../ucsCA/private/CAkey.pem -in req.pem -out cert.pem -days ${days} -CAcreateserial -extfile code_sign_cert.conf
+openssl pkcs12 -export -out /root/${CertName}.p12 -in cert.pem -inkey private.key -passout pass:${ExportPassword}
+</code>
+created with thanks to the infos found here: [[https://stackoverflow.com/questions/72207572/how-to-create-a-self-signed-code-signing-certificate-from-a-csr]]

AHa-IT

Benutzer-Werkzeuge

Webseiten-Werkzeuge

Unterschiede

Seiten-Werkzeuge