Key Rollover for KSK and ZSK

Generate New KSK and ZSK

Generate new key pair as ksk1 and zks1 on HSM as below.

›_ Console
`# p11tool2 slot=0 LoginUser=ask PubKeyAttr=CKA_LABEL=”ksk1” PrvKeyAttr=CKA_LABEL=”ksk1” GenerateKeyPair=RSA # p11tool2 slot=0 LoginUser=ask PubKeyAttr=CKA_LABEL=”zsk1” PrvKeyAttr=CKA_LABEL=”zsk1” GenerateKeyPair=RSA`

›_ Console

# p11tool2 slot=0 LoginUser=ask PubKeyAttr=CKA_LABEL=”ksk1” PrvKeyAttr=CKA_LABEL=”ksk1” GenerateKeyPair=RSA 

 

# p11tool2 slot=0 LoginUser=ask PubKeyAttr=CKA_LABEL=”zsk1” 

PrvKeyAttr=CKA_LABEL=”zsk1” GenerateKeyPair=RSA

If you want to generate new ECC keys, follow the steps in section Generating KSK and ZSK with ECC Algorithm.