Create the responder key and certificates

Create the responder private key in CryptoHub, then issue filesystem certificates for both peers.

The CA commands below create a short-lived test CA. Use your organization’s CA for production certificates. The responder certificate must contain the public key that matches the CryptoHub-resident private key.

Create the responder key

sudo install -d -m 700 /root/strongswan-certs
KEY_ID="$(openssl rand -hex 8)"

sudo env CHLIBS_CONFIG=/etc/strongswan-chlibs/cryptohub.json \
  pkcs11-tool \
  --module /usr/local/lib/libcryptohub-pkcs11.so \
  --login \
  --pin "$(sudo cat /etc/strongswan-chlibs/token-pin)" \
  --keypairgen \
  --key-type rsa:2048 \
  --usage-sign \
  --label strongswan-responder \
  --id "$KEY_ID"

printf '%s\n' "$KEY_ID" \
  | sudo install -m 600 -o root -g root /dev/stdin \
      /etc/strongswan-chlibs/responder-key-id
unset KEY_ID

The output lists a private key with Usage: sign and a public key with Usage: verify. Both objects must have the same ID.

Export the public object

KEY_ID="$(sudo cat /etc/strongswan-chlibs/responder-key-id)"

sudo env CHLIBS_CONFIG=/etc/strongswan-chlibs/cryptohub.json \
  pkcs11-tool \
  --module /usr/local/lib/libcryptohub-pkcs11.so \
  --login \
  --pin "$(sudo cat /etc/strongswan-chlibs/token-pin)" \
  --read-object \
  --type pubkey \
  --id "$KEY_ID" \
  --output-file /root/strongswan-certs/responder-public.der

unset KEY_ID

Run sudo openssl pkey -pubin -inform DER -in /root/strongswan-certs/responder-public.der -noout. The command must succeed.

Issue the certificates

sudo -i
cd /root/strongswan-certs

pki --gen --type rsa --size 2048 --outform pem > ca-key.pem
pki --self --ca --lifetime 365 --in ca-key.pem --type rsa \
  --dn "CN=strongSwan example CA" --outform pem > ca-cert.pem

pki --issue --lifetime 30 \
  --in responder-public.der --type pub \
  --cacert ca-cert.pem --cakey ca-key.pem \
  --dn "CN=responder.example.com" \
  --san responder.example.com \
  --flag serverAuth --outform pem > responder-cert.pem

pki --gen --type rsa --size 2048 --outform pem > initiator-key.pem
pki --pub --in initiator-key.pem --type rsa \
  --outform der > initiator-public.der
pki --issue --lifetime 30 \
  --in initiator-public.der --type pub \
  --cacert ca-cert.pem --cakey ca-key.pem \
  --dn "CN=initiator.example.com" \
  --san initiator.example.com \
  --flag clientAuth --outform pem > initiator-cert.pem

pki --verify --in responder-cert.pem --cacert ca-cert.pem
pki --verify --in initiator-cert.pem --cacert ca-cert.pem
exit

Both verification commands report certificate trusted, lifetimes valid.

No private-key file exists for the responder. Transfer initiator-key.pem, initiator-cert.pem, and ca-cert.pem to the initiator over an encrypted channel.

​Create the responder key

​Export the public object

​Issue the certificates

Create the responder key

Export the public object

Issue the certificates