SAW-Kinoite/package-verification/ca/README.md

Package Verification CA Configuration

Overview

This directory contains the Certificate Authority (CA) configuration for package verification.

Files

package-verification/ca/
├── ca.crt          # CA certificate (PLACEHOLDER - you must add your own)
├── ca.key          # CA private key (PLACEHOLDER - NEVER include this in the ISO)
├── crl.pem         # Certificate Revocation List (PLACEHOLDER)
└── README.md       # This file

CA Certificate

What is a CA Certificate?

A CA (Certificate Authority) certificate is used to sign and verify packages. It ensures:

1. Integrity - Packages haven't been modified
2. Authenticity - Packages come from your trusted source
3. Non-repudiation - Can prove who signed the package

Creating Your CA Certificate

# Generate CA private key
openssl genrsa -out ca.key 4096

# Generate CA certificate
openssl req -x509 -new -nodes -key ca.key -sha256 -days 3650 -out ca.crt

# Verify certificate
openssl x509 -in ca.crt -text -noout

Installing CA Certificate

The CA certificate should be:

1. Embedded in ISO - During ISO build
2. Installed to system - /etc/pki/rpm-gpg/RPM-GPG-KEY-custom-ca
3. Imported into RPM database - rpm --import
4. Added to CA trust - update-ca-trust

CA Private Key

Security Requirements

The CA private key is CRITICAL to protect:

1. Never include in ISO - Only use on signing machine
2. Store offline - USB drive or air-gapped system
3. Use strong encryption - AES-256 with passphrase
4. Back up securely - Multiple encrypted backups
5. Use hardware token - HSM for maximum security

Signing Packages

# Sign RPM packages
rpm --define "%_gpg_name Your CA Name" --addsign package.rpm

# Sign with specific key
rpm --define "%_gpg_name Your CA Name" --addsign --define '_gpg_transport_key YOUR_KEY_ID' package.rpm

# Verify signature
rpm --checksig package.rpm

Certificate Revocation List (CRL)

What is a CRL?

A CRL is a list of certificates that have been revoked before their expiration date. It's used to:

1. Detect compromised certificates
2. Block revoked packages
3. Respond to security incidents
4. Maintain trust

Creating a CRL

# Create a certificate to revoke (for testing)
openssl req -new -nodes -out test.csr
openssl ca -in test.csr -out test.crt

# Revoke the certificate
openssl ca -revoke test.crt

# Generate CRL
openssl ca -gencrl -out crl.pem

# Verify CRL
openssl crl -in crl.pem -noout -text

CRL Distribution

The CRL should be:

1. Hosted on secure server - HTTPS with authentication
2. Signed by CA - Ensure CRL authenticity
3. Updated regularly - Daily recommended
4. Cached locally - For offline verification

Package Signing

Creating Signed Packages

1. Create package - Build your RPM package
2. Sign package - Use CA private key to sign
3. Distribute - Share signed package
4. Verify - Recipients verify signature

Example Package Signing Workflow

# Step 1: Build package
rpmbuild -bb your-package.spec

# Step 2: Sign package
rpm --define "%_gpg_name Your CA Name" --addsign ~/rpmbuild/RPMS/x86_64/your-package.rpm

# Step 3: Verify signature
rpm --checksig ~/rpmbuild/RPMS/x86_64/your-package.rpm

Security Best Practices

CA Key Management

1. Generate on air-gapped system
2. Store in encrypted storage
3. Use hardware security module (HSM)
4. Implement key rotation
5. Maintain audit trail

Certificate Management

1. Set appropriate validity period - 1-3 years for CA
2. Use strong algorithms - RSA 4096, ECDSA P-256
3. Implement certificate policies
4. Maintain certificate registry
5. Track certificate lifecycle

CRL Management

1. Update daily - Ensure current revocation status
2. Sign CRL - Use CA key for authenticity
3. Cache CRL - For offline verification
4. Monitor expiration - Renew before expiration
5. Test revocation - Verify revocation works

Package Signing

1. Sign all packages - No unsigned packages
2. Verify before install - Always check signature
3. Log all operations - Audit trail
4. Use separate signing keys - For different purposes
5. Implement key rotation - Regularly rotate keys

Troubleshooting

CA Certificate Not Found

# Verify certificate exists
ls -la /etc/pki/rpm-gpg/RPM-GPG-KEY-custom-ca

# Check certificate format
openssl x509 -in /etc/pki/rpm-gpg/RPM-GPG-KEY-custom-ca -text -noout

Package Signature Verification Failed

# Verify package signature
rpm --checksig package.rpm

# Check CA key is imported
rpm -q gpg-pubkey

# Re-import CA key
rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-custom-ca

CRL Verification Failed

# Verify CRL format
openssl crl -in crl.pem -noout -text

# Check CRL signature
openssl crl -in crl.pem -CAfile ca.crt -noout

# Verify CRL dates
openssl crl -in crl.pem -noout -text | grep -E "(Last Update|Next Update)"

References

• OpenSSL Documentation
• RPM Signature Documentation
• Certificate Management Best Practices

Contact

For questions about CA configuration, contact your security administrator.