Breadcrumbs

For EC Key

  1. Generate an EC keypair on Utimaco HSM.

›_ Console 

# keytool -genkey -keyalg EC -keystore NONE -storetype CryptoServer -storepass 

12345678 -providername CryptoServer -alias jbosseckey

Provide information when prompted. Here:

  • EC is the key algorithm.

  • NONE is the keystore for HSM.

  • CryptoServer is the storetype.

  • 12345678 is the slot PIN.

  • CryptoServer is the provider name.

  • jbosseckey is the key name that will be generated on Utimaco HSM.

image-3285450979-1.jpg

Key generation using keytool command

2. Verify that the keys have been generated.

›_ Console 

# keytool -list -keystore NONE -storetype CryptoServer -providername 

CryptoServer -storepass 12345678 -v

Here:

  • NONE is the keystore for HSM.

  • CryptoServer is the storetype.

  • 12345678 is the slot PIN.

  • CryptoServer is the provider’s name.

image-3285450979-2.jpg

List keystore entries

image-3285450979-3.jpg

List keystore entries

  1. List the keys using cxitool.

›_ Console 

# cxitool Dev=<HSM_IP> Logonpass=<user_name>,<PIN> Group=<cxi_group_name>} Listkeys
image-3285450979-4.jpg

List keys output using cxitool

  1. Generate a CSR using the Keytool command.

›_ Console 

# keytool -certreq -alias jbosseckey -file jbosseckey.csr -storetype 

CryptoServer -keystore NONE -v
image-3285450979-5.jpg

CSR generation

Provide the keystore password when prompted. Here:

  • NONE is the keystore for HSM.

  • CryptoServer is the storetype.

  • CryptoServer is the provider name.

  • jbosseckey is the key name.

  • jbosseckey.csr is the CSR file name that will be generated.

  1. Get this CSR signed by CA.

  2. Copy the signed certificate along with Root CA certificate on the JBoss server.

  3. Import the Root certificate into the HSM keystore. Type yes when prompted.

›_ Console 

# keytool -importcert -alias RootCA -file /opt/rootca.crt -storetype 

CryptoServer -keystore NONE -providername CryptoServer -storepass 12345678
image-3285450979-6.jpg

Importing root CA certificate into keystore

  1. Import the signed certificate using the command below.

›_ Console 

# keytool -importcert -alias jbosseckey -file /opt/JbossECKey.pem -storetype 

CryptoServer -keystore NONE -providername CryptoServer -storepass 12345678
image-3285450979-7.jpg

Import signed certificate into keystore

  1. List the keystore entries.

›_ Console 

# keytool -list -keystore NONE -storetype CryptoServer -providername 

CryptoServer -storepass 12345678 -v

Here:

  • NONE is the keystore for HSM.

  • CryptoServer is the storetype.

  • 12345678 is the slot PIN.

  • CryptoServer is the provider’s name.

image-3285450979-8.jpg

keytool list output

image-3285450979-9.jpg

keytool list output