Create the HSM-backed CA and responder keys

Generate two RSA key pairs inside the CryptoHub: one acts as the certificate authority, the other is the responder’s IKE authentication key. Neither private key exists on the Linux host at any point. Use distinct object IDs so the final tunnel test is not affected by older test objects.

Key requirements

Purpose	Label	ID	Key type	Usage
CA key	`strongSwanCA`	`01`	RSA 3072	sign, signRecover
Responder key	`StrongSwan`	`02`	RSA 3072	sign, signRecover

Generate the CryptoHub-resident CA key

Shell

read -rsp "HSM PIN: " HSM_PIN
echo

sudo env FXPKCS11_CFG=/etc/fxpkcs11.cfg HOME=/root \
pkcs11-tool \
--module /usr/local/lib/fxpkcs11/libfxpkcs11.so \
--login --pin "$HSM_PIN" \
--keypairgen --key-type rsa:3072 \
--label "strongSwanCA" --id "01" --usage-sign

unset HSM_PIN

The command reports the generated public key, Public Key Object; RSA 3072 bits, with the label strongSwanCA.

If this step fails with CKR_TEMPLATE_INCONSISTENT, the endpoint role is missing CertManage:Add. The client-side error text does not name the missing permission. Review the permissions in Before you start and retry.

Confirm the CA key exists:

Shell

read -rsp "HSM PIN: " HSM_PIN
echo

sudo env FXPKCS11_CFG=/etc/fxpkcs11.cfg HOME=/root \
pkcs11-tool \
--module /usr/local/lib/fxpkcs11/libfxpkcs11.so \
--login --pin "$HSM_PIN" \
--list-objects --type privkey --id 01 -v

unset HSM_PIN

The output shows Private Key Object; RSA, label strongSwanCA, ID 01, and Usage: sign, signRecover.

If this returns no output at all — no error, just nothing — the role is missing CertManage:Export or CertManage:Export Private Key. The key was created successfully; the client cannot enumerate it. Grant both and retry.

Create the self-signed CA certificate

When using an HSM object ID with ipsec pki --self, include --type priv. Without this option, strongSwan may fail to locate the HSM-backed private key.

Shell

mkdir -p ~/strongswan-certs
cd ~/strongswan-certs

sudo env FXPKCS11_CFG=/etc/fxpkcs11.cfg HOME=/root \
ipsec pki --self \
--type priv \
--keyid 01 \
--ca \
--lifetime 3650 \
--serial 01 \
--dn "C=US, O=Example, CN=strongSwan Test CA" \
--outform pem > strongswanCert.pem

Substitute your own organization and common name in --dn. Verify the CA certificate:

Shell

head -n 2 strongswanCert.pem

ipsec pki --print --in strongswanCert.pem

The output reports the subject and issuer as the same DN, flags: CA CRLSign self-signed, and pubkey: RSA 3072 bits. The log lines confirming found key on PKCS#11 token 'futurex':0 show the signature was produced inside the CryptoHub.

Generate the CryptoHub-resident responder key

Shell

read -rsp "HSM PIN: " HSM_PIN
echo

sudo env FXPKCS11_CFG=/etc/fxpkcs11.cfg HOME=/root \
pkcs11-tool \
--module /usr/local/lib/fxpkcs11/libfxpkcs11.so \
--login --pin "$HSM_PIN" \
--keypairgen --key-type rsa:3072 \
--label "StrongSwan" --id "02" --usage-sign

unset HSM_PIN

Confirm the responder key exists:

Shell

read -rsp "HSM PIN: " HSM_PIN
echo

sudo env FXPKCS11_CFG=/etc/fxpkcs11.cfg HOME=/root \
pkcs11-tool \
--module /usr/local/lib/fxpkcs11/libfxpkcs11.so \
--login --pin "$HSM_PIN" \
--list-objects --id 02 -v

unset HSM_PIN

Both a private and a public key object appear with the label StrongSwan and ID 02.

Read the public key out of the HSM so the CA can certify it:

Shell

cd ~/strongswan-certs

read -rsp "HSM PIN: " HSM_PIN
echo

sudo env FXPKCS11_CFG=/etc/fxpkcs11.cfg HOME=/root \
pkcs11-tool \
--module /usr/local/lib/fxpkcs11/libfxpkcs11.so \
--login --pin "$HSM_PIN" \
--read-object --type pubkey --id "02" \
--output-file strongswan-pub.der

unset HSM_PIN

ls -lh strongswan-pub.der

strongswan-pub.der exists and is several hundred bytes. Only the public key is read out; the private key remains in the CryptoHub.

Issue the responder certificate with the CryptoHub CA key

Shell

cd ~/strongswan-certs

sudo env FXPKCS11_CFG=/etc/fxpkcs11.cfg HOME=/root \
ipsec pki --issue \
--in strongswan-pub.der \
--type pub \
--cacert strongswanCert.pem \
--cakeyid 01 \
--dn "CN=StrongSwan" \
--flag clientAuth \
--serial 02 \
--outform pem > strongswan-cert.pem

--cakeyid 01 tells pki to sign with the CA key inside the CryptoHub. Verify the issued certificate:

Shell

head -n 2 strongswan-cert.pem

ipsec pki --print --in strongswan-cert.pem

ipsec pki --verify \
--in strongswan-cert.pem \
--cacert strongswanCert.pem

--print reports subject CN=StrongSwan, the CA DN as issuer, and pubkey: RSA 3072 bits. --verify reports certificate trusted, lifetimes valid after reaching the self-signed root.

If any command on this page fails, see Troubleshooting.

​Key requirements

​Generate the CryptoHub-resident CA key

​Create the self-signed CA certificate

​Generate the CryptoHub-resident responder key

​Issue the responder certificate with the CryptoHub CA key

Key requirements

Generate the CryptoHub-resident CA key

Create the self-signed CA certificate

Generate the CryptoHub-resident responder key

Issue the responder certificate with the CryptoHub CA key