For OpenJDK8 with EC Key

1. Generate an EC keypair on the Utimaco HSM.

# keytool -genkey -keyalg EC -keystore NONE -storetype CryptoServer - storepass 12345678 -providername CryptoServer -alias webleckey

Provide information when prompted.

Here:

• EC is the key algorithm.

• NONE is the keystore for HSM.

• CryptoServer is the storetype.

• 12345678 is the slot PIN.

• CryptoServer is the provider name.

• webleckey is the key name that will be generated on Utimaco HSM.

Key Generation using keytool command output

2. Verify that the keys have been generated.

# keytool -list -keystore NONE -storetype CryptoServer -providername CryptoServer -storepass 12345678 -v

Here:

• NONE is the keystore for HSM.

• CryptoServer is the storetype.

• 12345678 is the slot PIN.

• CryptoServer is the provider’s name.

Listkeys output

3. List the keys using cxitool.

# /opt/utimaco/bin/cxitool Dev=3001@127.0.0.1 Logonpass=weblogic,12345678 Group=Cryptoserver Listkeys

List keys output using cxitool

4. Generate a CSR using keytool command.

# keytool -certreq -alias webleckey -file webleckey.csr -storetype CryptoServer -keystore NONE -v

Provide the keystore password when prompted.

Here:

• NONE is the keystore for HSM.

• CryptoServer is the storetype.

• CryptoServer is the provider name.

• webleckey is the key name.

• webleckey.csr is the CSR file name that will be generated.

5. Get this CSR signed by CA.

6. Copy the signed certificate on the WebLogic server.

7. Import the Root certificate into the HSM keystore.

# keytool -importcert -alias RootCA -file /home/rootca.crt -storetype CryptoServer -keystore NONE -providername CryptoServer -storepass 12345678

Import root certificate into keystore

8. Import the signed certificate reply using the command below.

# keytool -importcert -alias webleckey -file /home/ec_demo.pem -storetype CryptoServer -keystore NONE -providername CryptoServer -storepass 12345678

Import certificate reply into keystore

9. List the keystore entries.

# keytool -list -keystore NONE -storetype CryptoServer -providername CryptoServer -storepass 12345678 -v

Here:

• NONE is the keystore for HSM.

• CryptoServer is the storetype.

• 12345678 is the slot PIN.

• CryptoServer is the provider’s name.

Keytool list output