Skip to main content
This section uses Java keytool to generate a private key and an Apache Tomcat server TLS certificate directly on the CryptoHub. On FXPKCS11 6.0 rev dc27 or later, a single keytool -genkeypair command generates the key pair on the appliance (through C_GenerateKeyPair) and self-signs a certificate for it, producing a usable PrivateKeyEntry with no CryptoHub UI step. You then use keytool -list to confirm the private key and certificate are present in the PKCS #11 keystore. These steps ensure that Apache Tomcat is configured to use the CryptoHub-backed server certificate for TLS, allowing clients to verify the server during HTTPS connections.
The JDK installation includes the keytool application, so you can run the keytool commands in this section with no additional installation.

​
Generate a key pair

Perform the following steps to generate a key pair on the CryptoHub:
1
Export FXPKCS11_CFG so the Futurex PKCS #11 library can locate its own configuration file (fxpkcs11.cfg). Point it at the fxpkcs11.cfg you configured in Install and configure Futurex PKCS #11:
Shell
On Windows, set FXPKCS11_CFG as a machine-wide variable with setx instead (see Configure SunPKCS11 to use the Futurex PKCS11 module). If you keep fxpkcs11.cfg in its default location, this step is not required.
2
Run the following command, passing the pkcs11.cfg file you created in the previous section with -providerArg. This generates an RSA 2048 key pair on the CryptoHub and self-signs a TLS server certificate for it:
Text
Use RSA. Apache Tomcat’s older ECC path is not used here. Token-key generation through keytool is validated with RSA 2048, and the TLS handshake is unaffected by the key algorithm.
The keytool application generates the key pair on the CryptoHub and self-signs a certificate for it. With no -storepass on the command line, keytool prompts for the keystore password.
3
When prompted for the keystore password, enter the CryptoHub identity password (PKCS #11 PIN) configured inside the <CRYPTO-OPR-PASS> tag in the fxpkcs11.cfg file.

​
Verifying the Private Key and Certificate in the Java Keystore

Run the following keytool command to confirm the key pair generated on the CryptoHub and lists a PrivateKeyEntry. The -providerArg flag passes the pkcs11.cfg file you created earlier:
Shell
When prompted for the keystore password, enter the identity password configured inside the <CRYPTO-OPR-PASS> tag in the fxpkcs11.cfg file.
If the command succeeds, you see an output similar to the following:
None
Important: Take note of the entry alias (in this example, futurex-tomcat-1784141140:futurex-tomcat) as that will be needed for the server.xml file in the next section. Copy the exact value printed by keytool -list; the short -alias you passed to keytool -genkeypair does not work.
The CryptoHub assigns the on-token key its own alias in the form <alias>-<id>:<alias> (for example, futurex-tomcat-1784141140:futurex-tomcat), where <id> is generated per key and is not deterministic. This mangled alias, not the short -alias value you passed to keytool -genkeypair, is what Apache Tomcat must reference for certificateKeyAlias in server.xml. Copy the exact alias from this keytool -list output; the short alias fails with Alias does not exist. The certificate CN stays clean (it comes from -dname, for example CN=futurex-tomcat), so CN-based checks are unaffected.