make_credential works

tools/ca_sign.sh

@@ -7,7 +7,7 @@ openssl req -new -key "$1" -out "$1".csr
 
 # CA sign the request
 echo "sign request with CA key"
-openssl x509 -days 18250 -req -in "$1".csr -CA "$2" -CAkey "$3" -out "$4" -set_serial 0
+openssl x509 -days 18250 -req -in "$1".csr -extfile v3.ext -CA "$2" -CAkey "$3" -out "$4" -set_serial 0
 
 echo "output as der"
 openssl  x509 -in "$4" -outform der -out "$4".der

tools/dump_pem.py

@@ -17,5 +17,14 @@ if len(sys.argv) not in [2]:
 pemkey = sys.argv[1]
 attestkey = ecdsa.SigningKey.from_pem(open(pemkey).read())
 
-print(binascii.hexlify(attestkey.to_string()))
-print(repr(attestkey.to_string()))
+hstr = binascii.hexlify(attestkey.to_string())
+print(hstr)
+
+cstr = ''
+it = iter(hstr)
+for d1 in it:
+    d2 = next(it)
+    cstr += '\\x'+d1+d2
+
+print('"%s"' % cstr)
+

tools/v3.ext

@@ -0,0 +1,3 @@
+authorityKeyIdentifier=keyid,issuer
+basicConstraints=CA:FALSE
+keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment