daan/runelab-ca
1
0
Fork 0
Code Issues Activity

Document how to sign on macOS

Browse source
This commit is contained in:
Daan Boerlage 2024-02-12 21:01:22 +01:00
parent 65a7f692d2
commit ec1b0cccb9
Signed by: daan
GPG key ID: FCE070E1E4956606
1 changed files with 17 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

21
readme.md
View file

@ -17,8 +17,24 @@ The setup was mostly done by following these two guides:
### Required Software ### Required Software
* OpenSSL * OpenSSL
* libp11
* [YKCS11](https://developers.yubico.com/yubico-piv-tool/YKCS11/) * [YKCS11](https://developers.yubico.com/yubico-piv-tool/YKCS11/)
* [AUR Link](https://aur.archlinux.org/packages/ykcs11-p11-kit-module) *[AUR Link](https://aur.archlinux.org/packages/ykcs11-p11-kit-module)
**macOS note:** openssl installed via homebrew does not pickup on libp11, you need to manually copy the pkcs11 library (update the versions):
`cp /opt/homebrew/Cellar/libp11/0.4.12/lib/engines-3/pkcs11.dylib /opt/homebrew/Cellar/openssl@3/3.2.1/lib/engines-3/`
### Environment Variables
These must be set for all openssl operations.
Linux:
- `PKCS11_MODULE_PATH="/usr/lib/libykcs11.so"`
macOS:
- `PKCS11_MODULE_PATH="/opt/homebrew/lib/libykcs11.dylib"`
### Generating the Root ### Generating the Root
@ -31,9 +47,6 @@ echo 1000 > serial
echo 1000 > crlnumber echo 1000 > crlnumber
# OpenSSL CA config file # OpenSSL CA config file
vim config/ca.conf vim config/ca.conf
# Setting up PKCS11
export PKCS11_MODULE_PATH="/usr/lib/libykcs11.so"
export MODULE_PATH="/usr/lib/libykcs11.so"
# Generating the root # Generating the root
openssl req -new -x509 -days 8000 -sha256 -extensions v3_ca -engine pkcs11 -keyform engine -key "pkcs11:object=Private key for PIV Authentication" -out certs/root.ca.cert.pem openssl req -new -x509 -days 8000 -sha256 -extensions v3_ca -engine pkcs11 -keyform engine -key "pkcs11:object=Private key for PIV Authentication" -out certs/root.ca.cert.pem
``` ```