Command Summary

mkdir -p /opt/utimaco/bin

Create directory for Utimaco binaries

mkdir -p /opt/utimaco/lib

Create directory for Utimaco libraries

cp ~/path_to_application_folder/lib/libcs_pkcs11_R3.so /opt/utimaco/lib

Copy PKCS#11 library to target directory

cp csadm p11tool2 /opt/utimaco/bin

Copy administration tools to binary folder

chmod +x /opt/utimaco/bin/csadm /opt/utimaco/bin/p11tool2

Make tools executable

mkdir /etc/utimaco

Create configuration directory

cp cs_pkcs11_R3.cfg /etc/utimaco

Copy PKCS#11 configuration file

./p11tool2 slot=<slot_no> Label=<token_label> Login=ADMIN,ADMIN.key InitToken=<SO_PIN>

Initialize token and create Security Officer

./p11tool2 slot=<slot_no> LoginSO=<SO_PIN> InitPin=<CryptoUser_PIN>

Initialize user PIN for slot

rpm --import https://packages.microsoft.com/keys/microsoft.asc

Import Microsoft repository key

dnf install -y https://packages.microsoft.com/config/rhel/9.0/packages-microsoft-prod.rpm

Add Microsoft package repository

dnf install azure-cli

Install Azure CLI

az login

Authenticate to Azure account

az group create --location "<location>" --name "<resource_group>"

Create Azure resource group

az keyvault create --location "<location>" --name "<keyvault>" --resource-group "<resource_group>" --sku premium

Create Azure Key Vault (Premium)

az keyvault key create --name "<keyvault_key>" --vault-name "<keyvault>" --kty RSA-HSM --size 2048 --ops import

Generate Key Exchange Key (KEK)

az keyvault key download --name "<keyvault_key>" --vault-name "<keyvault>" --file <keyvault_key>.publickey.pem

Download KEK public key

p11tool2 slot=<slot_no.> loginuser=<user_password> PubKeyAttr=CKA_LABEL="<tenant_public_key>",CKA_MODULUS_BITS=<keysize> PrvKeyAttr=CKA_LABEL="<tenant_private_key>",CKA_EXTRACTABLE=CK_TRUE GenerateKeyPair=RSA

Generate RSA tenant key in HSM

p11tool2 slot=<slot_no.> loginuser=<user_password> PubKeyAttr=CKA_LABEL="<tenant_public_key>",CKA_EC_PARAMS=oid:<curvename> PrvKeyAttr=CKA_LABEL="<tenant_private_key>",CKA_EXTRACTABLE=CK_TRUE GenerateKeyPair=ECC

Generate ECC tenant key in HSM

byoktool Dev=<HSM_IP> LogonPass=<user,password> Label="<tenant_private_key>" CSP=azure PublicKey="<keyvaultkey>.pem" KID="<kid>" WrappedKey="<wrappedkey>"

Wrap tenant key for Azure import

az keyvault key import --vault-name <keyvault> --name <WrappedKeyName> --byok-file "wrappedkey"

Import wrapped RSA key into Azure Key Vault

az keyvault key import --vault-name <keyvault> --name <WrappedKeyName> --byok-file "wrappedkey" --kty EC --curve <curvename>

Import wrapped EC key into Azure Key Vault

az keyvault key show --vault-name <keyvault> --name <WrappedKeyName>

Verify imported key in Azure