5.7 Sign the Certificate Request

$ openssl x509 -req -in samkey.csr -days 365 -CA cacert.crt -CAkey cacert.key -CAcreateserial -out samkey.crt -extfile openssl.cnf -extensions code_sign

This command uses the previously created CA certificate to sign the samkey.csr certificate request. U-Boot requires that the key and the certificate have identical filenames, differing only in their extensions. The private key file must use the .key extension, and the certificate file must use the .crt extension. To successfully sign the certificate request, the signer must enter the passphrase for the CA private key.

$ openssl x509 -req -in samkey.csr -days 365 -CA cacert.crt -CAkey cacert.key -CAcreateserial
-out samkey.crt -extfile openssl.cnf -extensions code_sign 
Certificate request self-signature ok
subject=C = US, ST = Arizona, L = Chandler, O = Microchip Technology, OU = MPU32 Applications, CN = U-Boot Image Signing
Enter pass phrase for cacert.key: