-
Request the necessary test certificates from CableLabs. It is likely
that you will need to execute the
OCAP Implementers Agreement
with CableLabs before they provide the certificate files. As a
minimum, you will be requested to execute Annex B of this agreement, for the
"OCAP Materials".
CableLabs should then supply the test root certificate, a certificate authority
(CA) certificate, your leaf certificate and the private key for the leaf
certificate. You will also need the pass phrase allocated by CableLabs
for accessing your private key.
-
Install the root certificate into your OCAP SFG
certificate database by using the command:
ocapsfg install -in {filename.cert} -selfsigned -base {directory}
Where {directory} is the location of your default OCAP SFG file
structure, containing the OCAP.index file and related directories.
{filename.cert} is the location of the certificate file which
you are installing into the database.
Note that the filename must end with .cert, so if the certificates
are named with a .pem postfix, you will need to rename them as
filename.pem.cert.
-
Repeat this process for the CA certificate using:
ocapsfg install -in {filename.cert} -base {directory} -purpose mhp_ca
-
Finally install your leaf certificate using:
ocapsfg install -in {filename.cert} -base {directory} -purpose mhp_sign
Note that you need to add certificates nearest to the root certificate
first, and work down to the leaf certificate last. The default
"purpose" is mhp_sign.
-
You can view the content of a certificate by using the following command:
ocapsfg x509 -text -in {filename.cert}
-
Generate a
Permission Request File
and place in the same directory as the application initial class, naming the
file as ocap.<application name>.perm. Note, this should be the name of
the initial class without the .class extension.
-
Sign application:
ocapsfg sign -certfile {filename.cert} -keyfile {your.key} -sigdir {root} -xmlcred {sigfile.xml} -base {dir}
Where: {filename.cer} is the path name of your leaf certificate,
{your.key} is your private key, {root} is the root of the OCAP
application directory structure, {sigfile.xml} is the
signature control file
and {dir} is the
directory containing the OCAP SFG default file structure.
Note that if CableLabs has assigned you a private key with a pass phrase
(which is most likely) you will be prompted to enter that after executing the
above command.
or if you are using a
config file:
ocapsfg sign -config {config.xml} -sigdir {dir} -xmlcred {sigfile.xml}
-
Checking a signature:
ocapsfg sign -check -sigdir root -suffix 1
Where -suffix denotes the suffix number of the
ocap.certificates and ocap.signaturefile files.
OCAP SFG
