HSM Configuration

By completing section 5 successfully, you can now start setting up and deploying your CA(s). In this section, we are going to discuss the options those we have in terms of integrating EJBCA with Utimaco’s CryptoServer over the PKCS#11 interface and maximizing security over the sensitive CA key material. As mentioned, there are two possible ways to integrate an Utimaco HSM into an EJBCA installation and both will be presented in the following two subsections. Regardless of which configuration one will choose, there are some steps that have to be taken in advance in order to configure a PKCS#11 slot which will then be used for the generation and storage of the CA’s keys.

Use p11tool to initialize a slot on the HSM (in this example slot 1).

# ./p11tool Slot=1 InitToken=officer1  
# ./p11tool Slot=1 Label=CVCA LoginSO=officer1 InitPin=user1  

When done, use the pkcs11HSM tool from the EJBCA toolbox to generate a sign key, default key and test key on the initialized slot. The process of generating keys is listed below.

# cd $EJBCA_HOME/bin  
# ./pkcs11HSM.sh generate ./libcs2_pkcs11.so 4096 signKey 1 \  
PKCS11 Token \  
[SunPKCS11-libcs2_pkcs11.so-slot1] Password:  
# ./pkcs11HSM.sh generate ./libcs2_pkcs11.so 2048 defaultKey 1 \  
PKCS11 Token \  
[SunPKCS11-libcs2_pkcs11.so-slot1] Password:  
# ./pkcs11HSM.sh generate ./libcs2_pkcs11.so 1024 testKey 1 \  
PKCS11 Token \  
[SunPKCS11-libcs2_pkcs11.so-slot1] Password:  

Use user1 as a password to generate above keys. This finishes the slot initialization and respective key generation upon which you can now set up a CA. It is possible to observe the pkcs11 objects created on the slot by using the p11tool like shown below.

# ./p11tool Slot=1 Login=user1 ListObjects