These are the procedures to follow when adding a root and/or intermediate certificate to the system.

For the purposes of these instructions, assume that $SRCDIR is e.g. ~/tla and that LOCAL_BUILD_DIR points to your build directory. For purposes of illustration, assume that you have checked out the security_certificates project to the directory SECCERTDIR:

	cvs.src -q co -d SECCERTDIR security_certificates

In practice, this would be something like security_certificates-PR-3XXXXXX.

To add a root certificate:

- Convert the certificate to DER form with either a .der, .crt, or .cer extension
- Copy the file to $SECCERTDIR/roots/
- Add the file to the security_certificates.xcode project in the "roots" folder, target security_certificates
- Open the security_certificates target and drag (copy) the file to the top "Copy Files" section
- Install the result via buildit or 'xcodebuild install':

	cd $SECCERTDIR
	sudo ~rc/bin/buildit . install

   This will copy the files listed in the project to the directories:

	/tmp/SECCERTDIR.roots/SECCERTDIR~dst/System/Library/Keychains/Anchors
	/tmp/SECCERTDIR.roots/SECCERTDIR~dst/System/Library/Keychains/Certificates

   It does NOT create or modify the system keychains.

- Run 

	export ROOTTMP=/tmp/SECCERTDIR.roots/SECCERTDIR~dst/System/Library/Keychains/Anchors
	$SRCDIR/SecurityTests/clxutils/anchorTest/anchorSourceTest  $ROOTTMP

- The "buildCertKeychains" script will move the existing system keychain out of the way and create a new keychain from
   built directories above. Run it with:

	sudo $SRCDIR/SecurityTests/clxutils/anchorTest/buildCertKeychains anchors $ROOTTMP

   Note that this needs to be run again if you have intermediates; this only operators on X509Anchors

- Run anchorTest:

	$LOCAL_BUILD_DIR/anchorTest

   This assumes that you have built the csp and cl tests

- Finally, add the file(s) to cvs on a branch

To add an intermediate certificate:

- Follow the steps above "To add a root certificate:" if necessary. The project file additions can be done simultaneously,
   but the roots must be actually installed for the intermediate tests to run properly.
- Convert the certificate to DER form with either a .der, .crt, or .cer extension
- Copy the file to tla/security_certificates/certs/
- Add the file to the security_certificates.xcode project in the "certs" folder
- Open the security_certificates target and drag (copy) the file to the bottom "Copy Files" section
- Install the result via buildit or 'xcodebuild install', installing raw intermediate certs into __some_cert_dir__
- Run 
  % tla/SecurityTests/clxutils/anchorTest/anchorintermedSourceTest __some_cert_dir__
- Build new X509Certificates using clxutils/anchorTest/buildCertKeychains like so (as root):
   % clxutils/anchorTest/buildCertKeychains certs __some_cert_dir__
- Run tla/SecurityTests/clxutils/anchorTest/intermedTest
- Add the file to cvs

To pre-flight an intermediate certificate

- Assume that the intermediate is intermed.crt with corresponding root root.crt
- Run

	$LOCAL_BUILD_DIR/certcrl -c intermed.crt -C root.crt -f

To remove a root or intermediate

- Remove the file from the project
- Remove the file from cvs

To make the test tools

- cd tla/SecurityTests/cspxutils
- set LOCAL_BUILD_DIR
- make all

Converting from PEM

- openssl x509 -outform DER -in SoneraClass1CA.pem -out SoneraClass1.crt

Description of tools

intermedTest - verifies contents of /System/Library/Keychains/X509Certificates. Run with no args, or with ‘q’ for quiet.

anchorSourceTest - like anchorTest but just tests a directory full of anchor certs. Intended to pre-screen changes to security_certificates/roots. Run with one arg, a path to the directory full of root certs. Run with no args to get a hint.

intermedSourceTest - like intermedTest crossed with anchorSourceTest. Prescreens a directory full of intermediate certs. Run with one arg, a path to the directory full of intermediate certs. Run with no args to get a hint. All of these must be verifiable by the current X509Anchors (so if you add an intermediate and the associated root to the security_certificates project, without updating X509Anchors, this test will fail).

Run SecurityTests/clxutils/anchorTest on a machine with the new roots installed

For intermediate certificates, run:

	$BUILDDIR/certcrl -c VeriSign_TSA_CA.crt -C Class3_PCA_G2_v2.crt -f