This repository contains the list of revoked certificates issued by openziti.org. This list is used in conjunction with a proper x509 implementation to determine if the certificate provided is to be considered valid.
The following openssl commands generated the keys used by openziti.org to sign code. RSA was chosen for the keys as EC is sometimes unsupported. Commands sometimes reference a configuration file which is important. Running these commands should start by first cloning this repository and running the commands from the root of the clone.
The root certificate authority was generated and is valid for 7320 days (approx 20 years)
openssl genrsa -out openziti.rootCA.rsa.key 4096
openssl req \
-new -x509 \
-config ./openziti.openssl.conf \
-key openziti.rootCA.rsa.key \
-sha512 \
-days 7320 \
-subj "/CN=Root Signing CA/O=openziti.org Inc/OU=adv-dev/C=US/ST=NC" \
-out certs/openziti.rootCA.rsa.pem
openssl genrsa -out openziti.signing.rsa.key 4096
This is a two-part process of generating the CSR and then signing the CSR. Replace the year appropriately
openssl req \
-new -key openziti.signing.rsa.key \
-config ./openziti.openssl.conf \
-subj "/CN=openziti.org Code Signing Certificate 2021/O=openziti.org Inc/OU=adv-dev/C=US/ST=NC" \
-out openziti.signing.rsa.csr
openssl ca \
-batch \
-config ./openziti.openssl.conf \
-keyfile openziti.rootCA.rsa.key \
-cert certs/openziti.rootCA.rsa.pem \
-days 1098 \
-in openziti.signing.rsa.csr \
-extfile openziti.signing.rsa.conf \
-out certs/openziti.signing.2021.rsa.pem
The code signing tool of choice desires a PKCS#12 file to be supplied. The following command is run to produce a PKCS#12
file. During the process a password file named .pfxpass should be created containing the strong password to use
for the PKCS#12 file. This file is ignored via .gitignore and MUST NOT be committed. If committed even accidentally
the signing cert needs to be revoked.
openssl pkcs12 \
-export \
-inkey openziti.signing.rsa.key \
-in certs/openziti.signing.2021.rsa.pem \
-out openziti.signing.2021.rsa.pfx \
-password "pass:$(cat .pfxpass)"
Once generated, issue the following command and verify the certificate contains the expected extensions:
#command to execute:
openssl x509 -text -in certs/openziti.signing.2021.rsa.pem
#expected extensions below:
X509v3 extensions:
X509v3 Authority Key Identifier:
keyid:B4:BF:93:98:07:2D:7A:50:4C:3B:93:B9:CC:2E:0E:D8:DC:5B:3B:B8
X509v3 Basic Constraints:
CA:FALSE
X509v3 Key Usage:
Digital Signature
X509v3 Extended Key Usage:
Code Signing
X509v3 CRL Distribution Points:
Full Name:
URI:https://openziti.github.io/crl/openziti.crl
If you need to sign an executable in Windows you would use signtool. Here’s an example command illustrating how to
sign an executable with a signing certificate. %PFXPASS_OPENZITI% is an environment variable set in cmd:
signtool sign /f openziti.signing.2021.rsa.pfx /p %PFXPASS_OPENZITI% /fd sha512 /td sha512 executable_name.exe
A file exists in the repository named certdb.txt. This is a plaintext file that represents the revoked
certificates. This file serves as the source of the actual CRL list: openziti.crl. It contains the
serial numbers of revoked certificates as well as other information such as the date of revocation.
Creating the CRL requires access to the Root CA private key and thus can only be performed by authorized personnel.
To revoke a certificate perform the following steps:
openziti.rootCA.rsa.key, sha256sum: e8de652fc6fb6b6189bb6de3162d3c3ea5ef019b1e80f6a94ed93f4bdd9d579fissue the following command and optionally supply a valid crl_reason. rfc5280, section 5.3.1
openssl ca \
-config ./openziti.openssl.conf \
-keyfile openziti.rootCA.rsa.key \
-cert certs/openziti.rootCA.rsa.pem \
-revoke certs/openziti.signing.2021.rsa.pem \
-crl_reason keyCompromise
sign the crl using the private key and generate the actual CRL
openssl ca -config ./openziti.openssl.conf -gencrl -out openziti.crl.pem
some platforms might DER encoding - export the crl as DER
openssl crl -in openziti.crl.pem -inform PEM -outform DER -out openziti.crl
commit and push the changes and issue PR to merge to main. Make sure to commit the following files:
serial.num.txt
certdb.txt
openziti.crl (DER formatted binary crl)
openziti.crl.pem (PEM formatted textual crl)
To verify the revoke command has succeeded you should notice a change to the certdb.txt file. The row you have revoked should change from V for Valid, to R for Revoked. The second field of the file should now show a timestamp and the reason for which the certificate was revoked. Example below:
-V 220603050220Z 1004 unknown /CN=Code Signing Certificate .....
+R 220603050220Z 210602113249Z,keyCompromise 1004 unknown /CN=Code Signing Certificate
The following commands were issued to generate a certificate which was then revoked:
openssl genrsa -out openziti.signing.rsa.key.torevoke 4096
openssl req \
-new -key openziti.signing.rsa.key.torevoke \
-config ./openziti.openssl.conf \
-subj "/CN=RevokeTest openziti.org Code Signing Certificate 2021/O=openziti.org Inc/OU=adv-dev/C=US/ST=NC" \
-out openziti.signing.rsa.csr.torevoke
openssl ca \
-batch \
-config ./openziti.openssl.conf \
-keyfile openziti.rootCA.rsa.key \
-cert certs/openziti.rootCA.rsa.pem \
-days 1098 \
-in openziti.signing.rsa.csr.torevoke \
-extfile openziti.signing.rsa.conf \
-out certs/openziti.signing.2021.rsa.pem.torevoke
openssl ca \
-config ./openziti.openssl.conf \
-keyfile openziti.rootCA.rsa.key \
-cert certs/openziti.rootCA.rsa.pem \
-revoke certs/openziti.signing.2021.rsa.pem.torevoke \
-crl_reason keyCompromise
openssl pkcs12 \
-export \
-inkey openziti.signing.rsa.key.torevoke \
-in certs/openziti.signing.2021.rsa.pem.torevoke \
-out openziti.signing.rsa.pfx.torevoke