# Package Verification CA Configuration

## Overview

This directory contains the Certificate Authority (CA) configuration for package verification.

## Files

```
package-verification/ca/
├── ca.crt          # CA certificate (PLACEHOLDER - you must add your own)
├── ca.key          # CA private key (PLACEHOLDER - NEVER include this in the ISO)
├── crl.pem         # Certificate Revocation List (PLACEHOLDER)
└── README.md       # This file
```

## CA Certificate

### What is a CA Certificate?

A CA (Certificate Authority) certificate is used to sign and verify packages. It ensures:

1. **Integrity** - Packages haven't been modified
2. **Authenticity** - Packages come from your trusted source
3. **Non-repudiation** - Can prove who signed the package

### Creating Your CA Certificate

```bash
# Generate CA private key
openssl genrsa -out ca.key 4096

# Generate CA certificate
openssl req -x509 -new -nodes -key ca.key -sha256 -days 3650 -out ca.crt

# Verify certificate
openssl x509 -in ca.crt -text -noout
```

### Installing CA Certificate

The CA certificate should be:

1. **Embedded in ISO** - During ISO build
2. **Installed to system** - `/etc/pki/rpm-gpg/RPM-GPG-KEY-custom-ca`
3. **Imported into RPM database** - `rpm --import`
4. **Added to CA trust** - `update-ca-trust`

## CA Private Key

### Security Requirements

The CA private key is **CRITICAL** to protect:

1. **Never include in ISO** - Only use on signing machine
2. **Store offline** - USB drive or air-gapped system
3. **Use strong encryption** - AES-256 with passphrase
4. **Back up securely** - Multiple encrypted backups
5. **Use hardware token** - HSM for maximum security

### Signing Packages

```bash
# Sign RPM packages
rpm --define "%_gpg_name Your CA Name" --addsign package.rpm

# Sign with specific key
rpm --define "%_gpg_name Your CA Name" --addsign --define '_gpg_transport_key YOUR_KEY_ID' package.rpm

# Verify signature
rpm --checksig package.rpm
```

## Certificate Revocation List (CRL)

### What is a CRL?

A CRL is a list of certificates that have been revoked before their expiration date. It's used to:

1. **Detect compromised certificates**
2. **Block revoked packages**
3. **Respond to security incidents**
4. **Maintain trust**

### Creating a CRL

```bash
# Create a certificate to revoke (for testing)
openssl req -new -nodes -out test.csr
openssl ca -in test.csr -out test.crt

# Revoke the certificate
openssl ca -revoke test.crt

# Generate CRL
openssl ca -gencrl -out crl.pem

# Verify CRL
openssl crl -in crl.pem -noout -text
```

### CRL Distribution

The CRL should be:

1. **Hosted on secure server** - HTTPS with authentication
2. **Signed by CA** - Ensure CRL authenticity
3. **Updated regularly** - Daily recommended
4. **Cached locally** - For offline verification

## Package Signing

### Creating Signed Packages

1. **Create package** - Build your RPM package
2. **Sign package** - Use CA private key to sign
3. **Distribute** - Share signed package
4. **Verify** - Recipients verify signature

### Example Package Signing Workflow

```bash
# Step 1: Build package
rpmbuild -bb your-package.spec

# Step 2: Sign package
rpm --define "%_gpg_name Your CA Name" --addsign ~/rpmbuild/RPMS/x86_64/your-package.rpm

# Step 3: Verify signature
rpm --checksig ~/rpmbuild/RPMS/x86_64/your-package.rpm
```

## Security Best Practices

### CA Key Management

1. **Generate on air-gapped system**
2. **Store in encrypted storage**
3. **Use hardware security module (HSM)**
4. **Implement key rotation**
5. **Maintain audit trail**

### Certificate Management

1. **Set appropriate validity period** - 1-3 years for CA
2. **Use strong algorithms** - RSA 4096, ECDSA P-256
3. **Implement certificate policies**
4. **Maintain certificate registry**
5. **Track certificate lifecycle**

### CRL Management

1. **Update daily** - Ensure current revocation status
2. **Sign CRL** - Use CA key for authenticity
3. **Cache CRL** - For offline verification
4. **Monitor expiration** - Renew before expiration
5. **Test revocation** - Verify revocation works

### Package Signing

1. **Sign all packages** - No unsigned packages
2. **Verify before install** - Always check signature
3. **Log all operations** - Audit trail
4. **Use separate signing keys** - For different purposes
5. **Implement key rotation** - Regularly rotate keys

## Troubleshooting

### CA Certificate Not Found

```bash
# Verify certificate exists
ls -la /etc/pki/rpm-gpg/RPM-GPG-KEY-custom-ca

# Check certificate format
openssl x509 -in /etc/pki/rpm-gpg/RPM-GPG-KEY-custom-ca -text -noout
```

### Package Signature Verification Failed

```bash
# Verify package signature
rpm --checksig package.rpm

# Check CA key is imported
rpm -q gpg-pubkey

# Re-import CA key
rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-custom-ca
```

### CRL Verification Failed

```bash
# Verify CRL format
openssl crl -in crl.pem -noout -text

# Check CRL signature
openssl crl -in crl.pem -CAfile ca.crt -noout

# Verify CRL dates
openssl crl -in crl.pem -noout -text | grep -E "(Last Update|Next Update)"
```

## References

- [OpenSSL Documentation](https://www.openssl.org/docs/)
- [RPM Signature Documentation](https://docs.fedoraproject.org/en-US/fedora-coreos/security-verification/)
- [Certificate Management Best Practices](https://csrc.nist.gov/publications)

## Contact

For questions about CA configuration, contact your security administrator.