diff -r c11c717470d0 -r 11c66574c2a2 cryptomgmtlibs/securitydocs/building-certstore.txt --- a/cryptomgmtlibs/securitydocs/building-certstore.txt Fri Apr 16 16:52:34 2010 +0300 +++ /dev/null Thu Jan 01 00:00:00 1970 +0000 @@ -1,71 +0,0 @@ -Title: Building Certificate Store -Owner: Gleb Dolgich -Contributors: Xavier Leclercq, Gleb Dolgich -Copyright (C) 2003 Symbian Limited. All rights reserved. -================================================================================ - -Purpose -------- - -This document describes how to build CACerts.dat (certificate store) and -certclients.dat (certificate client applications) files. These files are stored -on a device in c:\system\data\ directory. They are necessary for Software -Install and SSL/TLS. - -Certificates and trusters -------------------------- - -Every certificate stored in CACerts.dat has a set of UIDs associated with it, -each UID marking the certificate as good for a particular purpose (application). -Currently the following applications/UIDs are defined: - -- SW Install (268452523, or 0x100042AB)--certificate is suitable for software - install (SIS files); -- SW Install OCSP Signing (268478646, or 0x1000A8B6)--certificate is suitable - for OCSP checking (SIS files); -- MIDlet Installation (270506792, or 0x101F9B28)--certificate is good for Java - MIDlet installation, which includes OCSP checking; -- Server Authentication (268441661, or 0x1000183D)--certificate is suitable for - SSL/TLS server authentication. - -These UIDs are stored in certclients.dat file. Once certclients.dat is in -c:\system\data on the device, the Certificates Control Panel applet allows -manual assignment of applications to each certificate. - -Files needed ------------- - -The following files are needed to build a certificate store: - -- T_CERTSTORE.EXE test harness, which is located in security/certman/tcertstore; - build it from security/certman/group; -- bldcertstore.txt: test script located in security/certman/tcertstore/scripts; - you can modify it depending on which certificates/applications you want - included in the store. This script is exported into device's - c:\tcertstore\scripts. - -The following certificates are used for running tests: - -- cacert.crt "TestCA"--SSL server CA certificate (self-signed) -- thawtetest.crt "Thawte Root"--SW Install certificate -- TOCSP-Root5-RSA.cer--SW Install and MIDlet Installation -- TOCSP-Signing5-RSA.cer--OCSP Signing - -These certificates are copied into c:\tappinst\certs\ directory on the device. - -Building the store ------------------- - -To build a certificate store, perform the following steps: - -1. Build the T_CERTSTORE test harness and export test files for appinst and - certman. - -2. Go to the appropriate build directory (udeb or urel) and run the following - command: - - t_certstore c:\tcertman\scripts\bldcertstore.txt c:\bldcertstore.log - - This will build c:\system\data\cacerts.dat and c:\system\data\certclients.dat - with test certificates. If you need to add your own certificates, modify the - bldcertstore.txt script accordingly.