MSC C6B-SLH
MSC C6B-SLH User Manual
126 / 144
Key Creation with MakeCert
MakeCert -r -a sha256 -len 2048 -n "CN=<certificate name>" -sv key.pvk key.cer
pvk2pfx -pvk key.pvk -spc key.cer -pfx key.pfx -pi <password>
Since Trusted Update uses the same format as the Microsoft tools, those files can be used directly. The important files are the private key file
“key.pfx” and the public key certificate “key.cer”.
Key Creation with OpenSSL
openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -keyout key.key -out key.crt
openssl x509 -in key.crt -outform der -out key.cer
openssl pkcs12 -export -out key.pfx -inkey key.key -in key.crt
OpenSSL generates keys in a different format, therefore some conversion must be done before those keys can be used for Trusted Update.
However, all re
quired conversion can be done with the openssl tool, as seen above. The important files are the private key file “key.pfx” and the public
key certificate “key.cer”.
Trusted Update key usage
MakeCert or OpenSSL will prompt you for a password when generating a private key. This password is used to protect the access to the private key.
Whenever the private key is used (i.e. pvk2pfx or bios editor), this password must be provided.
Self-signed certificates will be used, as it is not possible for the bios to check key hierarchies.
The “valid date” certificate entry will be ignored by the bios, as there is no reliable time source available during bios execution.