--------------------------------------------------------------------------------
File:           ChainCreationInstructions.txt

Description:    This folder contains INI files that are required to generate
                the following test cert chains. Certs will be copied onto the
                file system AND MY store when they are generated by certreq.exe.

Note that typically certreq.exe operates on INF files, but in this folder
we use INI files so that our build system does not complain about INF's being
in the tree, but not in the CryptoPkg.dsc file.

To create your own certificates and signatures for testing, this file demonstrates
how the test certificate chains and signatures were created.

To create test signatures, run SignFirmwareWithEKUs.cmd (with SignTool.exe in
your path).  You can then use your favorite BinaryToHex converter to convert
the binary into a byte array that you can include in unit tests.

Copyright (C) Microsoft Corporation.  All Rights Reserved.
--------------------------------------------------------------------------------
Cert Chain:

       ------------------------------------------
      |                                          | // Root of trust. ECDSA P521 curve
      |          TestEKUParsingRoot              | // SHA 256 Key Usage: CERT_DIGITAL_SIGNATURE_KEY_USAGE
      |                                          | // CERT_KEY_CERT_SIGN_KEY_USAGE | CERT_CRL_SIGN_KEY_USAGE
       ------------------------------------------
                         ^
                         |
       ------------------------------------------
      |                                          | // Issues subordinate CAs. ECC P384 curve.
      |       TestEKUParsingPolicyCA             | // SHA 256 Key Usage:
      |                                          | // CERT_KEY_CERT_SIGN_KEY_USAGE | CERT_CRL_SIGN_KEY_USAGE
       ------------------------------------------
                         ^
                         |
       ------------------------------------------
      |                                          | // Issues end-entity (leaf) signers. ECC P256 curve.
      |        TestEKUParsingIssuingCA           | // SHA 256 Key Usage: CERT_DIGITAL_SIGNATURE_KEY_USAGE
      |                                          | // Enhanced Key Usage:
       ------------------------------------------  // 1.3.6.1.4.1.311.76.9.21.1 (Surface firmware signing)
                         ^
                         |
          --------------------------------------
         /                                     /   // Leaf signer,  ECC P256 curve.
        /      TestEKUParsingLeafSigner       /    // SHA 256 Key Usage: CERT_DIGITAL_SIGNATURE_KEY_USAGE
       /                                     /     // Enhanced Key usages:
       --------------------------------------      // 1.3.6.1.4.1.311.76.9.21.1 (Surface firmware signing)
                                                   // 1.3.6.1.4.1.311.76.9.21.1.N, N == Product ID.




---------------------------------------------------------------------------------


--- files required ---

TestEKUParsingRoot.ini               - This certificate is the root CA under which all CAs live.
TestEKUParsingPolicyCA.ini           - This policy CA will issue subordinate CA's with EKU constraints.
TestEKUParsingIssuingCA.ini          - CA to issue end-entity leafs.
TestEKUParsingLeafSigner.ini         - End-Entity leaf signer.
TestEKUParsingLeafSignerPid12345.ini - End-Entity, with EKU: 1.3.6.1.4.1.311.76.9.21.1.12345.
TestEKUParsingNoEKUsInSigner.ini     - Leaf with no EKU's specified.
TestEKUParsingLeafSignerPid1.ini     - Test with naming files ini, to get around build complaints.
--- Commands to execute ---

certreq.exe -new                                    TestEKUParsingRoot.ini               TestEKUParsingRoot.cer
certreq.exe -new -q -cert "TestEKUParsingRoot"      TestEKUParsingPolicyCA.ini           TestEKUParsingPolicyCA.cer
certreq.exe -new -q -cert "TestEKUParsingPolicyCA"  TestEKUParsingIssuingCA.ini          TestEKUParsingIssuingCA.cer
certreq.exe -new -q -cert "TestEKUParsingIssuingCA" TestEKUParsingLeafSigner.ini         TestEKUParsingLeafSigner.cer
certreq.exe -new -q -cert "TestEKUParsingIssuingCA" TestEKUParsingLeafSignerPid12345.ini TestEKUParsingLeafSignerPid12345.cer
certreq.exe -new -q -cert "TestEKUParsingIssuingCA" TestEKUParsingNoEKUsInSigner.ini     TestEKUParsingNoEKUsInSigner.cer
certreq.exe -new -q -cert "TestEKUParsingIssuingCA" TestEKUParsingLeafSignerPid1.ini     TestEKUParsingLeafSignerPid1.cer

---------------------------------------------------------------------------------

Then start mmc->Add certificates, Local Computer/open Personal/Certs and export the keys into the pfx files below.
Note:  You should see a little key on the top left of each cert icon, which means you have the private key
       for this cert.  If you don't see it something is wrong.  For each cert, right-click and do all tasks,
       export.  Yes, Export the private key.  PCKS#12 format, include all certs in path if possible.

       If we automated the call to certreq above, there is a PowerShell "PKI" cmdlet which has
       an Export-PfxCertificate command.

Passwords:  TestEKUParsingRoot.pfx               == TestEKUParsingRoot
            TestEKUParsingPolicyCA.pfx           == TestEKUParsingPolicyCA
            TestEKUParsingIssuingCA.pfx          == TestEKUParsingIssuingCA
            TestEKUParsingLeafSigner.pfx         == TestEKUParsingLeafSigner
            TestEKUParsingLeafSignerPid12345.pfx == TestEKUParsingLeafSignerPid12345
            TestEKUParsingNoEKUsInSigner.pfx     == TestEKUParsingNoEKUsInSigner