Changes between Version 27 and Version 28 of BuildingUsingGenericBuildsystem

Timestamp:

04/30/12 14:40:51 (12 years ago)

Author:

Samuli Seppänen

Comment:

--

BuildingUsingGenericBuildsystem

@@ -305 +305 @@
 
 {{{
-> makecert -r -pe -n "CN=OpenVPN project test CA" -ss CA -sr CurrentUser -a sha1 -sky signature -sv openvpntestca.pvk openvpntestca.cer
+> makecert -r -pe -n "CN=My organization test CA" -ss CA -sr CurrentUser -a sha1 -sky signature -sv testca.pvk testca.cer
 }}}
 
@@ -311 +311 @@
 
 {{{
-> certutil -user -addstore Root openvpntestca.cer
+> certutil -user -addstore Root testca.cer
 }}}
 
@@ -317 +317 @@
 
 {{{
-> makecert -pe -n "CN=OpenVPN community project" -a sha1 -sky signature -ic openvpntestca.cer -iv openvpntestca.pvk -sv openvpnproject.pvk openvpnproject.cer
-}}}
- 
+> makecert -pe -n "CN=My organization" -a sha1 -sky signature -ic testca.cer -iv testca.pvk -sv testspc.pvk testspc.cer
+}}}
+
+After all of this is done, you should have four files in the current directory, e.g.
+
+ * testca.cer
+ * testca.pvk
+ * testspc.cer
+ * testspc.pvk
+
+== Converting the certificate ==
+
+The next step is to convert these into a format [http://sourceforge.net/projects/osslsigncode/ osslsigncode] can understand. As described [http://sourceforge.net/projects/osslsigncode/forums/forum/438747/topic/1706587 here], first you need to convert the actual code-signing certificate into p7b format. One way to do that is described below:
+
+ * Navigate to the directory with the generated certificates using Windows Explorer
+ * Right-click on the code-signing certificate file (e.g. ''testspc.cer'')
+ * Select "Install certificate" and place the certificate into the certificate store of your choosing (e.g. ''Personal'')
+
+Next you need to export the just imported certificate in a different format:
+
+ * Launch ''mmc.exe''
+ * Add the ''Certificates'' snap-in
+ * Locate the ''My organization'' certificate you just installed using ''mmc.exe''
+ * Double click on the certificate
+ * Select ''Details'' tab
+ * Click on ''Copy to File'' and export the certificate in p7b format
+
+== Converting the private key ==
+
+As described [http://sourceforge.net/projects/osslsigncode/forums/forum/438747/topic/1706587 here], you will also need to convert the private key. Because it's in a proprietary [http://www.drh-consultancy.demon.co.uk/pvk.html PVK] format, you need to use the [http://www.drh-consultancy.demon.co.uk/pvk.html pvk.exe] tool on the Windows box to convert it into PEM format:
+
+{{{
+> pvk -in testspc.pvk -nocrypt -out testspc.pem
+}}}
+
+This will prompt you for the private key's password. After this, you can use [http://openssl.org/ OpenSSL] to convert the PEM file into DER format, which ''osslsigncode'' requires. Below we use ''openssl'' on Linux for the job; adapt as necessary for Windows (i.e. ''openssl'' -> ''openssl.exe'':
+
+{{{
+$ openssl rsa -in testspc.pem -inform PEM -out testpsc.der -outform DER
+}}}
+
+== Signing OpenVPN components ==
+
+At this point you should have these files:
+
+ * testca.cer: CA certificate
+ * testca.pvk: CA certificate's private key (in proprietary PVK format)
+ * testspc.cer: Code-signing certificate
+ * testspc.p7b: Code-signing certificate (in P7B format)
+ * testspc.pvk: Code-signing certificate's private key (in proprietary PVK format)
+ * testspc.pem: Code-signing certificate's private key (in PEM format)
+ * testpsc.der: Code-signing certificate's private key (in DER format)
+
+We can now sign whatever executables we want like this:
+
+{{{
+$ osslsigncode -spc testspc.p7b -key testspc.der -n "OpenVPN custom version" -i "http://company.domain.com" -in openvpn-2.3-alpha1-custom-install.exe -out openvpn-2.3-alpha1-custom-install-signed.exe
+}}}
+
+Next you can test the installer to see whether the ''Program Name'' and ''Verified publisher'' are correct. 
+
 = External links =