Relax PK and DB key usage constraints and try to follow what OEMs do

* Since OEMs, including Microsoft, don't set key usage, and since we had trouble with that
  in #19, remove it altogether.
* On the other hand, since all the OEMs we see seem to use them, add subject_key_identifier
  and authority_key_identifier.
* Also make sure we set up a proper context in AddExtension().

Author: pbatard

src/pki.c

@@ -121,8 +121,10 @@ STATIC EFI_STATUS AddExtension(
 {
 	EFI_STATUS Status = EFI_SUCCESS;
 	X509_EXTENSION *ex = NULL;
+	X509V3_CTX ctx;
 
-	ex = X509V3_EXT_nconf_nid(NULL, NULL, ExtNid, (char *)ExtStr);
+	X509V3_set_ctx(&ctx, Cert, Cert, NULL, NULL, 0);
+	ex = X509V3_EXT_nconf_nid(NULL, &ctx, ExtNid, (char *)ExtStr);
 	if (ex == NULL)
 		ReportOpenSSLErrorAndExit(EFI_UNSUPPORTED);
 
@@ -173,9 +175,12 @@ EFI_STATUS GenerateCredentials(
 	// Set version
 	X509_set_version(Cert, 2);
 
-	// Set usage for code signing as a Certification Authority
-	AddExtension(Cert, NID_basic_constraints, "critical,CA:TRUE");
-	AddExtension(Cert, NID_key_usage, "critical,digitalSignature,keyCertSign");
+	// Set usage to what OEMs typically use for PK. Should also work fine for DB.
+	// Avoid restricting key usage and avoid critical, as some UEFI firmwares do
+	// take objection to a signed cert with an improperly declared key usage.
+	AddExtension(Cert, NID_basic_constraints, "CA:TRUE");
+	AddExtension(Cert, NID_subject_key_identifier, "hash");
+	AddExtension(Cert, NID_authority_key_identifier, "keyid:always,issuer");
 
 	// Set subject key identifier
 	ASN1_OCTET_STRING *Skid = ASN1_OCTET_STRING_new();