HTTPS root certificate patch

[TorutheRedFox]

To get HTTPS working with a custom gameserver, we need to patch the root certificate with our own, specifically the one used to sign the certificate used by the gameserver itself

I can't remember which of the games I pulled this out of, but this is one of them anyways, and it's in PEM format in the EBOOT as shown below

-----BEGIN CERTIFICATE-----
MIIDujCCAqKgAwIBAgIUAQAAAAAAAAAAAAAAAAAAAAAAAAAwDQYJKoZIhvcNAQEF
BQAwgZYxCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJDQTESMBAGA1UEBxMJU2FuIERp
ZWdvMTEwLwYDVQQKEyhTT05ZIENvbXB1dGVyIEVudGVydGFpbm1lbnQgQW1lcmlj
YSBJbmMuMRQwEgYDVQQLEwtTQ0VSVCBHcm91cDEdMBsGA1UEAxMUU0NFUlQgUm9v
dCBBdXRob3JpdHkwHhcNMDUwMTAxMTIwMDAwWhcNMzQxMjMxMjM1OTU5WjCBljEL
MAkGA1UEBhMCVVMxCzAJBgNVBAgTAkNBMRIwEAYDVQQHEwlTYW4gRGllZ28xMTAv
BgNVBAoTKFNPTlkgQ29tcHV0ZXIgRW50ZXJ0YWlubWVudCBBbWVyaWNhIEluYy4x
FDASBgNVBAsTC1NDRVJUIEdyb3VwMR0wGwYDVQQDExRTQ0VSVCBSb290IEF1dGhv
cml0eTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALKc0nZ71kfvzujJ
UeegRB6ZIK64dwY4HXm6b8q0i7YQWeCPT5uOPoQUC2gLtyUxn2vwhNWv4Zf/Dn/R
RSz7AbqD2KlcbwryIbQMBx6lOnG80baC0pCRFWCpxYRgrndxXYeotSceGD4t0+xc
T7qaR4X+z8s2M3zfpLtXiCQ6L9Fqzy+ZV3mEokkO26nG5LicnwSiPGO7yrkHFZGn
x30oLv7rhTh18iUUgd0Wzp7t+39OkcUo2mJnG9yMEtphA0JW0/LFZTsuIGWy4H6P
Ll9fvX/+ZZzx2+cTeGym6y7bIxorRAr246payX2v0ZmNyzz/SD4XC/ui0QNzuL0r
joG48o0CAwEAATANBgkqhkiG9w0BAQUFAAOCAQEAOgopH+NM7SJTvVDS90pS0vKY
AgMNi0o5wp8VKAvqFusZULN/dz+gXSwfwydzCJteZfTw8Xs+iYIRgGqqAuTaV1xT
TGDaHYgCw1EUF4chNKtQ8PjFb7nOFJOGd25Aedr4W09g2sTAtz7htsED0703odZM
FTk9g6Q1wrP/ZWRIYKHSXYMSwssmMpgMeb7v0z7tgqizbppnu9BC/BcaST2yliLO
rrlrBCNoL34oHSz9Wd9JexamZ4JQkiU8ViIyRfaey9/qGZRdVv/sJkxFv4zqGk/t
iRmeyTsNzoS+i+Fk3qbajbJcAd3TesHckyWcODi46+jf4VZxqIZLNXRqvJmanw==
-----END CERTIFICATE-----

[Zaprit]

Here's some info about the cert, not sure if that's of any use

[Zaprit]

"self signed certs are fine if you own the console"

• Some Sony developer probably

[TorutheRedFox]

I mean technically this is a self signed cert already as it's not in the console's certificate store lol

[TorutheRedFox]

and for anyone interested, here's the server certificate from before PS3 support was dropped

-----BEGIN CERTIFICATE-----
MIIDGDCCAgCgAwIBAgIUAQAAAAAAAAAAAAAAUgAAAAAAARcwDQYJKoZIhvcNAQEF
BQAwgZYxCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJDQTESMBAGA1UEBxMJU2FuIERp
ZWdvMTEwLwYDVQQKEyhTT05ZIENvbXB1dGVyIEVudGVydGFpbm1lbnQgQW1lcmlj
YSBJbmMuMRQwEgYDVQQLEwtTQ0VSVCBHcm91cDEdMBsGA1UEAxMUU0NFUlQgUm9v
dCBBdXRob3JpdHkwHhcNMTQwNDI2MDAwNjI4WhcNMjQwNDI0MjM1OTU5WjB5MQsw
CQYDVQQGEwJHQjEPMA0GA1UECBMGTG9uZG9uMQ8wDQYDVQQHEwZMb25kb24xDTAL
BgNVBAoTBFNDRUUxDDAKBgNVBAsTA01JUzErMCkGA1UEAxMibGl0dGxlYmlncGxh
bmV0cHMzLm9ubGluZS5zY2VlLmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkC
gYEAll+A09dUFVKb1AyeidUIAOsbDkvsTGAP7ajP+Jjm/JS6e7j8WpYBruyGNzHj
KdYjJE17mdM91YNFQiOElXCSVzZHeVUfWarkPprWjEm0sIxqt2pqUPF4YV9Hq3sZ
jmwBZXSi9kgNI5BDTGz5dqXev699l2bhvCaskf9xPZcv3g8CAwEAATANBgkqhkiG
9w0BAQUFAAOCAQEAKdfevwHB7rrB/Yh7UEYs4DSfGs+uwmOgR8CdxC/RO1C8W3F7
zb3QuMkMbUx2MPgzq7XczlFu78JZHCjecyvN88E+2NjIApjSeiOvcLlMcduU0GDo
IzJPJk7l8V9obvDlFEelP4H0fCDjo8KSpMDo9kOr5AZch+dzrAljABMiZ2mgTtUU
eDJxMUm+zxwULXSm1dp38w47FP/VLxb5ZesjgaKJs2PwCamSFlqTKzxf7KO+W6OB
33H276VoqaZQJpDPv1JlZHxhwcEcYteFODWtyb5xWSGDMiJ6Ef7A9O9hH58cteHx
FwX9FyVktU/FkMuGaaxhv3HUQMsCNfhsGLQSpQ==
-----END CERTIFICATE-----

[Zaprit]

more cert info, because why not, maybe we need to match crypto algorithms

[TorutheRedFox]

patching algorithms isn't necessary from my experience, and the game can have both URLs be HTTPS, but LBP3 needs a separate (wildcard) server certificate (signed by the same root) for the resource subdomains, as it doesn't support SANs

[TorutheRedFox]

personally I've also patched the template strings that the game uses to generate the resource URLs dynamically to be HTTPS too, which makes the above necessary

[TorutheRedFox]

so tl;dr getting the game to run over HTTPS exclusively is possible but it takes some work to get the server set up

the generation of the certs probably can be automated by integrating openssl into lighthouse though