how to remove the notation store and generate new certificate with longer validity

[TnGadaria]

Hi,
I was performing a few tests. I used notation cert generate-test to generate the cert and key. That worked fine, however, it expired in a day. Now, I am unable to delete the key and cert in store, hence not able to generate a new store with the same name.

Can someone please provide the steps to remove the cert, key, and store? Also, provide the details to generate new store, cert and key with longer validity.

[FeynmanZhou]

Hi @TnGadaria ,

It is by design that the test key and cert generated by notation cert generate-test will be expired after 1 day. You can remove the test key and cert using notation key delete and notation cert delete. See https://notaryproject.dev/docs/user-guides/cli-reference/notation_certificate_delete/. Alternatively, you can re-generate a new test key and cert using notation cert generate-test with another cert name.

If you want to sign using a key cert pair with longer validity for testing purposes, you can use openssl to generate a test key and cert and then add them to the notation trust store.

Is this answer helpful?

[TnGadaria]

Hi @FeynmanZhou ,
Thanks for the reference document to delete the key and cert.

To add the openssl generated key to the notation trust store I could find this command notation key add --plugin <plugin_name> [flags] <key_name> only. Can you provide more details on this or Do we have any reference doc link for this?

[shizhMSFT]

Linking issue #647

[TnGadaria]

I found this link: #539 (comment) as workaround for now to add the key.

[yizha1]

Thanks @TnGadaria you managed to find the workaround. We will consider to document it so that others can refer to it.