Skip to main content
This section uses Java keytool to generate an RSA 2048 key pair and a self-signed TLS server certificate on the CryptoHub for Curity Identity Server. On FXPKCS11 6.0 rev dc27 or later, this single command generates the key pair on the appliance and produces a usable PrivateKeyEntry in the Java keystore, with no CryptoHub UI step. The private key stays on the CryptoHub. Curity references the resulting keystore entry through the SunPKCS11 provider to serve TLS.
The keytool application is included in the JDK installation, so you can run the keytool commands in this section with no additional configuration.

​
Generate the key pair and certificate

Perform the following steps to generate the TLS server certificate and key pair on the CryptoHub:
1
Export FXPKCS11_CFG so the Futurex PKCS #11 library can locate its configuration file (fxpkcs11.cfg). Point it at the fxpkcs11.cfg you configured in Install and configure Futurex PKCS #11:
Shell
This step relies on the corrected SunPKCS11 configuration file (pkcs11.cfg) created in Configure SunPKCS11 to use the Futurex PKCS #11 module. Passing pkcs11.cfg on the command line (with -providerArg) is not enough on its own; without FXPKCS11_CFG, the token does not appear.
2
Execute the following command, passing the pkcs11.cfg file you created in the previous section with -providerArg. This generates an RSA 2048 key pair and self-signs a TLS server certificate with the common name Demo_1:
Text
The keytool application generates the key pair on the CryptoHub and self-signs a certificate for it. With no -storepass on the command line, keytool prompts for the keystore password.
3
When prompted for the keystore password, enter the CryptoHub identity password (PKCS #11 PIN) configured inside the <CRYPTO-OPR-PASS> tag in the fxpkcs11.cfg file.

​
Verify the private key entry linked to the TLS server certificate is in the Java keystore

Run the following keytool command to confirm that the key pair was generated on the CryptoHub and that the keystore lists a PrivateKeyEntry. The -providerArg flag passes the pkcs11.cfg file you created in the previous section:
Shell
When prompted for the keystore password, enter the identity password configured inside the <CRYPTO-OPR-PASS> tag in the fxpkcs11.cfg file.
If the command succeeds, you see an output similar to the following:
None
The CryptoHub assigns the on-token key its own alias in the form <alias>-<id>:<alias> (for example, Demo_1-1784141140:Demo_1), where <id> is generated per key and is not deterministic. This mangled alias, not the short -alias value (Demo_1) you passed to keytool -genkeypair, is the keystore entry name that Curity must reference. Copy the exact alias from this keytool -list output and enter it in Curity’s key Name field in Configure Curity to use the CryptoHub for TLS.The certificate common name is unaffected: it comes from -dname, so the CN remains Demo_1, which the Validate and test page checks.