Create a key pair and certificate on the Vectera Plus

Perform the following tasks to test OpenSSL engine:

Set FXPKCS11 environment variables.
Explore some OpenSSL Engine examples.

Set environment variables

In a terminal, run the following sequence of commands to set the required FXPKCS11 environment variables:

Shell

export FXPKCS11_MODULE=/path/to/libfxpkcs11.so;
export FXPKCS11_CFG=/path/to/fxpkcs11.cfg;

Create a key pair

Perform the following steps to create a key pair on the Vectera Plus by using pkcs11-tool:

In a terminal, run the following command to use pkcs11-tool to create a new key pair on the Vectera Plus:

Shell

pkcs11-tool --module $FXPKCS11_MODULE --login --keypairgen --key-type rsa:2048 --label "Demo_1" --id "123456" --usage-sign --usage-decrypt

Enter the password of the identity configured in the fxpkcs11.cfg file when prompted for the User PIN.

If the command succeeds, the keys display in the output, as shown in the following example:

Shell

Key pair generated:
Private Key Object; RSA 
  label:      Demo1
  ID:         123456
  Usage:      decrypt, sign, unwrap
  Access:     sensitive, local
Public Key Object; RSA 2048 bits
  label:      Demo1
  ID:         123456
  Usage:      encrypt, verify, wrap
  Access:     local

The command creates the following keys, which the next section uses in the test OpenSSL commands:

A private RSA 2048 key with asymmetric sign and verify usage
A public RSA 2048 key with verify usage.

Generate a certificate

Perform the following steps to generate a certificate from the key pair:

In a terminal, run the following command to use OpenSSL to generate a certificate from the key pair on the Vectera Plus:

Shell

openssl req -new -x509 -engine pkcs11 -keyform engine -key "pkcs11:object=m" -out demo-cert.pem -days 365

Enter the password of the identity configured in the fxpkcs11.cfg file when prompted for the User PIN.

Push the certificate

Perform the following steps to push the certificate to the Vectera Plus with pkcs11-tool:

In a terminal, run the following command to use pkcs11-tool to push the certificate to the Vectera Plus:

Shell

pkcs11-tool --module /usr/local/lib/fxpkcs11/libfxpkcs11.so -l --write-object demo-cert.pem --type cert --label "Demo_1"

Enter the password of the identity configured in the fxpkcs11.cfg file when prompted for the User PIN.

If the command succeeds, the certificate displays in the output, as shown in the following example:

Shell

Created certificate:
Certificate Object; type = X.509 cert
  label:      Demo1
  subject:    DN: C=US, ST=Texas, L=Bulverde, O=Futurex, OU=Integration Engineering, CN=Demo1
  ID:         c06b

​Set environment variables

​Create a key pair

​Generate a certificate

​Push the certificate

Set environment variables

Create a key pair

Generate a certificate

Push the certificate