Breadcrumbs

Migrating Existing Software Keys to Utimaco HSM

If you have NGINX running over SSL with the existing keys locally somewhere on the directory, you can migrate those keys to Utimaco HSM and securely store them.

To migrate the existing key to Utimaco HSM follow these steps:

  1. Make sure to complete the steps for installing and configuring openssl and libp11 in section 5.1, 5.2 and 5.3 before proceeding.

  2. Convert a private key to pkcs12 format.

›_ Console 

# openssl pkcs12 -export -nocerts -inkey private.pem -out private.key.p12

  1. Import converted private key to HSM using p11tool2.

›_ Console 

# p11tool2 slot=4 loginuser=123456 PubKeyAttr=CKA_LABEL="RSA Public 

Key",CKA_ID=0x25 PrvKeyAttr=CKA_LABEL="RSA Private Key",CKA_ID=0x25 ImportP12=private.key.p12,ask

Only private key is required to import to Utimaco HSM, as certificate contains only public key information.

  1. List the generated keys using p11tool2.

image-3284468023-2.jpg

List keys

  1. Open the nginx.conf file and make the following changes.

›_ Console 

ssl_engine pkcs11; 

     server {     listen 443 ssl; 
     ...............  
 ssl_certificate /root/nginx/cert.pem;  
 ssl_certificate_key engine:pkcs11:slot_4-id_25;  
   
 ...................  
 }  
}

Here:

  • /root/nginx/RSA.cert is the existing signed certificate.

  • engine:pkcs11:slot_4-id_25 is for slot no. 4 HSM and 25 is the CKA_ID of the private key on Utimaco HSM.

Below is the sample working configuration file for NGINX for SSL.

›_ Console 

[root@Nginx nginx]# vi /usr/local/nginx/nginx.conf  
user root;  
worker_processes 1;  
ssl_engine pkcs11;  
error_log logs/error.log info;  
events {  
 worker_connections 1024;  
}  
http {  
 include mime.types;  
 default_type application/octet-stream;  
 sendfile on;  
 keepalive_timeout 65;  
 server {  
 listen 80;  
 server_name localhost;  
 location / {  
 root html;  
 index index.html index.htm;  
 }  
 error_page 500 502 503 504 /50x.html;  
 location = /50x.html {  
 root html;  
 }  
 }
 #HTTPS server  
 server {  
 listen 443 ssl;  
 server_name localhost;  
 ssl_certificate /root/nginx/cert.pem;  
 ssl_certificate_key engine:pkcs11:slot_4-id_25;  
 access_log /tmp/sslparams.log;  
 location / {  
 root html;  
 index index.html index.htm;  
 }  
 }  
}

  1. Restart NGINX Open Source:

›_ Console 

# ./nginx -s reload

Provide slot PIN when prompted.

  1. Open https://<nginx_server_ip> in any browser and verify that you can see nginx welcome page.

image-3284468023-3.jpg

Nginx Page with Https

Once NGINX is running successfully after migrating the keys on Utimaco HSM you can delete the private key from the software location.

This completes the integration of NGINX with Utimaco HSM.