README
1Mono's Security Tools - README
2Last updated: January 20, 2005
3
4* General notes
5
6- This directory contains clones for .NET security tools;
7- All tools are 100% managed code with no dependency to the Mono's runtime,
8 except permview (which wouldn't be possible in managed code in Fx 1.0/1.1).
9- A much as possible the same command line arguments as the original are used;
10- Documentation (man) is available for most tools;
11- Authenticode(r) support is MINIMAL - there are still many missing
12 validations.
13
14
15* Authenticode tutorial
16
171. Getting a test certificate
18
19The tool makecert.exe can create test certificates. The test certificates are
20only trusted by Mono's security tools (i.e. the resulting signature won't be
21valid on Windows [1]). For "real" certificates you must deal with (and pay) a
22trusted commercial CA (or you can have your own CA inside your entreprise).
23
24The command:
25mono makecert.exe -n "CN=your name" -sv yourkeypair.pvk yourcert.cer
26
27will create both a PVK file (containing your private key) and a CER file
28(containing the X.509 certificate). This step will take some time because the
29tools must generate your own keypair (in this case a 1024 bits RSA keypair).
30
31example:
32mono makecert.exe -n "CN=Sebastien Pouliot" -sv spouliot.pvk spouliot.cer
33
34
352. Getting a SPC file
36
37The certificate file (.cer) must be converted into a SPC (software publisher
38certificate) file before signing any assembly (or executable file).
39
40The command:
41mono cert2spc.exe yourcert.cer yourspc.spc
42
43will create your SPC file from your X.509 certificates files.
44
45example:
46mono cert2spc.exe spouliot.cer spouliot.spc
47
48
493. Signing an assembly
50
51You need both your PVK (private key) and SPC files to sign an assembly (or
52any PE file). You may also include a countersignature in your assembly using
53a timestamp server (so the signature can still be verified after your
54certificate is expired).
55
56The command:
57mono signcode.exe -v yourkeypair.pvk -spc yourspc.spc -t
58http://timestamp.verisign.com/scripts/timstamp.dll yourassembly.exe
59
60will sign the specified PE file using your private key and embed your
61certificate and a timestamp. Note: there are no "e" in timstamp.dll !
62
63example:
64mono signcode.exe -v spouliot.pvk -spc spouliot.spc -t
65http://timestamp.verisign.com/scripts/timstamp.dll small.exe
66
67
684. Checking an assembly
69
70Anyone can now validate the assembly signature using the chktrust tool.
71
72The command:
73mono chktrust.exe yourassembly.exe
74
75will verify the integrity of the specified PE file. Any change to the file
76will invalidate it's signature.
77
78example:
79mono chktrust.exe small.exe
80
81
82
83[1] FOR TEST PURPOSE ONLY ON WINDOWS
84
85As stated you can "activate" the Mono's test certificate by doing the
86following steps.
87
88a. Generate the Mono's root certificate
89 mono makecert.exe -r mono.cer
90b. Double-click on the mono.cer file
91c. Click on the "Install certificate..." button
92d. Read everything then, if you still want to, answer YES to add the test
93 certificate in your TRUSTED root certificates.
94
95Be warned that by doing so YOU ARE TRUSTING THIS TEST CERTIFICATE on your
96system. This is bad for several reason, foremost that EVERYONE has access to
97it's private key! Please remove the test certificate AS SOON as you have
98finished testing using it.
99
100--------------------
101sebastien@ximian.com
102