For OpenJDK17 with an RSA Key Using a Self-Signed Certificate

1. Generate an RSA keypair on the Utimaco HSM.

# keytool -genkey -keyalg RSA -keysize 2048 -keystore NONE -storetype PKCS11 storepass 12345678  -providername SunPKCS11-CryptoServer -alias tomcatrsa17 

Provide information when prompted here:

• RSA is the key algorithm

• 2048 is the key size

• NONE is the keystore for HSM

• PKCS11 is the storetype

• 12345678 is the slot PIN

• SunPKCS11-CryptoServer is the provider name

• tomcatrsa is the key name that will be generated on the Utimaco HSM

RSA Key Generation Using a Self‑Signed Certificate

2. Verify that the keys have been generated by p11tool2.

# /opt/utimaco/bin/p11tool2 Slot=0 LoginUser=<passcode> ListObjects 

Certificate Details

Key Details

3. List the keys using the keytool command.

# keytool -list -keystore NONE -storetype PKCS11 -providername SunPKCS11-CryptoServer -storepass 12345678 -v 

Here:

• NONE is the keystore for HSM

• PKCS11 is the storetype

• SunPKCS11-CryptoServer is the provider name

• 12345678 is the slot PIN

Keytool List Command

Keytool List Output