search

nsacyber / Hardware-and-Firmware-Security-Guidance

Guidance for the Spectre, Meltdown, Speculative Store Bypass, Rogue System Register Read, Lazy FP State Restore, Bounds Check Bypass Store, TLBleed, and L1TF/Foreshadow vulnerabilities as well as general hardware and firmware security guidance. #nsacyber
Other
753 stars 145 forks source link

Unable to load certificate #23

Closed Azaretdodo closed 1 year ago

Azaretdodo commented 1 year ago

hello,

after have launch your fourth line of command i happen one problem so i paste below the fourth line of command finally thank you in advance to help myself follow fully your github,

[liveuser@localhost-live ~]$ sudo openssl req -new -x509 -newkey rsa:2048 -subj "/CN=Custom KEK/" -keyout KEK.key -out KEK.crt -days 3650 -nodes -sha256
.......+..+......+.............+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*...+......+........+......+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*........+.....+....+......+........+...+...+....+...+.....+...+....+..+.+............+...+.........+...+..+......+............+.+.....+.+...+.....+.+......+.....+...+.+..+....+...+........+....+.........+.....+......+.+.........+...+...............+.....+.............+..+.+.....+......+......+..........+...............+...+...........+...+..................+.......+...+..+.+..+...................+.....+.+..+...+....+.....+.+..+......+....+...+.....+...............+....+...+......+.....+.+...+..................+........+......+.+...+...........+.+..+.......+..................+.....+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
.+.....+.......+..+.........+.......+...+......+.........+......+...+...+..+......+....+..+.........+............+....+...........+...+.+...+......+.........+......+..+....+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*....+.....+...+...+...+....+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*........+............+.....+....+...............+........+.+.....................+........+...+....+.....+......+.......+...+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
-----
[liveuser@localhost-live ~]$ sudo openssl req -new -x509 -newkey rsa:2048 -subj "/CN=Custom DBK/" -keyout DBK.key -out KEK.crt -days 3650 -nodes -sha256
...+.+...+..+.+.....+.........+.........+....+..+.+............+.....+.......+......+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*..+......+....+.................+....+.....+......+....+...........+.......+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*.......+.+...+..+..........+.........+...+......+......+........+.+..+..................+......+....+..+...+.......+.....+....+......+....................+.........+....+.....+....+.................+...+.............+..+.+......+...........+....+.....+....+...........+....+......+.........+..+...+....+...+...+.....+....+..+...+.............+..+..........+.....+...+...+.......+...+..+...+....+......+.........+..+...+..........+...+.........+.........+...........+......+...+....+............+...+..+......+...+......+.+..+.......+...+......+.....+....+............+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
..+.+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*.+..+...+....+.....+.............+........+.......+..+.........+....+...+...+..+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*........+...............+....+...+........+....+...+............+..+..........+........+.+......+........+.+...........+....+..+....+......+.....+....+.....................+...+......+...+..+......+...+..........+......+.....+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
-----
[liveuser@localhost-live ~]$ sudo openssl x509 -outform der -in KEK.crt -out KEK.cer
[liveuser@localhost-live ~]$ sudo openssl x509 -outform der -in DBK.crt -out DBK.cer
Could not open file or uri for loading certificate from DBK.crt
001E0323B37F0000:error:16000069:STORE routines:ossl_store_get0_loader_int:unregistered scheme:crypto/store/store_register.c:237:scheme=file
001E0323B37F0000:error:80000002:system library:file_open:No such file or directory:providers/implementations/storemgmt/file_store.c:267:calling stat(DBK.crt)
Unable to load certificate

regards.

Azaretdodo.

Harvester57 commented 1 year ago

You need to change the -out parameter on the second command, from -out KEK.crt to -out DBK.crt

Harvester57 commented 1 year ago

Please note that the correct is provided here: https://github.com/nsacyber/Hardware-and-Firmware-Security-Guidance/blob/master/secureboot/Linux.md#21-create-certificates-and-keys

Azaretdodo commented 1 year ago

I have type the good so you are in a dreams,

Azaretdodo.

From: Florian Stosse @.> Sent: Sunday, June 25, 2023 3:28:54 PM To: nsacyber/Hardware-and-Firmware-Security-Guidance @.> Cc: Azaretdodo @.>; Author @.> Subject: Re: [nsacyber/Hardware-and-Firmware-Security-Guidance] Unable to load certificate (Issue #23)

You need to change the -out parameter on the second command, from -out KEK.crt to -out DBK.crt

— Reply to this email directly, view it on GitHubhttps://github.com/nsacyber/Hardware-and-Firmware-Security-Guidance/issues/23#issuecomment-1606093726, or unsubscribehttps://github.com/notifications/unsubscribe-auth/AHJN3IOXATEJFFRWFXFV3RLXNA4JNANCNFSM6AAAAAAZTEX5YQ. You are receiving this because you authored the thread.Message ID: @.***>

Harvester57 commented 1 year ago

Check again the second command that you used, and please be more respectful with people trying to help you :)

Azaretdodo commented 1 year ago

I have the true you dream so i paste below the copy from the line of command finally you should be useful or you leave this list

@.** ~]$ sudo openssl req -new -x509 -newkey rsa:2048 -subj "/CN=Custom KEK/" -keyout KEK.key -out KEK.crt -days 3650 -nodes -sha256 .......+..+......+.............+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++...+......+........+......+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++........+.....+....+......+........+...+...+....+...+.....+...+....+..+.+............+...+.........+...+..+......+............+.+.....+.+...+.....+.+......+.....+...+.+..+....+...+........+....+.........+.....+......+.+.........+...+...............+.....+.............+..+.+.....+......+......+..........+...............+...+...........+...+..................+.......+...+..+.+..+...................+.....+.+..+...+....+.....+.+..+......+....+...+.....+...............+....+...+......+.....+.+...+..................+........+......+.+...+...........+.+..+.......+..................+.....+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ .+.....+.......+..+.........+.......+...+......+.........+......+...+...+..+......+....+..+.........+............+....+...........+...+.+...+......+.........+......+..+....+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++....+.....+...+...+...+....+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*........+............+.....+....+...............+........+.+.....................+........+...+....+.....+......+.......+...+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

@.** ~]$ sudo openssl req -new -x509 -newkey rsa:2048 -subj "/CN=Custom DBK/" -keyout DBK.key -out KEK.crt -days 3650 -nodes -sha256 ...+.+...+..+.+.....+.........+.........+....+..+.+............+.....+.......+......+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++..+......+....+.................+....+.....+......+....+...........+.......+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++.......+.+...+..+..........+.........+...+......+......+........+.+..+..................+......+....+..+...+.......+.....+....+......+....................+.........+....+.....+....+.................+...+.............+..+.+......+...........+....+.....+....+...........+....+......+.........+..+...+....+...+...+.....+....+..+...+.............+..+..........+.....+...+...+.......+...+..+...+....+......+.........+..+...+..........+...+.........+.........+...........+......+...+....+............+...+..+......+...+......+.+..+.......+...+......+.....+....+............+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ ..+.+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++.+..+...+....+.....+.............+........+.......+..+.........+....+...+...+..+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*........+...............+....+...+........+....+...+............+..+..........+........+.+......+........+.+...........+....+..+....+......+.....+....+.....................+...+......+...+..+......+...+..........+......+.....+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

@. ~]$ sudo openssl x509 -outform der -in KEK.crt -out KEK.cer @. ~]$ sudo openssl x509 -outform der -in DBK.crt -out DBK.cer Could not open file or uri for loading certificate from DBK.crt 001E0323B37F0000:error:16000069:STORE routines:ossl_store_get0_loader_int:unregistered scheme:crypto/store/store_register.c:237:scheme=file 001E0323B37F0000:error:80000002:system library:file_open:No such file or directory:providers/implementations/storemgmt/file_store.c:267:calling stat(DBK.crt) Unable to load certificate.

Azaretdodo.

From: Florian Stosse @.> Sent: Sunday, June 25, 2023 8:49:20 PM To: nsacyber/Hardware-and-Firmware-Security-Guidance @.> Cc: Azaretdodo @.>; Author @.> Subject: Re: [nsacyber/Hardware-and-Firmware-Security-Guidance] Unable to load certificate (Issue #23)

Check again the second command that you used, and please be more respectful with people trying to help you :)

— Reply to this email directly, view it on GitHubhttps://github.com/nsacyber/Hardware-and-Firmware-Security-Guidance/issues/23#issuecomment-1606216888, or unsubscribehttps://github.com/notifications/unsubscribe-auth/AHJN3III6AQNJVOM764RDHTXNCB3BANCNFSM6AAAAAAZTEX5YQ. You are receiving this because you authored the thread.Message ID: @.***>

Azaretdodo commented 1 year ago

Big sorry i misunderstood between the line of command two from the line of command four,

You are useful finally that is myself thé dreamer,

Have a nice evening,

Regards.

Azaretdodo.

From: Florian Stosse @.> Sent: Sunday, June 25, 2023 8:49:20 PM To: nsacyber/Hardware-and-Firmware-Security-Guidance @.> Cc: Azaretdodo @.>; Author @.> Subject: Re: [nsacyber/Hardware-and-Firmware-Security-Guidance] Unable to load certificate (Issue #23)

Check again the second command that you used, and please be more respectful with people trying to help you :)

— Reply to this email directly, view it on GitHubhttps://github.com/nsacyber/Hardware-and-Firmware-Security-Guidance/issues/23#issuecomment-1606216888, or unsubscribehttps://github.com/notifications/unsubscribe-auth/AHJN3III6AQNJVOM764RDHTXNCB3BANCNFSM6AAAAAAZTEX5YQ. You are receiving this because you authored the thread.Message ID: @.***>