dexter has uploaded this change for review. ( https://gerrit.osmocom.org/c/onomondo-eim/+/43939?usp=email )
Change subject: contrib: improve script to re-generate the eIM certificate ......................................................................
contrib: improve script to re-generate the eIM certificate
The eIM ships with a pre-generated eIM certificate and a script that can be used to re-generate the certificates. Let's apply some improvements and re-generate the certificates using the improved script.
Related: SYS#8287 Change-Id: I0dc88c14492121fac955fc96b321fcf7ea326ae4 --- M contrib/make_eim_certificate.sh M priv/sample_eim_cert_brainpool.crt M priv/sample_eim_cert_brainpool.key M priv/sample_eim_cert_nist.crt M priv/sample_eim_cert_nist.key 5 files changed, 58 insertions(+), 34 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/onomondo-eim refs/changes/39/43939/1
diff --git a/contrib/make_eim_certificate.sh b/contrib/make_eim_certificate.sh index ab25cbe..0fca310 100755 --- a/contrib/make_eim_certificate.sh +++ b/contrib/make_eim_certificate.sh @@ -1,13 +1,31 @@ #!/bin/bash
-# This script is to illustrate how an eIM certificate could be generated using -# openssl. See also: GSMA SGP.32, section 2.6.4.2 +# This script may be used to generate an eIM certificate, which can be used to +# sign and verify eUICC packages (eCOs and PSMOs). The public key of the eIM +# certificate will be part of the eIM configuration, which is loaded onto the +# eUCCC. The private key is used by the eIM to sign the eUICC packages before +# sending them to the eUICC. (See also: GSMA SGP.32, section 2.6.4.2) + +C="EC" +ST="ExampleState" +L="ExampleLocality" +O="ExampleOrganization" +OU="ExampleOrganizationalUnit" +CN="ExampeCommonName" + +DAYS=365000 #1000 Years +OUTPUT_DIR=../priv/
#prime256v1: X9.62/SECG curve over a 256 bit prime field -openssl ecparam -genkey -name prime256v1 -noout -out sample_eim_cert_nist.key -openssl req -key sample_eim_cert_nist.key -new -x509 -days 36500 -out sample_eim_cert_nist.crt +openssl ecparam -name prime256v1 -genkey -noout -out sample_eim_cert_nist.key +openssl req -x509 -key sample_eim_cert_nist.key -out sample_eim_cert_nist.crt \ + -sha256 -days $DAYS -nodes -subj "/C=$C/ST=$ST/L=$L/O=$O/OU=$OU/CN=$CN"
#brainpoolP256r1: RFC 5639 curve over a 256 bit prime field -openssl ecparam -genkey -name brainpoolP256r1 -noout -out sample_eim_cert_brainpool.key -openssl req -key sample_eim_cert_brainpool.key -new -x509 -days 36500 -out sample_eim_cert_brainpool.crt +openssl ecparam -name brainpoolP256r1 -genkey -noout -out sample_eim_cert_brainpool.key +openssl req -x509 -key sample_eim_cert_brainpool.key -out sample_eim_cert_brainpool.crt \ + -sha256 -days $DAYS -nodes -subj "/C=$C/ST=$ST/L=$L/O=$O/OU=$OU/CN=$CN"
+#move certificates to output directory +mv ./*.key $OUTPUT_DIR +mv ./*.crt $OUTPUT_DIR diff --git a/priv/sample_eim_cert_brainpool.crt b/priv/sample_eim_cert_brainpool.crt index 541d9e4..6ae4825 100644 --- a/priv/sample_eim_cert_brainpool.crt +++ b/priv/sample_eim_cert_brainpool.crt @@ -1,13 +1,16 @@ -----BEGIN CERTIFICATE----- -MIIB4jCCAYigAwIBAgIUWIrJWeBmzulu5yt5ZHLGw6s5K/gwCgYIKoZIzj0EAwIw -RTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoMGElu -dGVybmV0IFdpZGdpdHMgUHR5IEx0ZDAgFw0yNDA1MjIxMTEwNTZaGA8yMTI0MDQy -ODExMTA1NlowRTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAf -BgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDBaMBQGByqGSM49AgEGCSsk -AwMCCAEBBwNCAASW2IBLRkBSZlg9nl6H4zps3z2HVfaahPVAXjfnP3bkYwXxaOyQ -zEnPFRYeq9uECTdj7tHWX7g8imqZq7N+86Sdo1MwUTAdBgNVHQ4EFgQUF0w8WS6N -x8qe1jwd/jxdg11lBSIwHwYDVR0jBBgwFoAUF0w8WS6Nx8qe1jwd/jxdg11lBSIw -DwYDVR0TAQH/BAUwAwEB/zAKBggqhkjOPQQDAgNIADBFAiBXmCDELWMTJN47FB82 -IpIqx2nFsZI/gJ12njrXBOzi/QIhAIyuRef27bLlFH6EWa8kxAyLpevJ4OZvPs95 -lFJzbFfq +MIICjzCCAjagAwIBAgIUAaOfZ6nHXz6Lnts4eOp/q5RpBFQwCgYIKoZIzj0EAwIw +gZsxCzAJBgNVBAYTAkVDMRUwEwYDVQQIDAxFeGFtcGxlU3RhdGUxGDAWBgNVBAcM +D0V4YW1wbGVMb2NhbGl0eTEcMBoGA1UECgwTRXhhbXBsZU9yZ2FuaXphdGlvbjEi +MCAGA1UECwwZRXhhbXBsZU9yZ2FuaXphdGlvbmFsVW5pdDEZMBcGA1UEAwwQRXhh +bXBlQ29tbW9uTmFtZTAgFw0yNjEwMjExMTI5MjBaGA8zMDI2MDIyMTExMjkyMFow +gZsxCzAJBgNVBAYTAkVDMRUwEwYDVQQIDAxFeGFtcGxlU3RhdGUxGDAWBgNVBAcM +D0V4YW1wbGVMb2NhbGl0eTEcMBoGA1UECgwTRXhhbXBsZU9yZ2FuaXphdGlvbjEi +MCAGA1UECwwZRXhhbXBsZU9yZ2FuaXphdGlvbmFsVW5pdDEZMBcGA1UEAwwQRXhh +bXBlQ29tbW9uTmFtZTBaMBQGByqGSM49AgEGCSskAwMCCAEBBwNCAAQylzPTz26D +cdaCzZWucNVFv1riwAqVfhpREWdh3DYSsqPjzMrWkBkbLFWP/k1myKwMANE47OMd +HX99XNq1OKzWo1MwUTAdBgNVHQ4EFgQUDVHVtDjsh4mYKDfpoZhyFCE/St8wHwYD +VR0jBBgwFoAUDVHVtDjsh4mYKDfpoZhyFCE/St8wDwYDVR0TAQH/BAUwAwEB/zAK +BggqhkjOPQQDAgNHADBEAiBv0SCPh+kO+4Jrn+2fYUsPUdLKie8QyGXNcofW7ET+ +PAIgWt0LaFWGPyt0GadJbjl5qAvqk01x/blax8Lv0WQTIj0= -----END CERTIFICATE----- diff --git a/priv/sample_eim_cert_brainpool.key b/priv/sample_eim_cert_brainpool.key index 2ff709c..4cce90b 100644 --- a/priv/sample_eim_cert_brainpool.key +++ b/priv/sample_eim_cert_brainpool.key @@ -1,5 +1,5 @@ -----BEGIN EC PRIVATE KEY----- -MHgCAQEEIIIH8O86z5njgI67CXMEVcIpw61LNJvYi7NW2mCka9lvoAsGCSskAwMC -CAEBB6FEA0IABJbYgEtGQFJmWD2eXofjOmzfPYdV9pqE9UBeN+c/duRjBfFo7JDM -Sc8VFh6r24QJN2Pu0dZfuDyKapmrs37zpJ0= +MHgCAQEEIGVrvICVkI4aMeTuW/pBKADyW6mOdGglgAUoYszS61QyoAsGCSskAwMC +CAEBB6FEA0IABDKXM9PPboNx1oLNla5w1UW/WuLACpV+GlERZ2HcNhKyo+PMytaQ +GRssVY/+TWbIrAwA0Tjs4x0df31c2rU4rNY= -----END EC PRIVATE KEY----- diff --git a/priv/sample_eim_cert_nist.crt b/priv/sample_eim_cert_nist.crt index c6725ad..85f2959 100644 --- a/priv/sample_eim_cert_nist.crt +++ b/priv/sample_eim_cert_nist.crt @@ -1,13 +1,16 @@ -----BEGIN CERTIFICATE----- -MIIB4jCCAYegAwIBAgIUTGB6P8Y9qfPRcs3sOh1rF5qalk4wCgYIKoZIzj0EAwIw -RTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoMGElu -dGVybmV0IFdpZGdpdHMgUHR5IEx0ZDAgFw0yNDA1MjIxMTEwNTVaGA8yMTI0MDQy -ODExMTA1NVowRTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAf -BgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDBZMBMGByqGSM49AgEGCCqG -SM49AwEHA0IABP5YSm9FBFlXSuyhldAplzf3TIm6LTbfkobsJdlzA3oPunDRTfPh -99CjBeV7lbcxxN4hjS1/nyIRPtXRjC493xyjUzBRMB0GA1UdDgQWBBSuLb4g6A1R -7Yj+arQrJbcEJEB9djAfBgNVHSMEGDAWgBSuLb4g6A1R7Yj+arQrJbcEJEB9djAP -BgNVHRMBAf8EBTADAQH/MAoGCCqGSM49BAMCA0kAMEYCIQDPDDvfcV0F/f+JPg0j -tmNNXH7CY91XEAcjKMWJmYJjdwIhAIfF6YbEcAIyY5129StjAB/xtXAS4JgBHok1 -o3NsXrXx +MIICkDCCAjWgAwIBAgIUWJ4+3BbLpKI8kv+deHlrDNnP6aowCgYIKoZIzj0EAwIw +gZsxCzAJBgNVBAYTAkVDMRUwEwYDVQQIDAxFeGFtcGxlU3RhdGUxGDAWBgNVBAcM +D0V4YW1wbGVMb2NhbGl0eTEcMBoGA1UECgwTRXhhbXBsZU9yZ2FuaXphdGlvbjEi +MCAGA1UECwwZRXhhbXBsZU9yZ2FuaXphdGlvbmFsVW5pdDEZMBcGA1UEAwwQRXhh +bXBlQ29tbW9uTmFtZTAgFw0yNjEwMjExMTI5MjBaGA8zMDI2MDIyMTExMjkyMFow +gZsxCzAJBgNVBAYTAkVDMRUwEwYDVQQIDAxFeGFtcGxlU3RhdGUxGDAWBgNVBAcM +D0V4YW1wbGVMb2NhbGl0eTEcMBoGA1UECgwTRXhhbXBsZU9yZ2FuaXphdGlvbjEi +MCAGA1UECwwZRXhhbXBsZU9yZ2FuaXphdGlvbmFsVW5pdDEZMBcGA1UEAwwQRXhh +bXBlQ29tbW9uTmFtZTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABELbNTAi0XTB +jVFCOQwkVRXP2gi3FoQivnaun3qKaAo2g7q07EuFhe/Dc8hEXZDdq7BBunAfIkr0 +zp4Z1fCkUR6jUzBRMB0GA1UdDgQWBBTNOK98JKC5SENja2a3tncCl9gpnDAfBgNV +HSMEGDAWgBTNOK98JKC5SENja2a3tncCl9gpnDAPBgNVHRMBAf8EBTADAQH/MAoG +CCqGSM49BAMCA0kAMEYCIQDgXoYoqrZn5ood8iXPdpnrYFw2Cygu78z1/Byax4FI +QQIhAN9FDkGw/ioUgFizGYtXQJZXRSM3V1vvtehbDS2MSW3R -----END CERTIFICATE----- diff --git a/priv/sample_eim_cert_nist.key b/priv/sample_eim_cert_nist.key index 119cf81..07440f4 100644 --- a/priv/sample_eim_cert_nist.key +++ b/priv/sample_eim_cert_nist.key @@ -1,5 +1,5 @@ -----BEGIN EC PRIVATE KEY----- -MHcCAQEEIJTota/YsWhFhwHqEcDiFhTN+V/oRjUQNmF3qI0RPeFLoAoGCCqGSM49 -AwEHoUQDQgAE/lhKb0UEWVdK7KGV0CmXN/dMibotNt+Shuwl2XMDeg+6cNFN8+H3 -0KMF5XuVtzHE3iGNLX+fIhE+1dGMLj3fHA== +MHcCAQEEIImxzoQUnpvWsfoYQQpv8W6Dnj3v2Bk7BXR6nnV0uePGoAoGCCqGSM49 +AwEHoUQDQgAEQts1MCLRdMGNUUI5DCRVFc/aCLcWhCK+dq6feopoCjaDurTsS4WF +78NzyERdkN2rsEG6cB8iSvTOnhnV8KRRHg== -----END EC PRIVATE KEY-----