Breadcrumbs

For RSA Key

1. Log in as root user and generate a keypair on Utimaco HSM.

›_ Console 

# keytool -genkey -keyalg RSA -keysize 2048 -keystore NONE -storetype 

CryptoServer -storepass 12345678 -providername CryptoServer -alias jbossrsa

Provide information when prompted. Here:

  • RSA is the key algorithm.

  • 2048 is the key size.

  • NONE is the keystore for HSM.

  • CryptoServer is the storetype.

  • 12345678 is the slot PIN.

  • CryptoServer is the provider name.

image-3286040734-1.jpg

Key generation using the keytool command

2. Verify that the keys have been generated using the keytool command.

›_ Console 

# keytool -list -keystore NONE -storetype CryptoServer -providername 

CryptoServer -storepass 12345678 -v

Here:

  • NONE is the keystore for HSM.

  • CryptoServer is the storetype.

  • 12345678 is the slot PIN.

  • CryptoServer is the provider’s name.

image-3286040734-2.jpg

List keystore entries

  1. List the keys using cxitool.

›_ Console 

# cxitool Dev=<HSM_IP> Logonpass=<user_name>,<PIN> Group=<cxi_group_name>} Listkeys
image-3286040734-3.jpg

List keys output using cxitool

  1. Generate a CSR using Keytool command.

›_ Console 

# keytool -certreq -alias jbossrsa -file rsa.csr -storetype CryptoServer keystore NONE -v
image-3286040734-4.jpg

CSR generation

Provide the keystore password when prompted. Here:

  • NONE is the keystore for HSM.

  • CryptoServer is the storetype.

  • CryptoServer is the provider name.

  • jbossrsa is the key name.

  • rsa.csr is the CSR file name that will be generated.

  1. Get this CSR signed by CA.

  2. Copy the signed certificate along with Root CA certificate on the JBoss server.

  3. Import the Root certificate into the HSM keystore. Type yes when prompted.

›_ Console 

# keytool -importcert -alias RootCA -file /opt/TestCA-Root.crt -storetype 

CryptoServer -keystore NONE -providername CryptoServer -storepass 12345678
image-3286040734-5.jpg

Import root CA certificate into keystore

  1. Import the signed certificate using the command below.

›_ Console 

# keytool -importcert -alias jbossrsa -file /opt/Jboss.pem -storetype 

CryptoServer -keystore NONE -providername CryptoServer -storepass 12345678
image-3286040734-6.jpg

Import signed certificate into keystore

  1. List the keystore entries.

›_ Console 

# keytool -list -keystore NONE -storetype CryptoServer -providername 

CryptoServer -storepass 12345678 -v
image-3286040734-7.jpg

Keytool list output

image-3286040734-8.jpg

Keytool list output