Generating SSL Key and Certificate on Windows for RSA Key and Certificate Generation

1. Generate a keypair on Utimaco HSM with the help of keytool command.

C:\Program Files\IBM\WebSphere\AppServer\java\8.0\jre\bin>keytool.exe -genkey 
-alias ibmrsa -keyalg RSA -keysize 2048 -keystore NONE -storetype PKCS11IMPLKS -providername IBMPKCS11Impl-CryptoServer 

Provide information when prompted.

Here:

• RSA is the key algorithm

• 2048 is the key size

• NONE is the keystore for HSM

• PKCS11IMPLKS is the storetype

• IBMPKCS11Impl-CryptoServer is the provider name

• ibmrsa is the key name that will be generated on Utimaco HSM

Provide the keystore password when prompted.

Key generation using keytool command

2. Verify the entry with same alias name is generated using keytool command.

C:\Program Files\IBM\WebSphere\AppServer\java\8.0\jre\bin>keytool -list keystore NONE -storetype PKCS11IMPLKS -providername IBMPKCS11Impl-CryptoServer 

Here:

• NONE is the keystore for HSM

• PKCS11IMPLKS is the storetype

• IBMPKCS11Impl-CryptoServer is the provider’s name

Provide the keystore password when prompted.

Keytool list output

3. List the objects using p11tool2.

C:\Program Files\Utimaco\SecurityServer\Administration>p11tool2.exe slot=0 Loginuser=ask ListObjects 

Enter user PIN when prompted.

ListObjects output using p11tool2

4. Generate a CSR using Keytool command.

C:\Program Files\IBM\WebSphere\AppServer\java\8.0\jre\bin>keytool.exe -certreq 
-alias ibmrsa -keystore NONE -storetype PKCS11IMPLKS -providername IBMPKCS11Impl-CryptoServer -file ibm.csr 

Generate CSR command output

Here:

• NONE is the keystore for HSM

• PKCS11IMPLKS is the storetype

• IBMPKCS11Impl-CryptoServer is the provider name

• ibmrsa is the key name

• ibm.csr is the CSR file name that will be generated

Provide keystore password when prompted.

5. Get this CSR signed by CA.

6. Copy the signed certificate and root CA certificate on the IBM WebSphere application server.

7. Import Root CA certificate into HSM keystore.

C:\Program Files\IBM\WebSphere\AppServer\java\8.0\jre\bin>keytool.exe importcert -alias rootca -file C:\Users\Downloads\RootCA.crt -storetype PKCS11IMPLKS -keystore NONE -providername IBMPKCS11Impl-CryptoServer 

Importing root CA certificate into keystore

8. Import the signed certificate reply using the command below.

C:\Program Files\IBM\WebSphere\AppServer\java\8.0\jre\bin>keytool.exe importcert -alias ibmrsa -file C:\Users\Downloads\rsa_demo.p7b -storetype PKCS11IMPLKS -keystore NONE -providername IBMPKCS11Impl-CryptoServer 

Importing user certificate into keystore

9. Verify that the keytool command shows the signed certificate as well as root CA certificate.

C:\Program Files\IBM\WebSphere\AppServer\java\8.0\jre\bin>keytool -list keystore NONE -storetype PKCS11IMPLKS -providername IBMPKCS11Impl-CryptoServer 

Here:

• NONE is the keystore for HSM

• PKCS11IMPLKS is the storetype

• IBMPKCS11Impl-CryptoServer is the provider’s name

Provide the keystore password when prompted.

Keytool list output showing signed certificate as well as root CA certificate