Generate an HAProxy server certificate for testing

Step-by-step guide to generate a self-signed HAProxy server certificate using OpenSC and HSM.

This section covers the following tasks:

Install OpenSC.
Generate a key pair on the CryptoHub by using pkcs11-tool.
Create a tls directory for HAProxy and generate a self-signed certificate by using OpenSSL.
Store a reference to the HSM-stored private key inside a special PEM object with the label PKCS#11 PROVIDER URI.

Install OpenSC

To generate a new key pair on the CryptoHub, use pkcs11-tool, which is included in the OpenSC package available through the default package manager in most Linux distributions. In a terminal, run the following commands to update the package index and install OpenSC:

Shell

sudo apt update

sudo apt install opensc

Generate a key pair

Perform the following steps to generate a key pair on the CryptoHub using pkcs11-tool:

If you haven’t set the FXPKCS11_MODULE environment variable to the location of the FXPKCS11 library file, run the following command to set it:

Shell

export FXPKCS11_MODULE=/usr/local/lib/fxpkcs11/libfxpkcs11.so

You can also manually type out the full path to the module in the next step instead of setting the environment variable.

In a terminal, run the following command:

Shell

pkcs11-tool --module $FXPKCS11_MODULE --login --keypairgen --key-type rsa:2048 --label "HAProxy" --id "123456" --usage-sign

For a TLS server key used with the cipher configuration in this guide, the sign usage is sufficient.

Enter the identity password configured in the fxpkcs11.cfg file when prompted for the User PIN.

If the command succeeds, the keys display in the output, as shown in the following example:

Shell

Key pair generated:
Private Key Object; RSA 
  label:      HAProxy
  ID:         123456
  Usage:      sign, signRecover
  Access:     local
Public Key Object; RSA 2048 bits
  label:      HAProxy
  ID:         123456
  Usage:      verify, verifyRecover
  Access:     none

The command creates the following keys:

A private RSA 2048 key with asymmetric sign and signRecover.
A public RSA 2048 key with verify and verifyRecover.

Create the `tls` directory and generate a self-signed certificate

Create a tls directory to hold the TLS certificate and key, and generate a self-signed certificate for HAProxy by using OpenSSL.

If you installed HAProxy through your Linux distribution default package manager (e.g., apt), the HAProxy configuration directory is located at /etc/haproxy/. In a terminal, create the directory tls to store the HAProxy certificate and private key, and change into that directory:

Shell

sudo mkdir -p /etc/haproxy/tls && cd /etc/haproxy/tls

Use OpenSSL to generate a self-signed certificate for HAProxy from the key pair stored on the HSM with admin privileges:

Shell

sudo openssl req -new -x509 -provider pkcs11 -key "pkcs11:object=HAProxy;type=private" -out haproxy-cert.pem -subj "/CN=HAProxy" -days 365

If the command is successful, the tls directory should contain a new file named haproxy-cert.pem.

Create a reference to the private key

Perform the following steps to create a reference to the HSM-stored private key by using the uri2pem.py script:

Install the asn1crypto dependency, which you need to run the uri2pem.py script.

Shell

sudo apt install python3-asn1crypto

The command above installs asn1crypto system-wide using the OS package manager (apt). This is the simplest approach and is managed alongside your other system packages. If you prefer to keep dependencies isolated, you can instead install it in a Python virtual environment:

python3 -m venv ~/src/venv
source ~/src/venv/bin/activate
pip install asn1crypto

If you use a virtual environment, make sure it is activated when you run uri2pem.py, since the script depends on asn1crypto being available in the active environment.

Run the script with the following command:

Shell

python3 ~/src/pkcs11-provider/tools/uri2pem.py 'pkcs11:object=HAProxy;type=private' | sudo tee /etc/haproxy/tls/haproxy-cert.pem.key > /dev/null

To check if the command succeeded, run the following command to display the contents of the haproxy-cert.pem.key file:

None

cat /etc/haproxy/tls/haproxy-cert.pem.key

It should look something similar to:

-----BEGIN PKCS#11 PROVIDER URI-----
MD8aGVBLQ1MjMTEgUHJvdmlkZXIgVVJJIHYxLjAMInBrY3MxMTpvYmplY3Q9SEFQ
cm94eTt0eXBlPXByaXZhdGU=
-----END PKCS#11 PROVIDER URI-----

The preceding stanza decodes to the PKCS #11 URI of the private key stored on the HSM. This object is a container for the PKCS #11 URI and contains no keying material. Because it holds no key material, inspecting it with tools such as strings may show only fragments of the encoded URI — this is expected and does not indicate a problem.