Unterschiede

Hier werden die Unterschiede zwischen zwei Versionen angezeigt.

--- lx:ucs:ca [02.04.2025 18:03] – how to create a CodeSigning Cert Andy Haubenschmid
+++ lx:ucs:ca [02.04.2025 21:06] (aktuell) – [CodeSigning] Andy Haubenschmid
@@ Zeile 74: / Zeile 74: @@
   - create a new cert by using univention-certificate new, use a name you recognize as CS Cert
   - create a special extension file
-  - generate the csr again manually
+  - generate the cert again manually by the CA with the extension
-  - sign it by the ca again by issuing univention-certificate renew
+  - use this cert for signing
 <code>
@@ Zeile 82: / Zeile 81: @@
 declare -x ExportPassword=SuperSecurePasswordForP12File
-grep output_password /etc/univention/ssl/openssl.cnf
 echo \(`date -d 18-Oct-2027 +'%s'` - `date +'%s'`\) /86400 |bc > days
 declare -x days=`cat days`
@@ Zeile 94: / Zeile 92: @@
 basicConstraints       = CA:FALSE
 subjectAltName         = @alt_names
-extendedKeyUsage       = codeSigning,1.3.6.1.5.5.7.3.3
+extendedKeyUsage       = codeSigning
 [alt_names]
 DNS.1 = ${CertName}
 " > code_sign_cert.conf
+grep output_password /etc/univention/ssl/openssl.cnf
 openssl x509 -req -CA ../ucsCA/CAcert.pem -CAkey ../ucsCA/private/CAkey.pem -in req.pem -out cert.pem -days ${days} -CAcreateserial -extfile code_sign_cert.conf

AHa-IT