9

How can we create a certificate with the following Extended Key Usage extension using OpenSSL?

Extended Key Usage extension, critical, with a purpose containing Developer ID Installer Package Code Signing (1.2.840.113635.100.4.13)

Apple's developer tool productsign requires the signing certificate to conform to the Installer Package Signing Certificate profile described in Certification Authority Certification Practice Statement Developer ID (page 14 of 18).

I would like to sign our product preview releases with our own certificates, rather than those issued by Apple.

Improve this question
6
  • Wouldn't that stop your users from running them? I was under the impression that all iDevices require apps to be signed by Apple in order to run.
    – Polynomial
    Commented Jul 31, 2012 at 13:01
  • This certificate is for Mac OS X. So there are less constraints than on iOS devices.
    – Graham Miln
    Commented Jul 31, 2012 at 13:13
  • Ah. Didn't know that.
    – Polynomial
    Commented Jul 31, 2012 at 13:13
  • 1
    If we can create this certificate, it will be interesting to see if Mac OS X accepts non-Apple Certificate Authority (CA) signed installers. I see no reason why a trusted certificate from a non-Apple CA should be refused.
    – Graham Miln
    Commented Jul 31, 2012 at 13:15
  • 1
    Thank you, but the steps listed in the article are to get an Apple signed certificate. I want to discover if a non-Apple Certificate Authority (CA) signed certificate - with the appropriate extension - is accepted; it should be but no-one yet knows for sure.
    – Graham Miln
    Commented Sep 1, 2012 at 14:15

2 Answers 2

Reset to default
7

A copy-paste documentation for myself. For more information about the certificate extensions, have a look at Apple Developer ID Certification Practice Statement.

  1. Create apple.conf with the following content:

    [ req ]
distinguished_name = req_name
prompt = no
[ req_name ]
CN = my-test-installer
[ extensions ]
basicConstraints=critical,CA:false
keyUsage=critical,digitalSignature
extendedKeyUsage=critical,1.2.840.113635.100.4.13
1.2.840.113635.100.6.1.14=critical,DER:0500

  2. Generate the key:

    openssl genrsa -out apple.key 2048

  3. Create the self-signed certificate:

    openssl req -x509 -new -config apple.conf -nodes \
-key apple.key -extensions extensions -sha256 -out apple.crt

  4. Wrap the key and certificate into PKCS#12:

    openssl pkcs12 -export -inkey apple.key -in apple.crt -out apple.p12

  5. Import it into keychain with open apple.p12. Select "Always trust".

  6. Use the certificate to sign installers:

    productbuild --sign "my-test-installer" ...

Improve this answer
2
  • 1
    Do not forget to add a pass phrase to your key to mitigate the damage in case of key compromise. You can safely add or edit the pass phrase of an existing private key using openssl rsa -in apple.key -des3 -out apple-passphrase-protected.key && mv apple-passphrase-protected.key apple.key
    – Rob W
    Commented Jan 1, 2014 at 11:47
  • This should be a purely test scenario, where the key compromise should have close to zero impact in real life. In fact, the key should be deleted after generation once it is imported to keychain (better do all of this in a temporary folder and delete it when done) , as keychain shall "protect" (cough-cough, hello NSA) the key afterwards. Also, if using OpenSSL, -aes256 would be better than -des3, in theory at least.
    – martin
    Commented Jan 1, 2014 at 15:42
1

To add extensions in an issued certificate with OpenSSL, you must use a "configuration file" which contains the extension value. See this page for a description (there is a section about the Extended Key Usage extension). The configuration file is then used with the openssl ca command, with the -config and -extensions command-line flags (see the documentation).

Improve this answer
1
  • I have not tried, I just read the doc. The "quad four numeric" is an Object Identifier (OID) and it may have more (or less) than 4 numbers; the Extended Key Usage extension contains a set of OID, and the Apple documentation says that it should contain the one they give.
    – Thomas Pornin
    Commented Jan 14, 2013 at 12:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .