WiiMart/WiiMart-Patcher
1
0
Fork 0
mirror of https://wiilab.wiimart.org/wiimart/WiiMart-Patcher synced 2025-09-04 04:21:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

Resolve certificate generation

Browse Source 
The server certificate was mistakenly using the public key of the CA and private key of itself, instead of the reverse.

We additionally bump the CA size to 2048 bytes.
This commit is contained in:
Spotlight 2022-03-16 17:33:36 -05:00
parent 3bfbc5fcde
commit 952c3824e3
No known key found for this signature in database
GPG Key ID: 874AA355B3209BDC
2 changed files with 15 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
README.md
View File

@ -37,8 +37,8 @@ Invoke WSC-Patcher similar to the following:
``` ```
Throughout its operation, the patcher will perform the following: Throughout its operation, the patcher will perform the following:
- Version 20 (latest, as of writing) of the Wii Shop Channel will be downloaded to `cache/original.wad`. - Version 21 (latest, as of writing) of the Wii Shop Channel will be downloaded to `cache/original.wad`.
- If `output/root.cer` is not present, a 1024-bit (RSA), SHA-1 CA certificate will be generated. - If `output/root.cer` is not present, a 2048-bit (RSA), SHA-1 CA certificate will be generated.
- At the same time, `*.<basedomain>` will be issued for ease of use. See `output/server.pem` and `output/server.key` for usage with nginx or similar servers. - At the same time, `*.<basedomain>` will be issued for ease of use. See `output/server.pem` and `output/server.key` for usage with nginx or similar servers.
- Modifications are made to the application's main `.arc` (within content index 2) to permit Opera loading the base domain, and the customized certificates. - Modifications are made to the application's main `.arc` (within content index 2) to permit Opera loading the base domain, and the customized certificates.
- Patches to the application's main dol are also performed. Please see `docs/patch_<name>.md` for more information on what these contain. - Patches to the application's main dol are also performed. Please see `docs/patch_<name>.md` for more information on what these contain.

32
cert_store.go
View File

@ -6,7 +6,6 @@ import (
"crypto/x509" "crypto/x509"
"crypto/x509/pkix" "crypto/x509/pkix"
"encoding/pem" "encoding/pem"
"log"
"math/big" "math/big"
"time" "time"
) )
@ -17,9 +16,7 @@ import (
func generateSerial() *big.Int { func generateSerial() *big.Int {
serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128) serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)
serialNumber, err := rand.Int(rand.Reader, serialNumberLimit) serialNumber, err := rand.Int(rand.Reader, serialNumberLimit)
if err != nil { check(err)
log.Fatalf("Failed to generate serial number: %v", err)
}
return serialNumber return serialNumber
} }
@ -28,7 +25,7 @@ func createCertificates() []byte {
//////////////////////////////////// ////////////////////////////////////
// Generate root CA // // Generate root CA //
//////////////////////////////////// ////////////////////////////////////
rootCA := x509.Certificate{ rootCAFormat := x509.Certificate{
SignatureAlgorithm: x509.SHA1WithRSA, SignatureAlgorithm: x509.SHA1WithRSA,
SerialNumber: generateSerial(), SerialNumber: generateSerial(),
Subject: pkix.Name{ Subject: pkix.Name{
@ -41,18 +38,16 @@ func createCertificates() []byte {
IsCA: true, IsCA: true,
} }
// Sadly, 2048 bits can cause compatability issues with IOS. We must use 1024. rootPriv, err := rsa.GenerateKey(rand.Reader, 2048)
// TODO(spotlightishere): Is it possible to raise to 2048 anyway?
rootPriv, err := rsa.GenerateKey(rand.Reader, 1024)
check(err) check(err)
rootCertBytes, err := x509.CreateCertificate(rand.Reader, &rootCA, &rootCA, &rootPriv.PublicKey, rootPriv) rootCert, err := x509.CreateCertificate(rand.Reader, &rootCAFormat, &rootCAFormat, &rootPriv.PublicKey, rootPriv)
check(err) check(err)
//////////////////////////////////// ////////////////////////////////////
// Issue server TLS certificate // // Issue server TLS certificate //
//////////////////////////////////// ////////////////////////////////////
serverCert := x509.Certificate{ serverCertFormat := x509.Certificate{
SignatureAlgorithm: x509.SHA1WithRSA, SignatureAlgorithm: x509.SHA1WithRSA,
SerialNumber: generateSerial(), SerialNumber: generateSerial(),
// We'll issue with a primary common name for our base domain. // We'll issue with a primary common name for our base domain.
@ -63,10 +58,9 @@ func createCertificates() []byte {
DNSNames: []string{ DNSNames: []string{
"*." + baseDomain, "*." + baseDomain,
}, },
NotBefore: time.Now(), NotBefore: time.Now(),
NotAfter: time.Now().AddDate(10, 0, 0), NotAfter: time.Now().AddDate(10, 0, 0),
// TODO: what's non-repudiation KeyUsage: x509.KeyUsageKeyAgreement | x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
KeyUsage: x509.KeyUsageDigitalSignature,
ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth}, ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
IsCA: false, IsCA: false,
MaxPathLenZero: true, MaxPathLenZero: true,
@ -75,24 +69,24 @@ func createCertificates() []byte {
serverPriv, err := rsa.GenerateKey(rand.Reader, 2048) serverPriv, err := rsa.GenerateKey(rand.Reader, 2048)
check(err) check(err)
serverCertBytes, err := x509.CreateCertificate(rand.Reader, &serverCert, &rootCA, &rootPriv.PublicKey, serverPriv) serverCert, err := x509.CreateCertificate(rand.Reader, &serverCertFormat, &rootCAFormat, &serverPriv.PublicKey, rootPriv)
check(err) check(err)
//////////////////////////// ////////////////////////////
// Persist certificates // // Persist certificates //
//////////////////////////// ////////////////////////////
rootCertPem := pemEncode("CERTIFICATE", rootCertBytes) rootCertPem := pemEncode("CERTIFICATE", rootCert)
rootKeyPem := pemEncode("RSA PRIVATE KEY", x509.MarshalPKCS1PrivateKey(rootPriv)) rootKeyPem := pemEncode("RSA PRIVATE KEY", x509.MarshalPKCS1PrivateKey(rootPriv))
serverCertPem := pemEncode("CERTIFICATE", serverCertBytes) serverCertPem := pemEncode("CERTIFICATE", serverCert)
serverKeyPem := pemEncode("RSA PRIVATE KEY", x509.MarshalPKCS1PrivateKey(serverPriv)) serverKeyPem := pemEncode("RSA PRIVATE KEY", x509.MarshalPKCS1PrivateKey(serverPriv))
writeOut("root.pem", rootCertPem) writeOut("root.pem", rootCertPem)
writeOut("root.cer", rootCertBytes) writeOut("root.cer", rootCert)
writeOut("root.key", rootKeyPem) writeOut("root.key", rootKeyPem)
writeOut("server.pem", serverCertPem) writeOut("server.pem", serverCertPem)
writeOut("server.key", serverKeyPem) writeOut("server.key", serverKeyPem)
return rootCertBytes return rootCert
} }
func pemEncode(typeName string, bytes []byte) []byte { func pemEncode(typeName string, bytes []byte) []byte {