futurex.p12 file generated in Edit the Client Profile.
If you do not have this file, complete that section before continuing.
Import the client PKCS #12 into the CryptoHub
In this sub-section, we’ll import the PKCS #12 file containing the CA certificate, client certificate, and client private key into the CryptoHub.Create an Approval Group
1
Log in to the CryptoHub with your administrator identities.
2
Go to PKI and CA > PKI Signing Approvals.
3
Select [ Add Approval Group ].
4
Enter a name for the Approval Group and select [ OK ].
5
Right-click the new Approval Group and select Permission.
6
In the dropdown menu towards the top of the dialog box, select Service - OpenVPN, then click [ Add ].
7
Grant the Use permission to the OpenVPN service, then click [ Save ].
Create an X.509 Certificate Container
1
Go to PKI and CA > Certificate Management.
2
Select [ Add CA ] at the bottom.
3
In the Certificate Container creation dialog:
- Name: Enter a name for the Certificate Container, such as “OpenVPN”.
- Host: None
- Type: X.509
- Owner Group: Select the OpenVPN FXPKCS11 role.
4
Select [ OK ].
Enable the option to allow importing certificates using passwords
Before importing the PKCS #12 file created above with OpenSSL, it is necessary to enable an option on the CryptoHub to allow importing certificates using passwords.1
Go to Classic Tools > Administration > Configuration Tasks > Options.
2
In the Main tab of the Options menu, select the Allow import of certificates using passwords checkbox.
3
Select [ Save ].
Import the PKCS #12 file into the X.509 Certificate Container
1
Go to PKI and CA > Certificate Management.
2
Right-click the X.509 Certificate Container you created above, and select Import > PKCS#12.
3
Click [ Browse ] and select your PKCS #12 file for import.
4
Select [ Next ].
5
Enter the password for the PKCS #12 file and select [ Next ].
6
Select [ Finish ].
Add an Issuance Policy to the client certificate
We must add an Issuance Policy to the client certificate so that the Futurex PKCS #11 library can find the certificate on the CryptoHub.1
Go to PKI and CA > Certificate Management.
2
Right-click the client certificate in the tree (the one under the CA certificate) and select Issuance Policy > Add.
3
In the Basic Info tab:
- Set Approvals to 0.
A message will appear stating, “Zero approval policy requires Anonymous Signing security usage.” We’ll set this after creating the Issuance Policy.
4
In the X.509 tab:
- Assign a Default approval group by clicking [ Select ], selecting the Approval Group you created above, and clicking [ OK ].
5
In the Object Signing tab:
- Select the Allow object signing checkbox.
6
Select [ OK ].
Change security usage on the client certificate to allow Anonymous Signing
1
Go to PKI and CA > Certificate Management.
2
Right-click the client certificate and select Change Security Usage.
3
In the dropdown menu select Anonymous Signing.
4
Select [ OK ].