#1142288 swupdate cannot read public certificate

Package:
swupdate
Source:
swupdate
Description:
Software update framework for embedded systems
Submitter:
Quirin Gylstorff
Date:
2026-07-19 19:21:02 UTC
Severity:
normal
#1142288#5
Date:
2026-07-17 07:21:33 UTC
From:
To:
Dear Maintainer,

SWUpdate is build for signed images by default. If I create a
certificate according to [1]. The following error occurs:

```
root@5c422e3506bf:/# swupdate
Error: SWUpdate is built for signed images, provide a public key file.
root@5c422e3506bf:/# openssl req -x509 -newkey rsa:4096 -noenc -keyout mycert.key.pem \
    -out mycert.cert.pem -subj "/O=SWUpdate/CN=target" \
    -addext extendedKeyUsage=1.3.6.1.5.5.7.3.4 -addext keyUsage=digitalSignature
root@5c422e3506bf:/# swupdate -k mycert.cert.pem
SWUpdate v2026.05.1

Licensed under GPLv2. See source distribution for detailed copyright notices.

[ERROR] : SWUPDATE failed [0] ERROR : mbedtls_pk_parse_public_keyfile: -15714
[ERROR] : SWUPDATE failed [0] ERROR : Error: Crypto cannot be initialized.
```

Best regards
Quirin

[1]: https://sbabic.github.io/swupdate/signed_images.html#generating-self-signed-certificates
#1142288#8
Date:
2026-07-17 11:07:23 UTC
From:
To:
Please check your digest provider. You are generating a certificate for
pkcs#7mbedtls but the mbedtls_pk_parse_public_keyfile error point to
mbedtlsRSA being active at runtime. You can force the provider with
the --digest-provider option.
#1142288#13
Date:
2026-07-19 18:56:09 UTC
From:
To:
Hi,
swupdate -v -k mycert.cert.pem --digest-provider pkcs#7mbedtls
it works.

Best regards
Quirin
#1142288#16
Date:
2026-07-19 18:56:09 UTC
From:
To:
Hi,
swupdate -v -k mycert.cert.pem --digest-provider pkcs#7mbedtls
it works.

Best regards
Quirin
#1142288#21
Date:
2026-07-19 19:18:04 UTC
From:
To: