7.2.3 Create an RSA Public Key Infrastructure (PKI)

OpenSSL is required to generate private keys and signed certificates. Proceed as follows:

Create an OpenSSL extension file on a Linux® machine:

cat << END_OF_V3_EXT > v3.ext
basicConstraints=CA:FALSE
keyUsage = digitalSignature
extendedKeyUsage = codeSigning
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer
END_OF_V3_EXT

Enter the following commands in OpenSSL to generate private keys:
```
openssl genrsa -out ca_key.pem 4096
openssl genrsa -out sign_key.pem 4096
```
Enter the following command to generate a self-signed CA certificate (ca.crt):
```
openssl req -new -x509 -days 2922 -sha256 -key ca_key.pem -out root-ca.crt -set_serial 0x101
```

Enter the following commands to generate a CA-signed code-signing certificate (sign.crt):

openssl req -new -key sign_key.pem -sha256 -out sign.csr
openssl x509 -extfile v3.ext -req -in sign.csr -out signing-ca.crt -CA root-ca.crt -CAkey  ca_key.pem -sha256 -days 2922 -set_serial 0x1234

Convert CERT to DER on the Linux machine:

openssl x509 -in root-ca.crt -out root-ca.der -outform DER 
openssl x509 -in signing-ca.crt -out signing-ca.der -outform DER