Generating Keys and Certificate for SSL

1. Generate the RSA key using p11tool2.

# p11tool2 slot=4 LoginUser=123456 

PubKeyAttr=CKA_LABEL="RSAKey",CKA_ID=0x45 

PrvKeyAttr=CKA_LABEL="RSAKey",CKA_ID=0x45  GenerateKeyPair=RSA 

2. Verify that the keys are generated onto the HSM using following command.

# p11tool2 LoginUser=<cryptouser_password> ListObjects 

Example:

List keys

3. Generate a certificate request.

# openssl req -engine pkcs11 -new -key "pkcs11:token=Nginx;object=RSAKey" 

-keyform engine -out RSACSR.csr 

Here, Nginx is the token label and RSAKey is the key on the HSM. Provide Cryptouser PIN when prompted. Also provide other required information for certificate.

Certificate request output

Content of certificate request file

4. Get this CSR signed by your CA and copy the signed certificate to NGINX server.

5. Alternatively, you can create the self-signed certificate based on the generated key.

# openssl req -engine pkcs11 -new -x509 -days 365 -key 

"pkcs11:token=Nginx;object=RSAKey" -keyform engine -out RSA.cert 

Here, Nginx is the token label and RSAKey is the key on the HSM. Provide Cryptouser PIN when prompted. Also provide other required information for certificate.

Self-signed certificate generation output

Content of self-signed certificate file