Test PKI operations - Futurex Documentation

This section shows several PKI operations to demonstrate how to create Root and Intermediate CAs, which can then issue leaf certificates under them.

Initialize Vault

Before performing the test PKI operations, perform the following steps to initialize, unseal (if required), and log in to Vault:

In a different terminal window from where Vault is running, run the following commands to set the VAULT_ADDR and PIN environment variables.

Shell

export VAULT_ADDR='http://127.0.0.1:8200'
export PIN= <HSM_PIN>

Run the following command to check the Vault status.

Shell

vault status

If the operation succeeds, the output should be similar to the following example:

Shell

Key                      Value
---                      -----
Recovery Seal Type       pkcs11
Initialized              false
Sealed                   true
Total Recovery Shares    0
Threshold                0
Unseal Progress          0/0
Unseal Nonce             n/a
Version                  n/a
HA Enabled               false

Run the following command to initialize Vault:

Shell

vault operator init -key-shares=1 -key-threshold=1

We do not recommend using 1 for both the key shares and the key threshold in production.

If the operation succeeds, the output should be similar to the following example:

Shell

Unseal Key 1: qK4pHBY46Zxg2nt/cMgeLGh01Kh9SQ1ChOIDHPe/kmg=

Initial Root Token: hvs.iYjhzPiwz00bpqX6rmzSe7yj

Success! Vault is initialized

Recovery key initialized with 1 key shares and a key threshold of 1. Please
securely distribute the key shares printed above.

If the HSM auto unseal is not configured, run the following command to unseal Vault manually:

Shell

vault operator unseal <Unseal Key 1 provided from above>

Run the following command to log in to Vault:

Shell

vault login <Initial Root Token provided from above>

Generate managed keys

Perform the following steps to generate managed keys on the KMES Series 3 for the Root and intermediate CA:

Run the following command to generate a managed key on the KMES Series 3 for the Root CA:

Shell

vault write /sys/managed-keys/pkcs11/hsm-key-root library=hsm1 token_label=Futurex pin=$PIN key_label="hsm-key-root" allow_generate_key=true allow_store_key=true mechanism=0x0001 key_bits=2048 any_mount=false 

The value specified in the library field in the preceding command must match the value set in the name field of the kms_library stanza in the Vault configuration file (shown in the following example). The value specified in the token_label field in the preceding command must be Futurex.

None

# Provide your Futurex HSM connection information
kms_library "pkcs11" {
  name="hsm1"
  library = "/usr/local/bin/fxpkcs11/libfxpkcs11-Debug.so"
}

Run the following command to generate a managed key on the KMES for the intermediate CA:

Shell

vault write /sys/managed-keys/pkcs11/hsm-key-int library=hsm1 token_label=Futurex pin=$PIN key_label="hsm-key-int" allow_generate_key=true allow_store_key=true mechanism=0x0001 key_bits=2048 any_mount=false

Run the following command to verify that the key configurations have been written to Vault:

Shell

vault list /sys/managed-keys/pkcs11

Run the following commands to verify that the key configurations are valid by test signing some data:

Shell

vault write -f /sys/managed-keys/pkcs11/hsm-key-root/test/sign
vault write -f /sys/managed-keys/pkcs11/hsm-key-int/test/sign

Enable the PKI Secrets Engine

Perform the following steps to enable the PKI Secrets Engine for the Root and intermediate CA:

Run the following command to enable the PKI secrets engine for the Root CA:

Shell

vault secrets enable -path=pki -allowed-managed-keys=hsm-key-root pki

Run the following command to enable the PKI secrets engine for the Intermediate CA:

Shell

vault secrets enable -path=pki_int -allowed-managed-keys=hsm-key-int pki

Create a Root CA certificate

Perform the following steps to create a Root CA certificate with the corresponding managed key that you generated and stored on the KMES Series 3:

Run the following command to create a Root CA certificate with its corresponding managed key and output it to a file:

Shell

vault write -field=certificate pki/root/generate/kms managed_key_name=hsm-key-root common_name=example.com ttl=8760h > /tmp/CA_cert.crt

Run the following command to verify that the certificate looks correct:

None

cat /tmp/CA_cert.crt

Create a CSR

Perform the following steps to create a CSR for the intermediate CA with the managed key that you generated and stored on the KMES Series 3

Run the following command to create an Intermediate CA certificate with its corresponding managed key and output it to a file:

The following command requires you to install the jq package on your system. This package processes JSON output.

Shell

vault write -format=json pki_int/intermediate/generate/kms managed_key_name=hsm-key-int common_name="example.com" | jq -r '.data.csr' > /tmp/pki_intermediate.csr

Run the following command to verify that the certificate looks correct:

Shell

cat /tmp/pki_intermediate.csr

Sign the CA certificate

Perform the following steps to sign the intermediate CA certificate with the managed Root CA:

Run the following command to sign the intermediate CA certificate with the managed Root CA and output it to a file:

The following command requires you to install the jq package on your system. This package processes JSON output.

Shell

vault write -format=json pki/root/sign-intermediate csr=@/tmp/pki_intermediate.csr format=pem_bundle ttl="43800h" | jq -r '.data.certificate' > /tmp/intermediate.cert.pem

Run the following command to write the signed Intermediate CA certificate to Vault:

Shell

vault write pki_int/intermediate/set-signed certificate=@/tmp/intermediate.cert.pem

Issue a leaf certificate

Perform the following steps to issue a leaf certificate from the intermediate CA:

Run the following command to create a new role:

Shell

vault write pki_int/roles/example-dot-com allowed_domains="example.com" allow_subdomains=true max_ttl="720h"

Run the following command to issue a leaf certificate:

Shell

vault write -format=json pki_int/issue/example-dot-com common_name="test.example.com" ttl="24h"

​Initialize Vault

​Generate managed keys

​Enable the PKI Secrets Engine

​Create a Root CA certificate

​Create a CSR

​Sign the CA certificate

​Issue a leaf certificate

Initialize Vault

Generate managed keys

Enable the PKI Secrets Engine

Create a Root CA certificate

Create a CSR

Sign the CA certificate

Issue a leaf certificate