Generate a key pair and certificate on the CryptoHub
This section describes the steps to generate a key pair, CSR, and certificate and then sign the certificate.
Run the FXCLI application.
Configure TLS certificates for communication between FXCLI and the by using the tls set of commands.
Run tls help to access syntax documentation.
Connect to the using the following command:
Log in to the with the default Admin1 and Admin2 identities by running the following command twice, entering the username and password when prompted:
Generate a new key pair in the next available key slot on the . (Note: Modify the key usage values to match your specific requirements.)
Confirm which key slot the private key was added to:
Assign a PKCS11 label to the key. You must set this field so certutil can find the key on the .
The PKCS11 label value should match the name that you set for the key pair in the generate command.
Generate a Certificate Signing Request (CSR) from the new key pair that was created on the :
Create a new key pair in the next available key slot on the :
Create a CA certificate from the key pair that was created on the :
Confirm which key slot the private key was added to:
Assign a PKCS11 label to the key. You must set this field so certutil can find the key on the .
The PKCS11 label value should match the name that you set for the key pair in the generate command.
Sign the IgDemo CSR that you created by using the self-signed CA certificate:
Modify the key usage values to match your specific certificate requirements.
The signed leaf certificate is output to a file called "IgDemo.pem".