dexter has uploaded this change for review.

View Change

contrib: improve script to re-generate the eIM certificate

The eIM ships with a pre-generated eIM certificate and a script that
can be used to re-generate the certificates. Let's apply some
improvements and re-generate the certificates using the improved
script.

Related: SYS#8287
Change-Id: I0dc88c14492121fac955fc96b321fcf7ea326ae4
---
M contrib/make_eim_certificate.sh
M priv/sample_eim_cert_brainpool.crt
M priv/sample_eim_cert_brainpool.key
M priv/sample_eim_cert_nist.crt
M priv/sample_eim_cert_nist.key
5 files changed, 58 insertions(+), 34 deletions(-)

git pull ssh://gerrit.osmocom.org:29418/onomondo-eim refs/changes/39/43939/1

diff --git a/contrib/make_eim_certificate.sh b/contrib/make_eim_certificate.sh
index ab25cbe..0fca310 100755
--- a/contrib/make_eim_certificate.sh
+++ b/contrib/make_eim_certificate.sh
@@ -1,13 +1,31 @@
 #!/bin/bash
 
-# This script is to illustrate how an eIM certificate could be generated using
-# openssl. See also: GSMA SGP.32, section 2.6.4.2
+# This script may be used to generate an eIM certificate, which can be used to
+# sign and verify eUICC packages (eCOs and PSMOs). The public key of the eIM
+# certificate will be part of the eIM configuration, which is loaded onto the
+# eUCCC. The private key is used by the eIM to sign the eUICC packages before
+# sending them to the eUICC. (See also: GSMA SGP.32, section 2.6.4.2)
+
+C="EC"
+ST="ExampleState"
+L="ExampleLocality"
+O="ExampleOrganization"
+OU="ExampleOrganizationalUnit"
+CN="ExampeCommonName"
+
+DAYS=365000 #1000 Years
+OUTPUT_DIR=../priv/
 
 #prime256v1: X9.62/SECG curve over a 256 bit prime field
-openssl ecparam -genkey -name prime256v1 -noout -out sample_eim_cert_nist.key
-openssl req -key sample_eim_cert_nist.key -new -x509 -days 36500 -out sample_eim_cert_nist.crt
+openssl ecparam -name prime256v1 -genkey -noout -out sample_eim_cert_nist.key
+openssl req -x509 -key sample_eim_cert_nist.key -out sample_eim_cert_nist.crt \
+	-sha256 -days $DAYS -nodes -subj "/C=$C/ST=$ST/L=$L/O=$O/OU=$OU/CN=$CN"
 
 #brainpoolP256r1: RFC 5639 curve over a 256 bit prime field
-openssl ecparam -genkey -name brainpoolP256r1 -noout -out sample_eim_cert_brainpool.key
-openssl req -key sample_eim_cert_brainpool.key -new -x509 -days 36500 -out sample_eim_cert_brainpool.crt
+openssl ecparam -name brainpoolP256r1 -genkey -noout -out sample_eim_cert_brainpool.key
+openssl req -x509 -key sample_eim_cert_brainpool.key -out sample_eim_cert_brainpool.crt \
+	-sha256 -days $DAYS -nodes -subj "/C=$C/ST=$ST/L=$L/O=$O/OU=$OU/CN=$CN"
 
+#move certificates to output directory
+mv ./*.key $OUTPUT_DIR
+mv ./*.crt $OUTPUT_DIR
diff --git a/priv/sample_eim_cert_brainpool.crt b/priv/sample_eim_cert_brainpool.crt
index 541d9e4..6ae4825 100644
--- a/priv/sample_eim_cert_brainpool.crt
+++ b/priv/sample_eim_cert_brainpool.crt
@@ -1,13 +1,16 @@
 -----BEGIN CERTIFICATE-----
-MIIB4jCCAYigAwIBAgIUWIrJWeBmzulu5yt5ZHLGw6s5K/gwCgYIKoZIzj0EAwIw
-RTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoMGElu
-dGVybmV0IFdpZGdpdHMgUHR5IEx0ZDAgFw0yNDA1MjIxMTEwNTZaGA8yMTI0MDQy
-ODExMTA1NlowRTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAf
-BgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDBaMBQGByqGSM49AgEGCSsk
-AwMCCAEBBwNCAASW2IBLRkBSZlg9nl6H4zps3z2HVfaahPVAXjfnP3bkYwXxaOyQ
-zEnPFRYeq9uECTdj7tHWX7g8imqZq7N+86Sdo1MwUTAdBgNVHQ4EFgQUF0w8WS6N
-x8qe1jwd/jxdg11lBSIwHwYDVR0jBBgwFoAUF0w8WS6Nx8qe1jwd/jxdg11lBSIw
-DwYDVR0TAQH/BAUwAwEB/zAKBggqhkjOPQQDAgNIADBFAiBXmCDELWMTJN47FB82
-IpIqx2nFsZI/gJ12njrXBOzi/QIhAIyuRef27bLlFH6EWa8kxAyLpevJ4OZvPs95
-lFJzbFfq
+MIICjzCCAjagAwIBAgIUAaOfZ6nHXz6Lnts4eOp/q5RpBFQwCgYIKoZIzj0EAwIw
+gZsxCzAJBgNVBAYTAkVDMRUwEwYDVQQIDAxFeGFtcGxlU3RhdGUxGDAWBgNVBAcM
+D0V4YW1wbGVMb2NhbGl0eTEcMBoGA1UECgwTRXhhbXBsZU9yZ2FuaXphdGlvbjEi
+MCAGA1UECwwZRXhhbXBsZU9yZ2FuaXphdGlvbmFsVW5pdDEZMBcGA1UEAwwQRXhh
+bXBlQ29tbW9uTmFtZTAgFw0yNjEwMjExMTI5MjBaGA8zMDI2MDIyMTExMjkyMFow
+gZsxCzAJBgNVBAYTAkVDMRUwEwYDVQQIDAxFeGFtcGxlU3RhdGUxGDAWBgNVBAcM
+D0V4YW1wbGVMb2NhbGl0eTEcMBoGA1UECgwTRXhhbXBsZU9yZ2FuaXphdGlvbjEi
+MCAGA1UECwwZRXhhbXBsZU9yZ2FuaXphdGlvbmFsVW5pdDEZMBcGA1UEAwwQRXhh
+bXBlQ29tbW9uTmFtZTBaMBQGByqGSM49AgEGCSskAwMCCAEBBwNCAAQylzPTz26D
+cdaCzZWucNVFv1riwAqVfhpREWdh3DYSsqPjzMrWkBkbLFWP/k1myKwMANE47OMd
+HX99XNq1OKzWo1MwUTAdBgNVHQ4EFgQUDVHVtDjsh4mYKDfpoZhyFCE/St8wHwYD
+VR0jBBgwFoAUDVHVtDjsh4mYKDfpoZhyFCE/St8wDwYDVR0TAQH/BAUwAwEB/zAK
+BggqhkjOPQQDAgNHADBEAiBv0SCPh+kO+4Jrn+2fYUsPUdLKie8QyGXNcofW7ET+
+PAIgWt0LaFWGPyt0GadJbjl5qAvqk01x/blax8Lv0WQTIj0=
 -----END CERTIFICATE-----
diff --git a/priv/sample_eim_cert_brainpool.key b/priv/sample_eim_cert_brainpool.key
index 2ff709c..4cce90b 100644
--- a/priv/sample_eim_cert_brainpool.key
+++ b/priv/sample_eim_cert_brainpool.key
@@ -1,5 +1,5 @@
 -----BEGIN EC PRIVATE KEY-----
-MHgCAQEEIIIH8O86z5njgI67CXMEVcIpw61LNJvYi7NW2mCka9lvoAsGCSskAwMC
-CAEBB6FEA0IABJbYgEtGQFJmWD2eXofjOmzfPYdV9pqE9UBeN+c/duRjBfFo7JDM
-Sc8VFh6r24QJN2Pu0dZfuDyKapmrs37zpJ0=
+MHgCAQEEIGVrvICVkI4aMeTuW/pBKADyW6mOdGglgAUoYszS61QyoAsGCSskAwMC
+CAEBB6FEA0IABDKXM9PPboNx1oLNla5w1UW/WuLACpV+GlERZ2HcNhKyo+PMytaQ
+GRssVY/+TWbIrAwA0Tjs4x0df31c2rU4rNY=
 -----END EC PRIVATE KEY-----
diff --git a/priv/sample_eim_cert_nist.crt b/priv/sample_eim_cert_nist.crt
index c6725ad..85f2959 100644
--- a/priv/sample_eim_cert_nist.crt
+++ b/priv/sample_eim_cert_nist.crt
@@ -1,13 +1,16 @@
 -----BEGIN CERTIFICATE-----
-MIIB4jCCAYegAwIBAgIUTGB6P8Y9qfPRcs3sOh1rF5qalk4wCgYIKoZIzj0EAwIw
-RTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoMGElu
-dGVybmV0IFdpZGdpdHMgUHR5IEx0ZDAgFw0yNDA1MjIxMTEwNTVaGA8yMTI0MDQy
-ODExMTA1NVowRTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAf
-BgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDBZMBMGByqGSM49AgEGCCqG
-SM49AwEHA0IABP5YSm9FBFlXSuyhldAplzf3TIm6LTbfkobsJdlzA3oPunDRTfPh
-99CjBeV7lbcxxN4hjS1/nyIRPtXRjC493xyjUzBRMB0GA1UdDgQWBBSuLb4g6A1R
-7Yj+arQrJbcEJEB9djAfBgNVHSMEGDAWgBSuLb4g6A1R7Yj+arQrJbcEJEB9djAP
-BgNVHRMBAf8EBTADAQH/MAoGCCqGSM49BAMCA0kAMEYCIQDPDDvfcV0F/f+JPg0j
-tmNNXH7CY91XEAcjKMWJmYJjdwIhAIfF6YbEcAIyY5129StjAB/xtXAS4JgBHok1
-o3NsXrXx
+MIICkDCCAjWgAwIBAgIUWJ4+3BbLpKI8kv+deHlrDNnP6aowCgYIKoZIzj0EAwIw
+gZsxCzAJBgNVBAYTAkVDMRUwEwYDVQQIDAxFeGFtcGxlU3RhdGUxGDAWBgNVBAcM
+D0V4YW1wbGVMb2NhbGl0eTEcMBoGA1UECgwTRXhhbXBsZU9yZ2FuaXphdGlvbjEi
+MCAGA1UECwwZRXhhbXBsZU9yZ2FuaXphdGlvbmFsVW5pdDEZMBcGA1UEAwwQRXhh
+bXBlQ29tbW9uTmFtZTAgFw0yNjEwMjExMTI5MjBaGA8zMDI2MDIyMTExMjkyMFow
+gZsxCzAJBgNVBAYTAkVDMRUwEwYDVQQIDAxFeGFtcGxlU3RhdGUxGDAWBgNVBAcM
+D0V4YW1wbGVMb2NhbGl0eTEcMBoGA1UECgwTRXhhbXBsZU9yZ2FuaXphdGlvbjEi
+MCAGA1UECwwZRXhhbXBsZU9yZ2FuaXphdGlvbmFsVW5pdDEZMBcGA1UEAwwQRXhh
+bXBlQ29tbW9uTmFtZTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABELbNTAi0XTB
+jVFCOQwkVRXP2gi3FoQivnaun3qKaAo2g7q07EuFhe/Dc8hEXZDdq7BBunAfIkr0
+zp4Z1fCkUR6jUzBRMB0GA1UdDgQWBBTNOK98JKC5SENja2a3tncCl9gpnDAfBgNV
+HSMEGDAWgBTNOK98JKC5SENja2a3tncCl9gpnDAPBgNVHRMBAf8EBTADAQH/MAoG
+CCqGSM49BAMCA0kAMEYCIQDgXoYoqrZn5ood8iXPdpnrYFw2Cygu78z1/Byax4FI
+QQIhAN9FDkGw/ioUgFizGYtXQJZXRSM3V1vvtehbDS2MSW3R
 -----END CERTIFICATE-----
diff --git a/priv/sample_eim_cert_nist.key b/priv/sample_eim_cert_nist.key
index 119cf81..07440f4 100644
--- a/priv/sample_eim_cert_nist.key
+++ b/priv/sample_eim_cert_nist.key
@@ -1,5 +1,5 @@
 -----BEGIN EC PRIVATE KEY-----
-MHcCAQEEIJTota/YsWhFhwHqEcDiFhTN+V/oRjUQNmF3qI0RPeFLoAoGCCqGSM49
-AwEHoUQDQgAE/lhKb0UEWVdK7KGV0CmXN/dMibotNt+Shuwl2XMDeg+6cNFN8+H3
-0KMF5XuVtzHE3iGNLX+fIhE+1dGMLj3fHA==
+MHcCAQEEIImxzoQUnpvWsfoYQQpv8W6Dnj3v2Bk7BXR6nnV0uePGoAoGCCqGSM49
+AwEHoUQDQgAEQts1MCLRdMGNUUI5DCRVFc/aCLcWhCK+dq6feopoCjaDurTsS4WF
+78NzyERdkN2rsEG6cB8iSvTOnhnV8KRRHg==
 -----END EC PRIVATE KEY-----

To view, visit change 43939. To unsubscribe, or for help writing mail filters, visit settings.