Re: [PATCH v6 3/3] ima-evm-utils: Read keyid from the cert appended to the key file

From: Vitaly Chikunov <vt@altlinux.org>
To: Mimi Zohar <zohar@linux.ibm.com>
Cc: Mimi Zohar <zohar@linux.vnet.ibm.com>,
	Dmitry Kasatkin <dmitry.kasatkin@gmail.com>,
	linux-integrity@vger.kernel.org
Subject: Re: [PATCH v6 3/3] ima-evm-utils: Read keyid from the cert appended to the key file
Date: Sat, 26 Jun 2021 03:21:36 +0300	[thread overview]
Message-ID: <20210626002136.bz2sn2chw4rddyev@altlinux.org> (raw)
In-Reply-To: <5a526d9dd5dcd227c4f85e8a3b9ae504ea97c438.camel@linux.ibm.com>

Mimi,

On Fri, Jun 25, 2021 at 08:22:15AM -0400, Mimi Zohar wrote:
> On Tue, 2021-05-11 at 14:56 +0300, Vitaly Chikunov wrote:
> > Allow to have certificate appended to the private key of `--key'
> > specified (PEM) file (for v2 signing) to facilitate reading of keyid
> > from the associated cert. This will allow users to have private and
> > public key as a single file. There is no check that public key form the
> > cert matches associated private key.
> 
> Is this a standard formats for storing the public and private key in
> the same file?

I am not aware of any standard to keep ASCII armored text x509 cert
together with the private key in the same file. But, it's common usage
for some web servers, such as NGINX. People commonly suggest doing
it in that context:

  https://stackoverflow.com/questions/991758/how-to-get-pem-file-from-key-and-crt-files
  "cat server.crt server.key > server.includesprivatekey.pem"
  "cat server.crt server.key > server.pem"

Thanks,

> 
> Mimi