48 lines
2.1 KiB
Markdown
48 lines
2.1 KiB
Markdown
|
# Certify
|
||
|
|
|
||
|
|
*Certify* is a tool to create and view certificates and can be used to set up a test PKI for secured V2X communication based on TS 103 097 v1.2.1.
|
||
|
|
|
||
|
|
## Installation
|
||
|
|
|
||
|
|
You need to enable building this tool explicitly.
|
||
|
|
Run `cmake -D BUILD_CERTIFY=ON ..` in your build directory and rebuild Vanetza.
|
||
|
|
You should be able to find `bin/certify` in your build directory afterwards.
|
||
|
|
|
||
|
|
## PKI Setup
|
||
|
|
|
||
|
|
The following section describe how to setup a test PKI.
|
||
|
|
We will generate a root certificate, an authorization authority certificate and an authorization ticket.
|
||
|
|
|
||
|
|
### Generating Keys
|
||
|
|
|
||
|
|
New private keys can be generated using `bin/certify generate-key root.key`.
|
||
|
|
The corresponding public key can be extracted using `bin/certify extract-public-key --private-key root.key root.pub`, but this step usually isn't required.
|
||
|
|
|
||
|
|
Please generate a `root.key` for the root certificate, a `aa.key` for the authorization authority and a `ticket.key` for the authorization ticket.
|
||
|
|
|
||
|
|
### Generating Root Certificates
|
||
|
|
|
||
|
|
A root certificate can be generated using `bin/certify generate-root --subject-key root.key root.cert`.
|
||
|
|
|
||
|
|
### Generating Authorization Authorities
|
||
|
|
|
||
|
|
An authorization authority certificate can be generated using `bin/certify generate-aa --sign-key root.key --sign-cert root.cert --subject-key aa.key aa.cert`.
|
||
|
|
|
||
|
|
### Generating Authorization Tickets
|
||
|
|
|
||
|
|
An authorization ticket can be generated using `bin/certify generate-ticket --sign-key aa.key --sign-cert aa.cert --subject-key ticket.key ticket.cert`.
|
||
|
|
|
||
|
|
If you're generating a certificate for real V2X hardware, it will likely use a hardware security module (HSM), which will only expose the public key.
|
||
|
|
You can export the given public key to a file and use `--subject-key` also with public keys.
|
||
|
|
The public key needs to be encoded according to the rules specified by ETSI in TS 103 097 v1.2.1.
|
||
|
|
|
||
|
|
## Other Options
|
||
|
|
|
||
|
|
This guide only uses the required options.
|
||
|
|
Further options may be available for certain commands.
|
||
|
|
Use `bin/certify <command> --help` for further information.
|
||
|
|
|
||
|
|
## Acknowledgement
|
||
|
|
|
||
|
|
This application has been initially developed [Niklas Keller](https://github.com/kelunik).
|