This chapter describes the procedure to sign an eAIP package using x509. See also the eAIP Security Risks and Mitigation Strategies in the eAIP Specification.
You need software to create Zip packages. The most widely used is WinZip.
You also need to have a CA set up, as described in How to setup up a x509 signing environment.
The steps are:
The eAIP Signing tool is provided by EUROCONTROL and is part of the full eAIP package (in the tools\Security\Sign directory), also available on the eAIP Web site. It is also available as a separate download package; in this case, download this package and unpack it in the [eAIP package directory]\tools\Security\Sign directory.
Open the XCA application.
Click on the Certificate tab on top, then expand the certificate list in order to display the signer's certificate.
Right-click on the signer's certificate and choose the Export / File option.
In the Filename field, type [eAIP package directory]\tools\Security\Sign\Certificate, followed by the certificate filename. The name must not contain spaces and should end with the suffix .crt.
Select PEM as Export Format. Click OK to export the certificate.
Click on the RSA Keys tab on top. Right-click on the signer's private key and choose the Export option.
In the Filename field, type [eAIP package directory]\tools\Security\Sign\PrivateKey, followed by the private key filename. The name must not contain spaces and should end with the suffix .pem.
Select PEM as Export Format.
Make sure Export the private part of the Key too is checked, and Encrypt the key with a password is not checked.
Click OK to export the private key.
Generate a single Zip package containing the eAIP. Save this file in the [eAIP package directory]\tools\Security\Sign directory. For example, name this file EC-eAIP.zip.
Open a command-prompt window and change the current directory to [eAIP package directory]\tools\Security\Sign.
Type sign EC-eAIP.zip. You will find, in the same directory, a new file EC-eAIP.zip.sig, which is the signed package you can distribute.
Steps for distribution
Send the CA certificate to end-users who request it. Steps to export the certificate are described in How to setup up a x509 signing environment
Send the signed package