Generate Certificate Request for Sender and Receiver

1. Create a directory to generate the certificate request for sender and receiver

# mkdir /localCA/newcerts/sender
# mkdir /localCA/newcerts/receiver

2. Generate a sender key pair using p11tool2

For RSA

# p11tool2 slot=0 LoginUser=123456 PubKeyAttr=CKA_LABEL="SenderKey" PrvKeyAttr=CKA_LABEL="SenderKey" GenerateKeyPair=RSA

For ECDSA

# p11tool2 slot=0 LoginUser=123456 PubKeyAttr=CKA_LABEL="SenderKey" PrvKeyAttr=CKA_LABEL="SenderKey" GenerateKeyPair=ECC

Once key generation is completed then add CKA_ID for both public and private ECDSA keys using PKCS11# CryptoServer Administration tool.

3. Verify that the keys are generated onto the HSM using the following command:

# p11tool2 slot=<Slot_No.> LoginUser=<CryptoUser_PIN> ListObjects

Figure 26: Sender RSA Key list

For ECDSA

Figure 27: Sender ECDSA Key list

4. Generate a certificate request for sender.

# openssl req -engine pkcs11 -new -key "pkcs11:token=OpensslSlot;object=SenderKey" -keyform engine -out /localCA/newcerts/sender/sender.txt

Figure 28: Sender certificate request generation

Enter the prompted value for "A challenge password" as blank.

Here, OpensslSlot is the token label and SenderKey is the key on the HSM. Provide Cryptouser PIN when prompted.

5. Sign the certificate request for sender by CA

# openssl ca -engine pkcs11 -policy policy_anything -cert /localCA/newcerts/ca.cer -in /localCA/newcerts/sender/sender.txt -keyfile "pkcs11:token=OpensslSlot;object=CAKey" -keyform engine -out/localCA/newcerts/sender/SenderSignedCertificate.cert

Figure 29: Sender certificate request signing by CA

Press y to sign and y again to commit.

Here, OpensslSlot is the token label and CAKey is the key on the HSM. Provide Cryptouser PIN when prompted.

6. Generate key pair for receiver using p11tool2

For RSA

./p11tool2 slot=0 LoginUser=123456 PubKeyAttr=CKA_LABEL="ReceiverKey" PrvKeyAttr=CKA_LABEL="ReceiverKey" GenerateKeyPair=RSA

For ECDSA

./p11tool2 slot=0 LoginUser=123456 PubKeyAttr=CKA_LABEL="ReceiverKey" PrvKeyAttr=CKA_LABEL="ReceiverKey",CKA_DERIVE=CK_TRUE GenerateKeyPair=ECC

Once key generation is completed then add CKA_ID for both public and private ECDSA keys using PKCS11# CryptoServer Administration tool.

Also, make sure to set CKA_DERIVE=CK_TRUE in the above command

7. Verify that key pair is generated onto the HSM using the following command:

# p11tool2 slot=<Slot_No.> LoginUser=<CryptoUser_PIN> ListObjects

For RSA

Figure 30: Receiver RSA Key list

For ECDSA

Figure 31: Receiver ECDSA Key list

8. Generate a certificate request for receiver.

# openssl req -engine pkcs11 -new -key "pkcs11:token=OpensslSlot;object=ReceiverKey" -keyform engine -out/localCA/newcerts/receiver/Receiver.txt

Figure 32: Receiver certificate request generation

Enter prompted value for "A challenge password" as blank.

Here, OpensslSlot is the token label and ReceiverKey is the key on the HSM. Provide Cryptouser PIN when prompted.

9. Sign the certificate request for receiver by CA

# openssl ca -engine pkcs11 -policy policy_anything -cert /localCA/newcerts/ca.cer -in /localCA/newcerts/receiver/Receiver.txt - keyfile "pkcs11:token=OpensslSlot;object=CAKey" -keyform engine -out/localCA/newcerts/receiver/ReceiverSignedCertificate.cert

Figure 33: Receiver certificate request signing by CA

Press y to sign and y again to commit.

Here, OpensslSlot is the token label and CAKey is the key on the HSM. Provide Cryptouser PIN when prompted.