For OpenJDK8 with RSA Key Using Self Sign Certificate

1. Generate a keypair on Utimaco HSM.

# keytool -genkey -keyalg RSA -keysize 2048 -keystore NONE -storetype PKCS11 storepass 123456  -providername SunPKCS11-CryptoServer -alias tomcatsslkey 

Provide information when prompted here:

• RSA is the key algorithm

• 2048 is the key size

• NONE is the keystore for HSM

• PKCS11 is the storetype

• 123456 is the slot PIN

• SunPKCS11-CryptoServer is the provider name

• tomcatsslkey is the key name that will be generated on Utimaco HSM

Keytool command to generate keys

2. Verify that the keys have been generated by p11tool2.

# /opt/utimaco/bin/p11tool2 Slot=0 LoginUser=123456 ListObjects 

Keytool list output using p11tool2

3. List the keys using keytool command.

# keytool -list -keystore NONE -storetype PKCS11 -providername SunPKCS11-
CryptoServer -storepass 123456 -v 

Here:

• NONE is the keystore for HSM

• PKCS11 is the storetype

• 123456 is the slot PIN

• SunPKCS11-CryptoServer is the provider name

Keytool list output