5.3 Creating RSA Signing Credentials
This application note does not go into the details of Public Key Infrastructure (PKI), but it introduces and describes the components necessary to perform a secure boot.
When performing PKI operations, the following important components must be obtained or
constructed ahead of time:
- RSA root key and certificate – used to sign signing certificates
- RSA signing key and certificate – used to sign images
Although not enforced by the tools used by U-Boot for signing images, certificates used for
signing code should be different from certificates used to sign certificates. For this
application note, we will generate a single root CA certificate and a single code-signing
certificate. Generally, a root CA certificate is created on a machine that is not connected to
a network. The following two items are created:
- CA private key
- CA certificate
Private keys must always remain confidential. Any individual with access to a private key can forge and sign certificates that will be accepted as authentic.