For OpenJDK17 with an EC Key Using a Self-Signed Certificate

1. Generate an EC keypair on the Utimaco HSM.

# keytool -genkey -alias tomssleckey -keyalg EC -keystore NONE -storetype 
PKCS11 -storepass 12345678 -providername SunPKCS11-CryptoServer -v 

Provide information when prompted here:

• EC is the key algorithm

• NONE is the keystore for HSM

• PKCS11 is the storetype

• 12345678 is the slot PIN

• SunPKCS11-CryptoServer is the provider name

• tomssleckey is the key name that will be generated on the Utimaco HSM

Keytool Command to Generate Keys

2. Verify that the keys have been generated by p11tool2.

# /opt/utimaco/bin/p11tool2 Slot=0 LoginUser=<passcode> ListObjects 

Created Key Details

List Keys Output Using p11tool2

3. List the keys using the keytool command.

# keytool -list -keystore NONE -storetype PKCS11 -providername SunPKCS11-CryptoServer -storepass 12345678 -v 

Here:

• NONE is the keystore for HSM

• PKCS11 is the storetype

• 12345678 is the slot PIN

• SunPKCS11-CryptoServer is the provider name

Keytool Command to List Keys

Keytool List Output