Command Summary

Create an MLDSA key pair

/opt/utimaco/bin/qptool2 -lib "/opt/utimaco/lib/libcs_pkcs11_R3.so" -s SLOT_ID -p PIN -token -mldsa -keytype 2 -label KEY_LABEL -gen -count 1

Generate a Certificate Signing Request from a key

openssl req -new -key "pkcs11:token=<token_label>;object=<key_label>" -out MLDSA_CSR.csr

Generate a certificate from a Certificate Signing Request

openssl req -new -x509 -days 365 -key "pkcs11:token=$PKCS11_TOKEN;object=$KEY_LABEL;pin-value=$PKCS11_PIN" -out test.cert

Generate a signature from a file using a private key

openssl pkeyutl -sign -in message.txt -inkey "pkcs11:token=<token_label>;object=<key_label>" -out signature.sig

Verify a signature using a certificate

openssl pkeyutl -verify -in message.txt -certin -inkey mldsa.cert -sigfile signature.sig

Generate a CA from a private key

openssl req -new -x509 -days 365 -key "pkcs11:token=$PKCS11_TOKEN;object=$KEY_LABEL;pin-value=$PKCS11_PIN" -out ca.cer

Sign a Certificate Signing Request using a CA private key

openssl ca -batch -policy policy_anything -cert ca.cer -in request.csr -keyfile "pkcs11:token=$PKCS11_TOKEN;object=$KEY_LABEL" -out certificate.crt