Breadcrumbs

Generating a Root CA Key and Certificate

  1. Open the /< OPENSSLDIR>/openssl.cnf file in the text editor and edit the [CA_default] section to following.

openssl.cnf

 
. . .  
dir = /localCA  
new_certs_dir = $dir/certs  
. . .

You can change dir to the directory of your choice but make sure to use correct path in the subsequent steps. Here we have created the directory /localCA under root directory and new_certs_dir= $dir/certs

  1. Create the directory /localCA/certs.

›_ Console 

# mkdir /localCA/certs

  1. Create the text files /localCA/index.txt and /localCA/serial.

›_ Console 

# touch /localCA/index.txt 

# touch /localCA/serial

  1. Open the /localCA/serial file and write 01 in it and click enter. Save the file.

  2. Create a key pair by using p11tool2 for root CA.

›_ Console 

# p11tool2 slot=<Slot_No.> LoginUser=ask PubKeyAttr=CKA_LABEL="CAKey" 

PrvKeyAttr=CKA_LABEL="CAKey" GenerateKeyPair=RSA

This generates RSA 2048 CA private and public keys on the HSM.

  1. Verify that the RSA keys are generated onto the HSM using the following command.

›_ Console 

# p11tool2 Slot=<Slot_No.> loginUser=ask listobjects
image-3285254231-1.jpg

List keys

  1. Create the CA certificate based on the generated key.

›_ Console 

# openssl req -x509 -engine pkcs11 -keyform engine  -extensions v3_ca_extensions -batch  -new -key "pkcs11:token=openxpki;object=CAKey" sha256 -out RootCA.pem  -subj "/CN=OpenXPKI Root CA 20230926"
image-3285254231-2.jpg

RootCA certificate generation

Here CAKey is the Object label for the CA private key on the Utimaco HSM created in Step 5 and openxpki is a token label. Provide Slot PIN when prompted.