<?xml version="1.0" encoding="utf-8"?>
<!-- Copyright (c) 2007-2010 Nokia Corporation and/or its subsidiary(-ies) All rights reserved. -->
<!-- This component and the accompanying materials are made available under the terms of the License 
"Eclipse Public License v1.0" which accompanies this distribution, 
and is available at the URL "http://www.eclipse.org/legal/epl-v10.html". -->
<!-- Initial Contributors:
    Nokia Corporation - initial contribution.
Contributors: 
-->
<!DOCTYPE concept
  PUBLIC "-//OASIS//DTD DITA Concept//EN" "concept.dtd">
<concept id="GUID-DF4A992B-E03B-57F5-9D5B-1C112FC16544" xml:lang="en"><title>Example
for Creating a Default Certificate Store</title><prolog><metadata><keywords/></metadata></prolog><conbody>
<p>This section provides details on how the <codeph>certtool</codeph> can
be used to create a default certstore to be used in a new device. For instance,
a device creator would want to create a default certstore to be shipped with
every device. The default certstore will most likely contain some default
root certificates. </p>
<p>User certificates might be added as well, for instance a device creator
might add a user certificate to allow a particular device to authenticate
itself during a SSL/TLS connection. In this manner the server will be sure
it is interacting with a certain device model. </p>
<p><b>The internal representation of a certificate store </b> </p>
<p>The contents of a certificate store are preserved in two files, CAcerts.dat
and certclients.dat. An actual device would store the default files in ROM,
from there the files will be copied to RAM when the certstore is first used.
The original ROM files are copied to RAM only if the files are not there already. </p>
<p>The paths where the files are stored in ROM are: </p>
<ul>
<li id="GUID-A8FD8FBB-D3E1-51CB-8851-0F3E93875BA6"><p> <filepath>z:\System\Data\CACerts.dat</filepath>  </p> </li>
<li id="GUID-840018D2-0200-5276-9696-C6BDA6AD75B0"><p> <filepath>z:\System\Data\certclients.dat</filepath>  </p> </li>
</ul>
<p>The paths where the files are stored in RAM are: </p>
<ul>
<li id="GUID-6C0E43B6-5C5F-5DC8-9030-09376F3E86AF"><p> <filepath>c:\System\Data\CACerts.dat</filepath>  </p> </li>
<li id="GUID-999CFC77-565B-579A-A64E-2AD9B10B013A"><p> <filepath>c:\System\Data\certclients.dat </filepath>  </p> </li>
</ul>
<p>The full paths for the emulator in ROM are: </p>
<ul>
<li id="GUID-26756A2A-1148-531D-AFCD-A7C101C6C191"><p> <filepath>\epoc32\release\(platform)\(build)\z\
             System\Data\CACerts.dat</filepath>  </p> </li>
<li id="GUID-25213156-B9D1-5A9F-BD4E-26B026D02C6A"><p> <filepath>\epoc32\release\(platform)\(
build)\z\              System\Data\certclients.dat </filepath>  </p> </li>
</ul>
<p>The full paths for the emulator in RAM are: </p>
<ul>
<li id="GUID-3A4B028D-A8B4-5B1A-8867-B08A3A48CBB7"><p> <filepath>\epoc32\(platform)\c\
System\Data\CACerts.dat</filepath>  </p> </li>
<li id="GUID-021DCED1-D59D-5CDC-AD6B-ED3BD4D0EBF4"><p> <filepath>\epoc32\(platform)\c\
System\Data\certclients.dat </filepath>  </p> </li>
</ul>
<p>where (platform) stands for wins, winscw, armi, etc. and (build) for either
udeb or urel. </p>
<p>If the files are not present in RAM, when the certstore is first used the
files are copied from ROM. If the files are not present at all, new empty
ones will be created, this event should not occur in production devices. </p>
<p><b>Generating a default certificate store </b> </p>
<p>You can generate a default certificate store (the two files, CACerts.dat
and certclients.dat) using <codeph>certtool</codeph> and the emulator. You
can then take the resulting CACerts.dat and certclients.dat files and insert
them in the final rom. </p>
<p>To have a certificate store containing two certificates <filepath>Class1PrimaryCA.cer</filepath> and <filepath>serverca.cer</filepath>,
the first step is to copy them to the emulator c drive. Copy them to a location,
say <filepath>\epoc32\(platform)\c</filepath>. </p>
<p>Use <codeph>certtool</codeph> to import the two certificates. Start the
eshell: <filepath>\epoc32\release\(platform)\(build)\eshell.exe</filepath>. </p>
<p>From the shell, import the certificates: </p>
<p><userinput>certtool –label “Class 1” –import c:\Class1PrimaryCA.cer</userinput> </p>
<p><userinput>certtool –label “Server CA” –import c:\serverca.cer</userinput> </p>
<p>The next step is to set the applicability of the certificates. If the “Class
1” certificate is to be trusted for software installation, SSL/TLS and OCSP,
while the “Server CA” must be trusted for software installation only, you
can then use <codeph>certtool</codeph> in the following manner: </p>
<p><userinput>certtool -setapps –apps SWInstall SSL/TLS SWInstallOCSP “Class
1”</userinput> </p>
<p><userinput>certtool -setapps –apps SWInstall “Server CA”</userinput> </p>
</conbody><related-links>
<link href="GUID-4462E8C8-CF27-5F3B-ACE3-4213DA6C377C.dita"><linktext>certtool
Reference</linktext></link>
</related-links></concept>