With RSA Key (Self Signed Certificate)

1. Generate a keypair on Utimaco HSM.

# keytool -genkeypair -alias utimacoRSAKey -keyalg RSA -keysize 2048 -keystore NONE -storetype PKCS11 -providerClass sun.security.pkcs11.SunPKCS11 -providerArg /etc/utimaco/pkcs11-java.cfg

Provide information when prompted Here:

• RSA is the key algorithm

• 2048 is the key size

• NONE is the keystore for HSM

• PKCS11 is the storetype

• sun.security.pkcs11.SunPKCS11 is the provider class

• utimacoRSAKey is the key name that will be generated on Utimaco HSM

Provide the keystore password when prompted

Key generation using keytool command

2. Verify the entry with same alias name is generated using keytool command.

# keytool -list -keystore NONE -storetype PKCS11 -providerClass sun.security.pkcs11.SunPKCS11 -providerArg /etc/utimaco/pkcs11-java.cfg  

Here:

• NONE is the keystore for HSM

• PKCS11 is the storetype

• sun.security.pkcs11.SunPKCS11 is the provider class

Provide the keystore password when prompted.

Listkeys output

3. List the objects using p11tool2.

# ./p11tool2 Slot=0 LoginUser=ask ListObjects

Enter user PIN when prompted.

List keys output using p11tool2

4. Sign any sample jar file with jarsigner command.

# jarsigner -tsa http://timestamp.digicert.com -keystore NONE -storetype PKCS11 -providerClass sun.security.pkcs11.SunPKCS11 -providerArg /etc/utimaco/pkcs11-java.cfg -signedjar HelloWorldRSASigned.jar HelloWorld.jar utimacoRSAKey

Here:

• http://timestamp.digicert.com is URL of timestamp server

• NONE is the keystore for HSM

• PKCS11 is the storetype

• sun.security.pkcs11.SunPKCS11 is the provider class

• HelloWorldRSASigned.jar is the new output signed jar file that will be generated

• HelloWorld.jar is the Jar file to be signed

• utimacoRSAKey is the RSA key used for jar signing

Provide the keystore password when prompted.

Signing the jar using jarsigner command

5. Verify the signed jar.

# jarsigner -verify HelloWorldRSASigned.jar

Here HelloWorldRSASigned.jar is the newly generated signed jar file.

Verifying signed jar