| author | Santosh V Patil <santosh.v.patil@nokia.com> |
| Fri, 13 Nov 2009 15:59:20 +0530 | |
| branch | RCL_1 |
| changeset 22 | 1440dc310db1 |
| parent 0 | 2c201484c85f |
| child 8 | 35751d3474b7 |
| permissions | -rw-r--r-- |
|
0
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
1 |
Title: Building Certificate Store |
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
2 |
Owner: Gleb Dolgich |
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
3 |
Contributors: Xavier Leclercq, Gleb Dolgich |
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
4 |
Copyright (C) 2003 Symbian Limited. All rights reserved. |
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
5 |
================================================================================ |
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
6 |
|
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
7 |
Purpose |
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
8 |
------- |
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
9 |
|
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
10 |
This document describes how to build CACerts.dat (certificate store) and |
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
11 |
certclients.dat (certificate client applications) files. These files are stored |
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
12 |
on a device in c:\system\data\ directory. They are necessary for Software |
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
13 |
Install and SSL/TLS. |
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
14 |
|
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
15 |
Certificates and trusters |
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
16 |
------------------------- |
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
17 |
|
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
18 |
Every certificate stored in CACerts.dat has a set of UIDs associated with it, |
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
19 |
each UID marking the certificate as good for a particular purpose (application). |
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
20 |
Currently the following applications/UIDs are defined: |
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
21 |
|
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
22 |
- SW Install (268452523, or 0x100042AB)--certificate is suitable for software |
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
23 |
install (SIS files); |
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
24 |
- SW Install OCSP Signing (268478646, or 0x1000A8B6)--certificate is suitable |
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
25 |
for OCSP checking (SIS files); |
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
26 |
- MIDlet Installation (270506792, or 0x101F9B28)--certificate is good for Java |
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
27 |
MIDlet installation, which includes OCSP checking; |
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
28 |
- Server Authentication (268441661, or 0x1000183D)--certificate is suitable for |
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
29 |
SSL/TLS server authentication. |
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
30 |
|
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
31 |
These UIDs are stored in certclients.dat file. Once certclients.dat is in |
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
32 |
c:\system\data on the device, the Certificates Control Panel applet allows |
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
33 |
manual assignment of applications to each certificate. |
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
34 |
|
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
35 |
Files needed |
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
36 |
------------ |
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
37 |
|
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
38 |
The following files are needed to build a certificate store: |
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
39 |
|
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
40 |
- T_CERTSTORE.EXE test harness, which is located in security/certman/tcertstore; |
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
41 |
build it from security/certman/group; |
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
42 |
- bldcertstore.txt: test script located in security/certman/tcertstore/scripts; |
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
43 |
you can modify it depending on which certificates/applications you want |
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
44 |
included in the store. This script is exported into device's |
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
45 |
c:\tcertstore\scripts. |
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
46 |
|
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
47 |
The following certificates are used for running tests: |
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
48 |
|
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
49 |
- cacert.crt "TestCA"--SSL server CA certificate (self-signed) |
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
50 |
- thawtetest.crt "Thawte Root"--SW Install certificate |
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
51 |
- TOCSP-Root5-RSA.cer--SW Install and MIDlet Installation |
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
52 |
- TOCSP-Signing5-RSA.cer--OCSP Signing |
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
53 |
|
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
54 |
These certificates are copied into c:\tappinst\certs\ directory on the device. |
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
55 |
|
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
56 |
Building the store |
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
57 |
------------------ |
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
58 |
|
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
59 |
To build a certificate store, perform the following steps: |
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
60 |
|
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
61 |
1. Build the T_CERTSTORE test harness and export test files for appinst and |
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
62 |
certman. |
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
63 |
|
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
64 |
2. Go to the appropriate build directory (udeb or urel) and run the following |
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
65 |
command: |
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
66 |
|
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
67 |
t_certstore c:\tcertman\scripts\bldcertstore.txt c:\bldcertstore.log |
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
68 |
|
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
69 |
This will build c:\system\data\cacerts.dat and c:\system\data\certclients.dat |
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
70 |
with test certificates. If you need to add your own certificates, modify the |
|
2c201484c85f
Move the Security package to EPL, and add the implementations of the cryptographic algorithms
Santosh Patil <santosh.v.patil@nokia.com>
parents:
diff
changeset
|
71 |
bldcertstore.txt script accordingly. |