Create an application partition for EJBCA

to segregate applications on the hsm, you must create an application partition specifically for your use case application partitions segment the permissions and keys between applications on an hsm choose one of the following options to create and configure an application partition excrypt manager go to the application partitions menu and select \[ add ] in the basic information tab, configure all of the fields as follows option required configuration role name specify any name that you would like for this new application partition logins required set to 1 if the hsm is in fips mode, you must set logins required to 2 ports set to prod connection sources set to ethernet managed roles leave blank because you specify the exact permissions , key slots , and commands for this application partition or role to have access to use dual factor set to never upgrade permissions leave unchecked in the permissions tab, select the following key permissions permission description keys top level permission authorized allows for keys that require login no usage wrap enables interoperable key wrapping without defining key usage as part of the wrapped key use this only if you want to exchange keys with external entities or use the hsm to wrap externally used keys in the key slots tab, we recommend you create a range of 1000 total keys that do not overlap with another application partition within the specified range, you should have ranges for both symmetric and asymmetric keys if the application requires more keys, configure it accordingly based on application requirements, enable specific functions on the application partition to use the hsm functionality you can enable the following commands according to your use case in the commands tab pkcs #11 communication commands command description echo communication test/retrieve version hash retrieve device serial gpkm retrieve key table information gpks general purpose key settings get/change time retrieve hsm time key operations commands command description apfp generate pki public key from private key asyl load asymmetric key into key table gecc generate an ecc key pair gpca general purpose add certificate to key table grsa generate rsa key rsar generate pkcs #10 certificate request lrsa load rsa key into key table data encryption commands command description gpsr general purpose rsa operations signing commands command description asys generate a signature by using a pki private key fxcli run the following role fxcli commands to create the new application partition and enable all required functions fxcli role add –name \[role name] –application –key range (0,999) –perm "keys\ authorized" – perm "keys\ no usage wrap"role modify name \[role name] add perm excrypt\ apfp add perm excrypt\ asyl add perm excrypt\ asys add perm excrypt\ echo add perm excrypt\ gecc add perm excrypt\ gpca add perm excrypt\ gpkm – add perm excrypt\ gpks –add perm excrypt\ hash – add perm excrypt\ time