Appendices

[CSADMIN]

CryptoServer – csadm Manual/Utimaco IS GmbH

2009-0003

[CSADMIN2]

CryptoServer_csadm_Manual_Systemadministrators.pdf

2009-0003

[CSLAN]

CryptoServerLAN_V5_Manual_Systemadministrators.pdf

2018-0010

[CSP-CNG]

CryptoServer_Manual_CSP_CNG.pdf

2008-0002

JSign Releases

JSign latest release details.

https://github.com/ebourg/jsign/releases

JSign Documentation

JSign documentation details.

https://ebourg.github.io/jsign

java -jar jsign-7.4.jar --version

Verify the installed JSign version.

Install-Module -Name PSPKI

Install the PowerShell PKI module.

Get-Command -Module PKI

Verify PKI module installation.

./p11tool2 slot=<slot no.> Label=<token label> Login=ADMIN,ADMIN.key InitToken=<SO pin>

Create and initialize a PKCS#11 token.

./p11tool2 slot=<slot no.> LoginSO=<SO pin> InitPin=<Crypto user pin>

Initialize the Crypto User PIN.

p11tool2.exe Slot=0 LoginUser=<passcode> PubKeyAttr='CKA_LABEL="jk_public_key",CKA_MODULUS_BITS=2048,CKA_ID="01"' PrvKeyAttr='CKA_LABEL="jk_private_key",CKA_EXTRACTABLE=CK_TRUE,CKA_ID="01"' GenerateKeyPair=RSA

Generate RSA key pair in HSM.

p11tool2.exe LoginUser=<passcode> ListObjects

List HSM objects and verify key/certificate creation.

p11tool2.exe Slot=0 LoginUser=<passcode> PubKeyAttr=CKA_LABEL="jk_public_key",CKA_MODULUS_BITS=2048,CKA_ID="01" PrvKeyAttr=CKA_LABEL="jk_private_key",CKA_EXTRACTABLE=CK_TRUE,CKA_ID="01" Mech=CKM_SHA256_RSA_PKCS DN="O=Utimaco,CN=Utimaco JCode Signing" ExportP10=testhsm_js.csr

Generate a CSR using an HSM-protected private key.

openssl req -in "<path>\testhsm_js.csr" -text -noout

Verify CSR content.

openssl x509 -in "<path>\testhsm_js.cer" -outform DER -out "<path>\testhsm_js.der"

Convert signed certificate to DER format.

p11tool2.exe Slot=0 LoginUser=<passcode> CertAttr='CKA_LABEL="jk_private_key",CKA_ID="01"' ImportCert="<path>\testhsm_js.der"

Import signed certificate into HSM.

keytool -genkeypair -alias <key label> -keystore NONE -storetype PKCS11 -storepass <passcode> -keyalg RSA -dname "CN=Utimaco Code Signing,O=Utimaco,L=Aachen,C=DE" -providerClass sun.security.pkcs11.SunPKCS11 -providerArg "C:\Tools\jsign\utimaco-pkcs11-java.cfg"

Generate self-signed certificate directly in HSM.

keytool -list -keystore NONE -storetype PKCS11 -storepass <passcode> -providerClass sun.security.pkcs11.SunPKCS11 -providerArg "C:\Tools\jsign\utimaco-pkcs11-java.cfg"

Verify PrivateKeyEntry and certificate availability.

java -jar "C:\Tools\jsign\jsign-7.4.jar" --keystore "C:\Tools\jsign\utimaco-pkcs11-java.cfg" --storetype PKCS11 --storepass <passcode> --alias <alias> --tsaurl http://timestamp.digicert.com "C:\Tools\jsign\TestSign.exe"

Digitally sign an executable using the HSM key.

Get-AuthenticodeSignature "<executable file>"

Verify Authenticode signature.