Generate update credentials
This section explains how to generate your update credentials. You can skip this section if you already have update credentials available.
Your credentials consist of a private key and an authenticity certificate.
- Your private key is used to sign your authenticity certificate, and to sign the manifest file that you will create later in this tutorial.
- Your authenticity certificate is used by your device to verify that your manifest file and firmware update originate from a trusted source.
Note: You must keep your private key secure and confidential.
Note: Take note of the private key and certificate's directory locations. You need these locations later in the tutorial.
Generate a private key
To generate your private key, run:
openssl ecparam -genkey -name prime256v1 -outform PEM -out my-update-key.pem
This command generates a private key and outputs it to a directory on your computer.
Generate an authenticity certificate
To generate your authenticity certificate, run:
openssl req -x509 -sha256 -days 7300 -key my-update-key.pem -outform der -out my-update-certificate.der -batch
This command uses your private key to derive an authenticity certificate, and outputs your certificate to a directory on your computer.