For OpenJDK 8 with RSA Key

1. Generate an RSA key pair on the Utimaco HSM.

Provide information when prompted.

Here:

• RSA is the key algorithm

• 2048 is the key size

• NONE is the key store for HSM

• CryptoServer is the store type

• 12345678 is the PIN

• CryptoServer is the provider name

• tomcatsslkey is the key name that will be generated on the Utimaco HSM

Key generation using keytool command output

2. Verify that the keys have been generated with the keytool command.

Here:

• NONE is the key store for HSM

• CryptoServer is the store type

• 12345678 is the PIN

• CryptoServer is the provider name

Keytool list output

3. List the keys using the cxitool.

List keys output using the cxitool

4. Generate a CSR using the keytool command.

Provide the user PIN when you’re prompted for the key store password.

Here:

• tomcatsslkey is the key name

• CryptoServer is the store type

• test.csr is the CSR file name that will be generated

• NONE is the keystore for HSM

5. Get this CSR signed by the CA.

6. Copy the signed certificate along with the root CA certificate chain to the Tomcat server.

7. Import the signed certificate chain reply using the command below.

Import the user certificate into the key store

8. Verify that the keytool command shows the signed certificate.

Here:

• NONE is the keystore for the HSM

• CryptoServer is the store type

• 12345678 is the PIN

• CryptoServer is the provider name

Keytool list output