5.4 OpenSSL Configuration File

Before creating the certificates that will be used to sign the code images, the default OpenSSL configuration file should be modified. The modifications include changing the default values for the “distinguished name” found in certificates and creating “key usage” values for the code signing certificate.

The procedure is as follows:

  1. Create a directory to store the configuration file, keys and certificates:
    $ mkdir keys
$ cd keys
  2. Copy the default OpenSSL configuration:
    $ cp /etc/ssl/openssl.cnf .
  3. Edit the configuration file (openssl.cnf) to fill in the req_distinguished_name section with values that represent your organization:
    [ req_distinguished_name ]
countryName		= Country Name (2 letter code)
countryName_default= US 
countryName_min= 2
countryName_max= 2
stateOrProvinceName	= State or Province Name (full name)
stateOrProvinceName_default = Arizona
localityName		= Locality Name (eg, city)
localityName_default	= Chandler
0.organizationName= Organization Name (eg, company) 
0.organizationName_default = Microchip Technology
  4. Create a section named code_sign with the following fields:
    [ code_sign ] 
basicConstraints=CA:FALSE 
keyUsage = digitalSignature 
extendedKeyUsage = codeSigning 
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer