For OpenJDK8 with RSA Key

1. Log in as a root user and generate a keypair on Utimaco HSM.

# keytool -genkey -keyalg RSA -keysize 2048 -keystore NONE -storetype CryptoServer -storepass 12345678 -providername CryptoServer -alias weblogicrsa

Provide information when prompted.

Here:

• RSA is the key algorithm.

• 2048 is the key size.

• NONE is the keystore for HSM.

• CryptoServer is the storetype.

• 12345678 is the slot PIN.

• CryptoServer is the provider name.

• weblogicrsa is the key name that will be generated on Utimaco HSM.

Key generation using keytool command

2. Verify that the keys have been generated using keytool command.

# keytool -list -keystore NONE -storetype CryptoServer -providername CryptoServer -storepass 12345678 -v

Here:

• NONE is the keystore for HSM.

• CryptoServer is the storetype.

• 12345678 is the slot PIN.

• CryptoServer is the provider’s name.

Listkeys output

3. List the keys using cxitool.

# /opt/utimaco/bin/cxitool Dev=3001@127.0.0.1 Logonpass=weblogic,12345678 Group=Cryptoserver Listkeys

List Keys output using cxitool

4. Generate a CSR using keytool command.

# keytool -certreq -alias weblogicrsa -file rsa.csr -storetype CryptoServer -keystore NONE -v

Provide the keystore password when prompted.

Here:

• NONE is the keystore for HSM.

• CryptoServer is the storetype.

• CryptoServer is the provider name.

• weblogicrsa is the key name.

• rsa.csr is the CSR file name that will be generated.

5. Get this CSR signed by CA.

6. Copy the signed certificate on the WebLogic server.

7. Import the Root certificate into the HSM keystore.

# keytool -importcert -alias RootCA -file /home/LAbCA-Root.crt -storetype CryptoServer -keystore NONE -providername CryptoServer -storepass 12345678

Importing root certificate

8. Import the signed certificate reply using the command below.

# keytool -importcert -alias weblogicrsa -file /home/rsa_demo.pem - storetype CryptoServer -keystore NONE -providername CryptoServer - storepass 12345678

Import user certificate into keystore

9. List the keystore entries.

# keytool -list -keystore NONE -storetype CryptoServer -providername CryptoServer -storepass 12345678 -v

Listkeys output