Generate Keys and Certificate for SSL

1. Generate the RSA key-pair using p11tool2.

2. Verify that the keys are generated onto the HSM using following command.

List objects output

3. Generate a certificate request.

Here apache is the token label and RSAKey is the key on the HSM. Provide Cryptouser PIN when prompted. apache.csr is the certificate signing request file. Also provide other required information for certificate when prompted.

Generate CSR certificate output

4. Get this CSR signed by your CA and copy the signed certificate to Apache server.

5. Alternatively, you can create the self-signed certificate based on the generated key.

Here apache is the token label and RSAKey is the key on the HSM. Provide Cryptouser PIN when prompted. Also provide other required information for certificate when prompted.

Generate self-signed certificate output

Certificate file output