With EC Key (CA Signed Certificate)

1. Generate an EC keypair on Utimaco HSM.

# keytool -genkey -alias ibmec -keyalg EC -keystore NONE -storetype PKCS11IMPLKS -providername IBMPKCS11Impl-CryptoServer 

Provide information when prompted Here:

• EC is the key algorithm

• NONE is the keystore for HSM

• PKCS11IMPLKS is the storetype

• IBMPKCS11Impl-CryptoServer is the provider name

• ibmec is the key name that will be generated on Utimaco HSM

Provide the keystore password when prompted

Key generation using keytool command

2. Verify the entry with same alias name is generated using keytool command.

# keytool -list -keystore NONE -storetype PKCS11IMPLKS -providername IBMPKCS11Impl-CryptoServer 

Here:

• NONE is the keystore for HSM

• PKCS11IMPLKS is the storetype

• IBMPKCS11Impl-CryptoServer is the provider name

Provide the keystore password when prompted

Listkeys output

3. List the objects using p11tool2.

Enter user PIN when prompted

List keys output using p11tool2

4. Generate a CSR using Keytool command.

# keytool -certreq -alias ibmec -keystore NONE -storetype PKCS11IMPLKS providername IBMPKCS11Impl-CryptoServer -file ec.csr

Here:

• NONE is the keystore for HSM

• PKCS11IMPLKS is the storetype

• Provide the keystore password when prompted

• IBMPKCS11Impl-CryptoServer is the provider name

• ibmec is the key name

• ec.csr is the CSR file name that will be generated

Provide the keystore password when prompted

5. Get this CSR signed by CA.

6. Copy the signed certificate and root CA certificate on the IBMPKCS11 server.

7. Import Root CA certificate into HSM keystore.

#  keytool -importcert -alias rootca -file /home/LAbCA-Root.crt storetype PKCS11IMPLKS -keystore NONE -providername IBMPKCS11ImplCryptoServer

Importing root certificate into keystore

8. Import the signed certificate reply using the command below.

#  keytool -importcert -alias ibmec -file /home/ec_demo.p7b -storetype PKCS11IMPLKS -keystore NONE -providername IBMPKCS11Impl-CryptoServer 

Import User Certificate into Keystore

9. Verify that the keytool command shows the signed certificate as well as root CA certificate.

# keytool -list -keystore NONE -storetype PKCS11IMPLKS -providername IBMPKCS11Impl-CryptoServer  

Here:

• NONE is the keystore for HSM

• PKCS11IMPLKS is the storetype

• IBMPKCS11Impl-CryptoServer is the provider’s name

Provide the keystore password when prompted

Listkeys output showing signed certificate as well as root CA 10. Sign any sample jar file using jarsigner tool

10. Sign any sample jar file using jarsigner tool.

# jarsigner -tsa http://timestamp.digicert.com -keystore NONE -storetype PKCS11IMPLKS -providername IBMPKCS11Impl-CryptoServer -signedjar sample_output.jar samples.jar ibmec 

Here:

• http://timestamp.digicert.com is URL of timestamp server

• NONE is the keystore for HSM

• PKCS11IMPLKS is the storetype

• IBMPKCS11Impl-CryptoServer is the provider’s name

• sample_output.jar is the new output signed jar file that will be generated

• samples.jar is the Jar file to be signed

• ibmec is the key name that will be used for signing

Provide the keystore password when prompted

Signing the jar using jarsigner command

11. Verify the signed jar.

# jarsigner -verify sample_output.jar -keystore NONE -storetype PKCS11IMPLKS -storepass 12345678 -providername IBMPKCS11Impl-CryptoServer 

Here sample_output.jar is the newly generated signed jar file

Verifying signed jar