Data protection
NGINX

Test OpenSSL Engine

11min

This section provides instructions on testing OpenSSL Engine and some sample commands.

Test your conguration

Perform the following tasks to test the OpenSSL Engine:

  1. Set the FXPKCS11 environment variables.
  2. Create a key pair on the by using pkcs11-tool.

Set environment variables

Perform the following step to set the FXPKCS11 environment variables:

1

In a terminal, run the following commands to set the required FXPKCS11 environment variables:

Text


Create a key pair

Perform the following steps to create a key pair on the by using pkcs11-tool:

1

In a terminal, run the following command to create a new key pair:

Text

2

Enter the password of the identity configured in the fxpkcs11.cfg file when prompted for the User PIN.

If the command succeeds, the keys display in the output:

Text


The command created one private RSA 2048 key with asymmetric sign and verify usage and one public RSA 2048 key with verify usage. The test OpenSSL commands in the next section use these keys.

OpenSSL example commands

This section provides several OpenSSL example commands, most of which use the keys created on the in the previous section. You must specify the PKCS11 OpenSSL engine in the commands that use keys created in .

The purpose of this section is not to provide an exhaustive list of OpenSSL commands for the PKCS11 OpenSSL Engine but to give a few examples of use cases and confirm that everything is configured correctly. See the OpenSSL documentation for the full list of compatible commands.

Example 1: Output the public key

Perform the following step to output the public key from the :

1

In a terminal, run the following command to output the public key:

Text


If the command succeeds, it should output the public key to the screen, similar to the following example:

Text


Example 2: Encrypt and decrypt data

Perform the following steps to encrypt data with the public key and decrypt it with the -stored private key:

1

In a terminal, run the following command to generate a file called clear_data containing random ASCII data:

Text

2

Retrieve the public key from the .

Text

3

Encrypt the clear_data file by using the public key retrieved from and output the results to a file called encrypted_data.

Text

4

Decrypt the encrypted_data file by using the -stored private key and output the results to a file called clear_data2.

Text

5

Confirm that the contents of the clear_data and clear_data2 files are identical.

Text


Example 3: Sign a data file

Perform the following steps to sign a data file using the -stored private key and verify the signature using the public key:

1

Sign the clear_data file by using the -stored private key and output the signature to a file called clear_data.sig.

Text

2

Verify the signature using the public key.

Text


You should see a message on the screen confirming that the signature was verified successfully.

Example 4: Create a CA

Perform the following steps to create a Self-Signed Root Certificate Authority (CA):

1

Generate a self-signed CA certificate with the -stored private key.

Text


It prompts for information about the self-signed CA certificate.

After you enter all fields, it outputs the result to a file called ssl-ca-cert.pem.

Example 5: Generate a CSR

Perform the following steps to generate a Certificate Signing Request (CSR):

1

Generate a CSR with the -stored private key.

Text


It prompts for information about the certificate.

After you enter all fields, the CSR outputs to a file called ssl-client-cert-req.pem.

Example 6: Sign a CSR

Perform the following steps to sign a CSR by using the -stored private key:

1

Sign a CSR by using the -stored private key.

Text


The signed certificate outputs to a file called signed-client-cert.pem.