Maybe it would be better that I ask my question in this way: If I have an ICA certificate and a pair of signed certificate (not self-signed) and key, how should I prepare the rauc bundle command? Is the below command correct?
$ rauc bundle --cert=certificate.pem --key=key.pem --intermediate=ica-certificate.pem input-dir output.bundle Or still I need --keyring argument? If yes, then --keyring=certificate.pem is right? What should I copy in rootfs (/etc/rauc/), certificate or ica-certificate? Best regards, Reyhaneh > -----Ursprüngliche Nachricht----- > Von: Jan Lübbe <j...@pengutronix.de> > Gesendet: Mittwoch, 16. März 2022 11:11 > An: Yazdani, Reyhaneh <ryazd...@data-modul.com>; rauc@pengutronix.de > Betreff: Re: [RAUC] resign a bundle with new intermediate certificate > > Hi, > > On Wed, 2022-03-16 at 08:36 +0000, Yazdani, Reyhaneh wrote: > > Hello, > > > > I have a bundle, which is signed with keys in the past. > > Now, I have new keys, which are created with a new ica-certificate. > > When I want to resign the bundle with new keys, I face this error: > > > > Failed to resign bundle: failed signing bundle: signature verification > > failed: > > Verify error:unable to get local issuer certificate > > Please don't trim the log output. You can also use -d to get more output. > > > This is the command which is applied: > > > > rauc resign --cert=new-certificate-1.pem --key=new-key-1.pem > > --keyring=old- rauc.cert.pem > > This is only correct if the old certificate was self-signed. Otherwise it > must be > the old root CA certificate. > > > --signing-keyring=new-certificate-1.pem > > If your using intermediate certificates, the new-certificate-1.pem can't be > self-signed. Accordingly, using it as the --signing-keyring can't be correct. > > You need to use the *new* root CA certificate here. > > > --intermediate=new-ica-certificate.pem old-bundle.raucb > > new-bundle.raucb > > > > Can I resign a bundle with new ica-certificate? > > It uses the same code paths as the normal bundle creation for singing, so I > don't see why it should behave differently. > > Regards, > Jan > -- > Pengutronix e.K. | | > Steuerwalder Str. 21 | http://www.pengutronix.de/ | > 31137 Hildesheim, Germany | Phone: +49-5121-206917-0 | > Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 | _______________________________________________ RAUC mailing list
