Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

How can we create a certificate with the following Extended Key Usage extension using OpenSSL?

Extended Key Usage extension, critical, with a purpose containing Developer ID Installer Package Code Signing (1.2.840.113635.100.4.13)

Apple's developer tool productsign requires the signing certificate to conform to the Installer Package Signing Certificate profile described in Certification Authority Certification Practice Statement Developer ID (page 14 of 18).

I would like to sign our product preview releases with our own certificates, rather than those issued by Apple.

share|improve this question
    
Wouldn't that stop your users from running them? I was under the impression that all iDevices require apps to be signed by Apple in order to run. –  Polynomial Jul 31 '12 at 13:01
    
This certificate is for Mac OS X. So there are less constraints than on iOS devices. –  Graham Miln Jul 31 '12 at 13:13
    
Ah. Didn't know that. –  Polynomial Jul 31 '12 at 13:13
1  
If we can create this certificate, it will be interesting to see if Mac OS X accepts non-Apple Certificate Authority (CA) signed installers. I see no reason why a trusted certificate from a non-Apple CA should be refused. –  Graham Miln Jul 31 '12 at 13:15
1  
Thank you, but the steps listed in the article are to get an Apple signed certificate. I want to discover if a non-Apple Certificate Authority (CA) signed certificate - with the appropriate extension - is accepted; it should be but no-one yet knows for sure. –  Graham Miln Sep 1 '12 at 14:15
show 1 more comment

2 Answers

up vote 1 down vote accepted

A copy-paste documentation for myself. For more information about the certificate extensions, have a look at Apple Developer ID Certification Practice Statement.

  1. Create apple.conf with the following content:

    [ req ]
    distinguished_name = req_name
    prompt = no
    [ req_name ]
    CN = my-test-installer
    [ extensions ]
    basicConstraints=critical,CA:false
    keyUsage=critical,digitalSignature
    extendedKeyUsage=critical,1.2.840.113635.100.4.13
    1.2.840.113635.100.6.1.14=critical,DER:0500
    
  2. Generate the key:

    openssl genrsa -out apple.key 2048

  3. Create the self-signed certificate:

    openssl req -x509 -new -config apple.conf -nodes \
    -key apple.key -extensions extensions -sha256 -out apple.crt
    
  4. Wrap the key and certificate into PKCS#12:

    openssl pkcs12 -export -inkey apple.key -in apple.crt -out apple.p12

  5. Import it into keychain with open apple.p12. Select "Always trust".

  6. Use the certificate to sign installers:

    productbuild --sign "my-test-installer" ...

share|improve this answer
1  
Do not forget to add a pass phrase to your key to mitigate the damage in case of key compromise. You can safely add or edit the pass phrase of an existing private key using openssl rsa -in apple.key -des3 -out apple-passphrase-protected.key && mv apple-passphrase-protected.key apple.key –  Rob W Jan 1 at 11:47
    
This should be a purely test scenario, where the key compromise should have close to zero impact in real life. In fact, the key should be deleted after generation once it is imported to keychain (better do all of this in a temporary folder and delete it when done) , as keychain shall "protect" (cough-cough, hello NSA) the key afterwards. Also, if using OpenSSL, -aes256 would be better than -des3, in theory at least. –  martin Jan 1 at 15:42
add comment

To add extensions in an issued certificate with OpenSSL, you must use a "configuration file" which contains the extension value. See this page for a description (there is a section about the Extended Key Usage extension). The configuration file is then used with the openssl ca command, with the -config and -extensions command-line flags (see the documentation).

share|improve this answer
    
I have not tried, I just read the doc. The "quad four numeric" is an Object Identifier (OID) and it may have more (or less) than 4 numbers; the Extended Key Usage extension contains a set of OID, and the Apple documentation says that it should contain the one they give. –  Thomas Pornin Jan 14 '13 at 12:19
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.