[PATCH 4/4] Documentation/admin-guide/module-signing.rst: add openssl command option example for CodeSign EKU
flat view
STALE2064d
SUPERSEDED
From: Lee, Chun-Yi <hidden>
Date: 2021-02-22 06:45:00
Also in:
keyrings, lkml
Subsystem:
certificate handling, documentation, the rest · Maintainers:
David Howells, David Woodhouse, Jonathan Corbet, Linus Torvalds
Revision v4 of 12 in this series.
Revisions (12)
Add an openssl command option example for generating CodeSign extended key usage in X.509 when CONFIG_CHECK_CODESIGN_EKU is enabled. Signed-off-by: "Lee, Chun-Yi" <jlee@suse.com> --- Documentation/admin-guide/module-signing.rst | 6 ++++++ 1 file changed, 6 insertions(+)
diff --git a/Documentation/admin-guide/module-signing.rst b/Documentation/admin-guide/module-signing.rst
index 7d7c7c8a545c..b57b30c7125f 100644
--- a/Documentation/admin-guide/module-signing.rst
+++ b/Documentation/admin-guide/module-signing.rst@@ -170,6 +170,12 @@ generate the public/private key files:: -config x509.genkey -outform PEM -out kernel_key.pem \ -keyout kernel_key.pem +When ``CONFIG_CHECK_CODESIGN_EKU`` option be enabled, the following openssl +command option should be added for generating CodeSign extended key usage in +X.509:: + + -addext "extendedKeyUsage=codeSigning" + The full pathname for the resulting kernel_key.pem file can then be specified in the ``CONFIG_MODULE_SIG_KEY`` option, and the certificate and key therein will be used instead of an autogenerated keypair.
--
2.16.4