{"action":"created","issue":{"url":"https://api.github.com/repos/snej/MYUtilities/issues/11","labels_url":"https://api.github.com/repos/snej/MYUtilities/issues/11/labels{/name}","comments_url":"https://api.github.com/repos/snej/MYUtilities/issues/11/comments","events_url":"https://api.github.com/repos/snej/MYUtilities/issues/11/events","html_url":"https://github.com/snej/MYUtilities/issues/11","id":97673034,"number":11,"title":"Documentation for generating kCertTemplate value","user":{"login":"cmsj","id":353427,"avatar_url":"https://avatars.githubusercontent.com/u/353427?v=3","gravatar_id":"","url":"https://api.github.com/users/cmsj","html_url":"https://github.com/cmsj","followers_url":"https://api.github.com/users/cmsj/followers","following_url":"https://api.github.com/users/cmsj/following{/other_user}","gists_url":"https://api.github.com/users/cmsj/gists{/gist_id}","starred_url":"https://api.github.com/users/cmsj/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cmsj/subscriptions","organizations_url":"https://api.github.com/users/cmsj/orgs","repos_url":"https://api.github.com/users/cmsj/repos","events_url":"https://api.github.com/users/cmsj/events{/privacy}","received_events_url":"https://api.github.com/users/cmsj/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-07-28T10:40:24Z","updated_at":"2015-07-28T15:00:02Z","closed_at":null,"body":"Hey\r\n\r\nThanks for this repo - it's the only place I've been able to find code that can generate a self-signed certificate without using loads of deprecated CDSA/OpenSSL APIs!\r\n\r\nOne thing I am trying to figure out though, is how to replace kCertTemplate with my own certificate template. Mainly I would like to do this so that my certs can appear in the Keychain with a name relating to my own app (Hammerspoon), rather than \"Anonymous\".\r\n\r\nI generated myself a CA and then created/signed a certificate from that, did the hexdump and replaced the contents of kCertTemplate with the first 499 bytes of my certificate, but SecItemAdd() returns an error that the certificate format is invalid.\r\n\r\nMy suspicion is that this is because the various kFooOffset values in MYAnonymousIdentity.m are hard-coded for the particular certificate you generated.\r\n\r\nSo, I was wondering if it would be possible to get some more information about how you generated the template certificate and figured out those offsets.\r\n\r\n(I did also attempt to use the MyCrypto code to generate a certificate completely from scratch, but it seemed like a pretty large amount of code to drop into a tiny plugin that happens to need a self-signed certificate!)"},"comment":{"url":"https://api.github.com/repos/snej/MYUtilities/issues/comments/125639798","html_url":"https://github.com/snej/MYUtilities/issues/11#issuecomment-125639798","issue_url":"https://api.github.com/repos/snej/MYUtilities/issues/11","id":125639798,"user":{"login":"cmsj","id":353427,"avatar_url":"https://avatars.githubusercontent.com/u/353427?v=3","gravatar_id":"","url":"https://api.github.com/users/cmsj","html_url":"https://github.com/cmsj","followers_url":"https://api.github.com/users/cmsj/followers","following_url":"https://api.github.com/users/cmsj/following{/other_user}","gists_url":"https://api.github.com/users/cmsj/gists{/gist_id}","starred_url":"https://api.github.com/users/cmsj/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cmsj/subscriptions","organizations_url":"https://api.github.com/users/cmsj/orgs","repos_url":"https://api.github.com/users/cmsj/repos","events_url":"https://api.github.com/users/cmsj/events{/privacy}","received_events_url":"https://api.github.com/users/cmsj/received_events","type":"User","site_admin":false},"created_at":"2015-07-28T15:00:02Z","updated_at":"2015-07-28T15:00:02Z","body":"I continued to bash my head against this, and figured out how to easily regenerate the cert template and offset values. Still might be handy to document somehow, to help folk figure this out:\r\n\r\n```bash\r\nopenssl req -x509 -newkey rsa:2048 -outform DER -out cert.cer -config openssl.conf -set_serial 106 >/dev/null\r\nopenssl asn1parse -inform DER -in cert.cer -dump -i >cert.cer.asn1\r\n\r\nINCLUDE_FILE=\"certTemplate.h\"\r\n> ${INCLUDE_FILE}\r\n\r\nSERIAL_OFFSET=$(( 2 + $(grep INTEGER cert.cer.asn1 | sed -n 2p | sed -e 's/:.*//') ))\r\nISSUED_OFFSET=$(( 2 + $(grep UTCTIME cert.cer.asn1 | sed -n 1p | sed -e 's/:.*//') ))\r\nEXPIRY_OFFSET=$(( 2 + $(grep UTCTIME cert.cer.asn1 | sed -n 2p | sed -e 's/:.*//') ))\r\nPUBKEY_OFFSET=$(( 5 + $(grep \"BIT STRING\" cert.cer.asn1 | sed -n 1p | sed -e 's/:.*//') ))\r\nCSR_LENGTH=$(grep \"BIT STRING\" cert.cer.asn1 | sed -n 2p | sed -e 's/:.*//')\r\n\r\necho \"#define kSerialOffset    ${SERIAL_OFFSET}\" >>${INCLUDE_FILE}\r\necho \"#define kIssueDateOffset ${ISSUED_OFFSET}\" >>${INCLUDE_FILE}\r\necho \"#define kExpDateOffset   ${EXPIRY_OFFSET}\" >>${INCLUDE_FILE}\r\necho \"#define kPublicKeyOffset ${PUBKEY_OFFSET}\" >>${INCLUDE_FILE}\r\necho \"#define kCSRLength       ${CSR_LENGTH}u\" >>${INCLUDE_FILE}\r\n\r\necho \"\" >>${INCLUDE_FILE}\r\n\r\nopenssl x509 -C -inform DER -in cert.cer -noout | sed -n '/XXX_certificate/,$p' | sed -e 's/unsigned char XXX_certificate/static uint8_t const kCertTemplate/' >>${INCLUDE_FILE}\r\n\r\nrm cert.cer\r\nrm cert.cer.asn1\r\n```\r\n"}}