Ashin Walpola
0e9525162d
obu-firmware builds against vanetza-idf from microbu-esp32c5/external, but that tree was gitignored, so a clone of this repository could not build the firmware it ships. It is now committed here as ordinary files in its own folder, microbu-esp32c5/: the colleague's commit cf4b99f plus the V2X2MAP bridge's signature verification (--trust) used on the bench. Nothing is fetched from or pushed to the colleague's repository; this repository and its remotes carry everything. The folder's own .gitignore keeps build output, downloaded components and private key material out, as it did there; the committed file set is identical to that repository's tracked files. The ESP32-C5 is still flashed from obu-firmware/, which only takes vanetza-idf from microbu-esp32c5/, so the two stay separate folders. FLASHING.md says how to take a newer version of the colleague's tree (copy it over the folder, rebuild, test, commit).
48 lines
2.1 KiB
Markdown
48 lines
2.1 KiB
Markdown
# Certify
|
|
|
|
*Certify* is a tool to create and view certificates and can be used to set up a test PKI for secured V2X communication based on TS 103 097 v1.2.1.
|
|
|
|
## Installation
|
|
|
|
You need to enable building this tool explicitly.
|
|
Run `cmake -D BUILD_CERTIFY=ON ..` in your build directory and rebuild Vanetza.
|
|
You should be able to find `bin/certify` in your build directory afterwards.
|
|
|
|
## PKI Setup
|
|
|
|
The following section describe how to setup a test PKI.
|
|
We will generate a root certificate, an authorization authority certificate and an authorization ticket.
|
|
|
|
### Generating Keys
|
|
|
|
New private keys can be generated using `bin/certify generate-key root.key`.
|
|
The corresponding public key can be extracted using `bin/certify extract-public-key --private-key root.key root.pub`, but this step usually isn't required.
|
|
|
|
Please generate a `root.key` for the root certificate, a `aa.key` for the authorization authority and a `ticket.key` for the authorization ticket.
|
|
|
|
### Generating Root Certificates
|
|
|
|
A root certificate can be generated using `bin/certify generate-root --subject-key root.key root.cert`.
|
|
|
|
### Generating Authorization Authorities
|
|
|
|
An authorization authority certificate can be generated using `bin/certify generate-aa --sign-key root.key --sign-cert root.cert --subject-key aa.key aa.cert`.
|
|
|
|
### Generating Authorization Tickets
|
|
|
|
An authorization ticket can be generated using `bin/certify generate-ticket --sign-key aa.key --sign-cert aa.cert --subject-key ticket.key ticket.cert`.
|
|
|
|
If you're generating a certificate for real V2X hardware, it will likely use a hardware security module (HSM), which will only expose the public key.
|
|
You can export the given public key to a file and use `--subject-key` also with public keys.
|
|
The public key needs to be encoded according to the rules specified by ETSI in TS 103 097 v1.2.1.
|
|
|
|
## Other Options
|
|
|
|
This guide only uses the required options.
|
|
Further options may be available for certain commands.
|
|
Use `bin/certify <command> --help` for further information.
|
|
|
|
## Acknowledgement
|
|
|
|
This application has been initially developed [Niklas Keller](https://github.com/kelunik).
|