how can i generate cert.cbor and resource.msg

[Bouki6]

Hello .
I'm new with nginx and accept my apologies if the question is obvious.
i have SXG certificate from DigiCert. but in the SXG config i should give cert.cbor and resource.msg path.
how can i generate these files? all i have is pem file.
thank you in advance.

        sxg on;
        sxg_certificate     /path/to/sxg/mySxg.pem;
        sxg_certificate_key /path/to/sxg/mySxg.key;
        sxg_cert_url        https://website.test/certs/cert.cbor;
        sxg_validity_url    https://website.test/validity/resource.msg;
        sxg_cert_path       /certs/cert.cbor;

[hasan]

Hello,

normally plugin automatically generate cbor file from your pem file, or you can use gen-certurl tool

if you use the gen-certurl you should remove "sxg_cert_path" directive

[pratik149]

Hello,

normally plugin automatically generate cbor file from your pem file, or you can use gen-certurl tool

if you use the gen-certurl you should remove "sxg_cert_path" directive

Thanks Hasan.

I generated .cbor file for sxg_cert_url using gen-certurl, but I'm still unable to understand how to generate resource.msg for sxg_validity_url?

If you have managed to generate one, then can you please let us know?

[pratik149]

Hi @twifkak, can you please help us know how the validity information file looks like and how to generate one? In this doc not much is mentioned about it.

It only says that, "sxg_validity_url: URL for the validity information file. It must be https and must be the same origin with the website. This directive is always required."

Can you shed some more light on it and also document it as well for others who are new to signed exchanges?

[Bouki6]

Hello.
I finally manged to make it work. the sxg_validity_url its not implemented yet. all you have to do is give the config section a simple url. in my case the file doesn't even exist and it works just fine.
here is my website: ghabzino.com
you can check it out. i had series of problems. after about 2 months I'm not even sure it works or not!!!

[Bouki6]

@hasan the tricky part is you have to renew cbor file every day!!! i used gen-certurl tool in order to do that. unfortunately i couldn't do it with plugin.

[hasan]

@Bouki6

i'm having an issue about cert file after a few days it says certificate is not found on sxg validator extension, you can see #110

do you renew ssl certificate also or just cbor file (gen-certurl --pem /etc/nginx/sxg/domain.pem >> /etc/nginx/sxg/domain.cbor) ?

am i missing something about conf file ? could you share your nginx conf file concerning sxg part

[Bouki6]

Hello dear @hasan
this message indicates that your cbor file expired and no longer is valid. remember you have to renew your cbor file every day. according to the documents plugin can do it but unfortunately i couldn't use it. here is my config part:

		sxg on;
		sxg_certificate sxg/ghabzino.pem;
		sxg_certificate_key ssl/sxg/ghabzino.key;
		sxg_cert_url https://wl.ayanco.com/sxg/ghabzino.cbor;
		sxg_validity_url https://ghabzino.com/validity/resource.msg;
		sxg_expiry_seconds 604800;
		sxg_fallback_host ghabzino.com;