And another one on AIR. To see if it is the end of the series
. The last few days I've been fighting with the signing AIR applications, did not understand much how it worked and I was surprised that, despite always having to sign an application with an SSL certificate, I always went to install "Publisher: UNKNOWN", which that gives very bad image. Now I have it clear, confused the terms sign and trust. If you do not want to leave the message in question will have to purchase a software signing certificate issued by a valid certificate authority (Thawte), a firm confidence. The downside is that its price is around 300 euros, nothing more and nothing less. Personally I think they have blown a bit but if you do not sign your potential users will have a sense of insecurity, your applications will be signed but not trusted them.
A second option is to create your own certificate authority (CA) and sign your applications yourself. The downside of doing this is that users will be required to install a CA certificate (the usual default ones in the browser). As the application I'm working on will be used in a specific and defined, I can use this system and save me some money. Also, my potential users have already installed the certificate from our CA as it will be the same we use to generate SSL certificates client / server . If I sign the AIR application with the same authority you'll be fine.
In that article we saw how to generate your own certificate authority, the method remains the same. Only need OpenSSL :
-keyout cakey.pem -out cacert.pem openssl req-x509-newkey rsa: 2048-days 3650-keyout cacert.pem-out cakey.pem
We created a couple of files to maintain database of certificates issued:
>serial miss '100001 '> serial
certindex.txt touch
Let's see how we generate the certificate for the software company. It is not easy to know all the options necessary to then run the firm, it's best to put them all in a configuration file, openssl.cnf:
dir =.
[Ca]
default_ca = CA_default
[CA_default]
serial = $ dir / serial
database = $ dir / certindex.txt
new_certs_dir = $ dir / certs
certificate = $ dir / cacert.pem
private_key = $ dir / cakey.pem
nameopt = default_ca
certopt = default_ca
policy = mypolicy
default_days = 365
default_md = md5
preserve = no
email_in_dn = no
[Mypolicy]
countryName = match
stateOrProvinceName = match
organizationName = match
organizationalUnitName = optional
commonName = supplied
emailAddress = optional
[Req]
default_bits = 1024
default_keyfile = key.pem
default_md = md5
string_mask = nombstr
distinguished_name = req_distinguished_name
req_extensions = v3_req
[Req_distinguished_name]
company ) 0. OrganizationName = Organization Name (company)
organizationalUnitName = Organizational Unit Name (department, division)
emailAddress = Email Address
emailAddress_max = 40
localityName = Locality Name (city, district)
stateOrProvinceName = State or Province Name (full name)
letter code ) countryName = Country Name (2 letter code)
countryName_min = 2
countryName_max = 2
, IP, or your name ) commonName = Common Name (hostname, IP, or your name)
commonName_max = 64
0. OrganizationName_default = Xplota Solutions
localityName_default = Valencia
stateOrProvinceName_default = Valencia
countryName_default = ES
emailAddress_default = tu@email.com
[V3_ca]
basicConstraints = CA: TRUE
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid: always, issuer: always
keyUsage = cRLSign, keyCertSign
nsCertType = sslCA, emailCA, objCA
subjectAltName = email: copy
cRLDistributionPoints = URI: http://ca.xplota.com/cert/
nsCaPolicyUrl = http://ca.xplota.com/policy.html
[V3_req]
basicConstraints = CA: FALSE
subjectKeyIdentifier = hash
[Air_cert]
basicConstraints = critical, CA: false
keyUsage = critical, digitalSignature
extendedKeyUsage = critical, codesigning
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid: always, issuer: always
subjectAltName = email: copy
issuerAltName = issuer: copy
cRLDistributionPoints = URI: http://ca.xplota.com/cert/
You may have to change some files path to your CA. There are many options, but you need not know the details. Now generate our certificate:
openssl req-new-nodes-out air_key-req.pem-keyout private / air_key-key.pem-days 3651-config. / openssl.cnf-extensions air_cert
When you ask for the certificate data, very important: those relating to the organization name, city, province and country have to be the same as the CA can generate it or not, put exactly the same data. In the Common Name must put the name you want to appear instead of one "UNKNOWN", can be yours or that of your company.
If you come here we can only sign the certificate with the CA.
openssl ca-extensions-air_key air_cert-out cert.pem-days 3652-config. / openssl.cnf-disbelieve-req.pem air_key
How we saw with client certificates, the certificate generated will not help us much, we export it to a standard format:
air_key-cert.pem -inkey private/air_key-key.pem -name "My Code Key" -chain -CAfile cacert.pem openssl pkcs12 - export-out air_key.pfx - in air_key-cert.pem-inkey private / air_key-key.pem-name "My Code Key"-chain-CAfile cacert.pem
We're done. Copy the file air_key.pfx to your workstation and export your AIR project with this certificate. If no problems strangers have your signed application. Let's try it:
Wow, does not work. What happened? Simple, what I was saying at first, your system does not have the CA certificate thus not trust your application. Installation is very simple. Import the cacert.pem file in the list of "Trusted Issuers" of your web browser.
Let's see what happens if we now try to install the application signed with our certificate:
Works!
How my environment is limited and already have my CA I can easily sign my applications myself, in a real environment more generally not be possible and would be paid by the trust.
A very important aspect about signing AIR applications and keep in mind is that you should always sign the same certificate, each release must be signed with the same certificate that you used the priemra time or your clients can not upgrade from one version to another as the security mechanism detects that the certificate is different and can be a security breach.
I hope I have shed some light on the world of firms and trusts in AIR.