Importing the Private Key Inside the HSM (< 2.4.42) | Utimaco Integration Guides

To import the key safely inside the HSM, another RSA key pair has to be used for encryption during the transfer. If such a key pair is not available, a new one can be generated using p11tool2 from the product bundle:

$p11tool2 LoginUser=0000PubKeyAttr=CKA_LABEL="transfer",CKA_ID=0x313233PrvKeyAttr=CKA_LABEL="transfer",CKA_ID=0x313233GenerateKeyPair=RSA

For more details about p11tool2, see [CS_PKCS11T2].

The private key needs to be in a specific format before it can be imported: pkcs8 DER format, protected with a passphrase encoded with AES 128 ECB cipher. To transform it into that format, you can perform this command:

$openssl pkcs8 -inform PEM -outform DER -topk8 -v2 aes-128-ecb -passout pass:prv_key_der_pass -in prv_key.key -out prv_key.der

Having an RSA key pair inside the HSM and the private key in the correct format, you can import by performing the following command:

$openssl pkey -engine cs_pkcs11 -inform engine -in "import:token=CryptoServer%20PKCS11%20Token;kek-label=transfer;kek-id=123;key-label=apache;key-id=123;key-type=rsa;key-file=rsa-private-enc-2048.der;key-passphrase=prv_key_der_pass;pin-value=1234"-noout

key-file is the private key used by apache server for the https cryptographic operations. It can be find in the apache configuration file as the value for setting: SSLCertificateKeyFile. For Ubuntu this is in the file /etc/apache2/sites-available/default-ssl.conf. For Red Hat this is in the file /etc/httpd/conf.d/ssl.conf.

key-label and key-id are the label and the ID for the private key after it was moved inside the HSM. kek-label and kek-id are the label and the ID of the key used for encryption of the private key during the transfer.

The ID is provided in hexadecimal for p11tool2 and it is provided in ASCII code for the import command. So, in the previous examples (0x313233) represents the ASCII code sequence: 123.

Another method of importing the private key (less secure) is described in section "Importing the Private Key Into the HSM".