Creating a local CA (Certificate Authority) and performing Cryptographic operation with OpenSSL

1. Open the /< OPENSSLDIR>/openssl.cnf file in the text editor and edit the [CA_default] section to following:

dir = /localCA new_certs_dir = $dir/certs

NOTE: You can change dir to the directory of your choice, but make sure to use correct path in the subsequent steps. Here we have created directory /localCA under root directory and new_certs_dir= $dir/newcerts

2. Create the directory /localCA/newcerts

# mkdir /localCA/newcerts

3. Create the text files /localCA/index.txt and /localCA/serial

# touch /localCA/index.txt # touch /localCA/serial

4. Open the /localCA/serial file and write 01 in it and click enter. Save the file

5. Create a key pair by using pkcs11tool2 for root CA

For RSA

# p11tool2 slot=0 LoginUser=123456 PubKeyAttr=CKA_LABEL="CAKey" PrvKeyAttr=CKA_LABEL="CAKey" GenerateKeyPair=RSA

This generates RSA 2048 CA private and public keys on the HSM

For ECDSA

To generate ECDSA CA keys on the HSM

# p11tool2 slot=0 LoginUser=123456 PubKeyAttr=CKA_LABEL="CAKey" PrvKeyAttr=CKA_LABEL="CAKey" GenerateKeyPair=ECC

Once key generation is completed then add CKA_ID for both public and private ECDSA keys using PKCS11# CryptoServer Administration tool.

6. Verify that the keys are generated onto the HSM using following command:

# p11tool2 Slot=<Slot_No.> LoginUser=<Cryptouser_PIN> ListObjects

For RSA

Figure 23: CA RSA Key list

For ECDSA:

Figure 24: CA ECDSA Key list

7. Create the CA certificate based on the generated key that is used for signing other certificates by running below command:

# openssl req -engine pkcs11 -new -x509 -days 365 -key "pkcs11:token=OpensslSlot;object=CAKey" -keyform engine -out
/localCA/newcerts/ca.cer

Figure 25: CA certificate generation output

Here, CAKey is the Object label for the CA private key on the Utimaco HSM created in Step 5, and OpensslSlot is token label. Provide Cryptouser PIN when prompted.