title: OpenSSL public key for Firefox extension signing
body: <p>I'm trying to bring back an old extension I made for Firefox 1.5 written in JavaScript. One of the changes introduced in Firefox 3.0 was the need for extension updates secured via either HTTPS or PKI. Since I can't use an SSL solution on my website, I need to use the PKI solution.</p>
  
  <p>So, first up is generating the private and public keys. I was able to create CA and client (code signing) certificates using OpenSSL by following <a href="http://blog.didierstevens.com/2008/12/30/howto-make-your-own-cert-with-openssl/" rel="nofollow">this guide</a>. So, how I have two key and certificate pairs: <code>ca.crt</code>, <code>ca.key</code>, <code>code.crt</code> and <code>code.key</code>.</p>
  
  <p>Now, I have to put the public key into the <code>install.rdf</code>'s <code>&lt;em:updateKey&gt;</code> field. I did this with the command <code>openssl -in code.key -outform DER -pubout</code> and copied the resulting output (sans the ^-----.* lines) into my <code>install.rdf</code>. Now, the public key generated in this way is base64-encoded and ends with a couple equals signs. I haven't seen any examples that actually have these trailing characters. Is that OK, or did I pass the wrong options to OpenSSL?</p>
  
  <p>Aside from this, using <code>uhura</code> to sign my <code>update.rdf</code> seems fairly straight-forward, but again there are no trailing =='s, which seems odd from the output I got via the OpenSSL command above.</p>
  
  <p>Any help would be greatly appreciated!</p>