Register CryptoHub as a CIS device
1
Make the Nexus PKCS #11 bridge available to Certificate Manager.Certificate Manager loads PKCS #11 libraries through the 64-bit
jpkcs11.dll bridge. Place jpkcs11.dll in a folder on the system PATH, as described in the Nexus installation instructions for your Certificate Manager version.2
Add a PKCS #11 device to the CIS configuration (
cis.conf) with the following values:Nexus Group provides the device syntax for
cis.conf with Certificate Manager. If you do not have it, contact Nexus support.3
Sign the changed CIS configuration file with an administration officer that holds the Configuration tasks role, then restart Certificate Manager.An unsigned configuration change starts Certificate Manager in maintenance mode. For details, refer to Sign CF and CIS configuration files in Certificate Manager.
Create the CA key
Two administration officers with the Use AWB and CA and Key tasks roles sign this task.1
In the Administrator’s workbench (AWB), select New > Key.
2
In the Create Key Request dialog, enter a Key name, for example
Nexus-RSA-Futurex. The name appears in the Key Registry.3
Set State to Active, then select the Domain.
4
Select the Authority type CA/SA.
5
In Type of key, select the option to use an existing key in the device.The key already exists on CryptoHub, so Certificate Manager registers it rather than generating a new one.
6
In Device, select the CryptoHub device you added to the CIS configuration.
The dialog shows the key algorithm and key operations of the CryptoHub device.
7
In Existing key ID, select the key ID you set with
hwsetup, for example nexus-ca-rsa.The list contains only keys that are not already in use by a CA.8
Select [ OK ] and sign the task with both officers.
The key appears in the Key Registry under the name you entered.
Create the CA
1
In AWB, select New > Authority.
2
In the Create Authority Request dialog, enter the Authority name, set State to Active, select the Domain, and select the Authority type CA.
3
Set Valid from and Expiration date.
4
Select the issuing CA:
- Root CA: Keep Issuing CA - Self signed selected.
- Subordinate CA: Clear Issuing CA - Self signed, select the browse button next to Issuing CA, and select the CA that issues this CA.
5
Under CA Usage, select Certificate signing and, if this CA publishes CRLs, CRL signing.
6
In Key, select the browse button and select the CA key you created in the previous section.
7
Select the Key algorithm and Signature algorithm, for example an RSA SHA-256 signature algorithm.
8
In Format, select the certificate format, for example
rfc5280, and add any distribution rules your CA requires.9
Enter the certificate attributes. In Common Name, enter the CA name that appears in the CA certificate, for example
Nexus-RSA-Futurex.10
Select [ OK ] and sign the task with both officers.
The CA appears in the Authority Hierarchy. Certificate Manager signs the CA certificate, or the subordinate CA request, with the CryptoHub-resident key.