For OpenJDK 8 with EC Key

HR 1. Generate an EC key pair on the Utimaco HSM.

Provide information when prompted.

Here:

• EC is the key algorithm

• NONE is the keystore for HSM

• CryptoServer is the store type

• 12345678 is the PIN

• CryptoServer is the provider name

• tomcatsslECKey is the key name that will be generated on the Utimaco HSM

Key generation using keytool command output

2. Verify that the keys have been generated using the keytool command.

Here:

• NONE is the keystore for HSM

• CryptoServer is the store type

• 12345678 is the slot PIN

• CryptoServer is the provider name

Keytool list output

3. List the keys using cxitool.

List keys output using cxitool

4. Generate a CSR using the keytool command.

keytool -certreq output

Provide user PIN when prompted for keystore password.

Here:

• tomcatsslECKey is the key name

• NONE is the keystore for HSM

• CryptoServer is the store type

• test.csr is the CSR file name that will be generated

5. Get this CSR signed by CA.

6. Copy the signed certificate along with the root CA certificate chain to the Tomcat server.

7. Import the signed certificate chain reply using the command below.

Import user certificate into key store

8. Verify that the keytool command shows the signed certificate

Here:

• NONE is the key store for the HSM

• CryptoServer is the store type

• 12345678 is the slot PIN

• CryptoServer is the provider name

Keytool list output