Breadcrumbs

Generating DataVault Key and Certificate

1. Generate a DataVault key pair using p11tool2.

›_ Console 

# p11tool2 slot=33 LoginUser=ask PubKeyAttr=CKA_LABEL=Datavault 

PrvKeyAttr=CKA_LABEL=Datavault GenerateKeyPair=RSA
image-3286073424-1.jpg

Generating DataVault key

  1. Verify that the keys are generated onto the HSM using the following command.

›_ Console 

# p11tool2 slot=<Slot_No.> loginUser=<ask> listobjects
image-3285090430-1.jpg

List keys

  1. Generate a self-signed certificate for DataVault.

›_ Console 

# openssl req -x509 -engine pkcs11 -keyform engine -extensions 

v3_datavault_extensions -batch -new -key "pkcs11:token=openxpki;obj             ect=Datavault" -sha256 -subj "/CN=DataVault" -out "OpenXPKI_DataVault.crt"
image-3285090430-2.jpg

Generating a self-signed DataVault certificate

Here openxpki is the token label and Datavault is the key on the HSM. Provide the Slot PIN when prompted.