Generate Client Key and Certificate on Utimaco HSM

1. Generate client key using the p11tool2 command.

> p11tool2 slot=0 LoginUser=ask 

PubKeyAttr=CKA_LABEL=”OpenVPNPublicKey”,CKA_ID=0x45 

PrvKeyAttr=CKA_LABEL=”OpenVPNPrivateKey”,CKA_ID=0x45 GenerateKeyPair=RSA 

Provide the slot PIN when prompted.

Generate RSA key command output

2. Generate certificate request for client. Provide the slot PIN when prompted.

> openssl req -engine pkcs11 -new -key 

“pkcs11:token=OpenVPNToken;object=OpenVPNPrivateKey” -keyform engine -out OpenVPNClient.req 

Certificate request command output

3. Copy the OpenVPNClient.req file to C:\Program Files\OpenVPN\easy-rsa\pki\reqs.

4. Go into directory C:\Program Files\OpenVPN\easy-rsa and start easy-rsa shell.

> EasyRSA-Start.bat 

EasyRSA shell

5. Sign the client CSR.

>./easyrsa sign-req client OpenVPNClient 

Client CSR signing

Client CSR signing

6. To import the certificate into HSM, convert the certificate file (.crt) into .der format using the below command.

> openssl x509 -outform der -in OpenVPNClient.crt -out OpenVPNClient.der 

Convert certificate into .der format

7. Import certificate into HSM using the command below. Provide slot PIN when prompted.

> p11tool2 slot=0 LoginUser=ask 

CertAttr=CKA_LABEL=”OpenVPNClientCert”,CKA_ID=0x45,CKA_PRIVATE=False  

PubKeyAttr=CKA_LABEL=”OpenVPNClientCertPublicKey”,CKA_ID=0x45 ImportCert=OpenVPNClient.der 

Import certificate command output

8. List objects of HSM using the command below. Provide the slot PIN when prompted.

> p11tool2 slot=0 LoginUser=ask ListObjects 

List objects command output

List objects command output