HSM Integration via the EJBCA Configuration Files

The alternative setup path is to directly edit the relevant configuration files in your EJBCA home directory and add the necessary information to interface of EJBCA with an Utimaco HSM via the pkcs11 API. To do so, change directory to EJBCA/conf directory and remove the .sample from the name of configuration files: install.properties, catoken.properties and ejbca.properties. After changing the name of configuration files, open the install.properties file and edit the lines given below accordingly.

ca.name=the CA name  
ca.dn=CN=the CA name, O=organization name, C=a two letter country code  
ca.tokentype=org.ejbca.core.model.ca.catoken.PKCS11CAToken  
ca.tokenpassword= slot password according to your initialization  
ca.tokenproperties=/opt/pki/ejbca/conf/catoken.properties  
ca.keyspec=2048  
ca.keytype=RSA  
ca.signaturealgorithm=SHA1WithRSA  
ca.validity=3650  
ca.policy=null  

Edit those properties according to the PKCS#11 slot initialization and installation path that you used in preparation of the EJBCA setup. Finally, edit the file catoken.properties by adding the lines given below to your configuration.

defaultKey defaultKey  
certSignKey signKey  
crlSignKey signKey  
testKey testKey  
pin user1  
sharedLibrary /etc/utimaco/libcs2_pkcs11.so  

When all the files have been edited according to your custom configuration, you can start your EJBCA and use the secure environment that is offered by an HSM by following the procedure described in section 5.3.