Data protection
OpenSSL Engine

Test OpenSSL Engine

9min

Perform the following tasks to test OpenSSL Engine.

1 | Set FXPKCS11 environment variables

1

In a terminal, run the following commands to set the required FXPKCS11 environment variables:

Text


2 | Create a key pair on the using pkcs11-tool

1

In a terminal, run the following command to create a new key pair on the using pkcs11-tool:

Text

2

Enter the password of the identity configured in the fxpkcs11.cfg file when prompted for the User PIN.

If the command succeeds, the keys are listed as shown in the following output:

Text


One private RSA 2048 key was created with asymmetric sign and verify usage, and one public RSA 2048 key was created with verify usage. The test OpenSSL commands in the next section use these keys.

OpenSSL example commands

This section shows several OpenSSL example commands, most of which use the keys created on the in the previous section. In the commands that utilize keys created in , the pkcs11 OpenSSL engine is specified.

The purpose of this section is not to provide an exhaustive list of OpenSSL commands that can be run using the pkcs11 OpenSSL Engine, but rather to give a few examples of use-cases and confirm that everything is configured correctly. Please refer to OpenSSL's documentation for the full list of compatible commands.

Example 1: Output the public key from the 

1

In a terminal, run the following command to output the public key from the :

Text


If the command succeeds, it should output the public key to screen, similar to the following example:

Text


Example 2: Encrypt data with the public key and decrypt with the -stored private key

1

In a terminal, run the following command to generate a file called clear_data containing random ASII data:

Text

2

Retrieve the public key from the .

Text

3

Encrypt the clear_data file using the public key retrieved from and output the results to a file called encrypted_data.

Text

4

Decrypt the encrypted_data file using the -stored private key and output the results to a file called clear_data2.

Text

5

Confirm that the contents of the clear_data and clear_data2 files are identical.

Text


Example 3: Sign a data file using the -stored private key and verify the signature using the public key

1

Sign the clear_data file using the -stored private key and output the signature to a file called clear_data.sig.

Text

2

Verify the signature using the public key.

Text


A message should be output to the screen confirming that the signature was verified successfully.

Example 4: Create a Self-Signed Root Certificate Authority (CA)

1

Generate a self-signed CA certificate with the -stored private key.

Text


It will prompt for information about the self-signed CA certificate. Once all fields have been entered, it will output to a file called ssl-ca-cert.pem.

Example 5: Generate a Certificate Signing Request (CSR)

1

Generate a CSR with the -stored private key.

Text

2

When prompted, enter information about the certificate. After you enter all fields, the certificate signing request is output to a file called ssl-client-cert-req.pem.

Example 6: Sign a CSR using the -stored private key

1

Sign a CSR using the -stored private key.

Text


The signed certificate is output to a file called signed-client-cert.pem.