Generate a key pair and certificate on the Vectera Plus
This section shows how to use FXCLI to perform the following tasks:
- Log in to the HSM.
- Create a new key pair on the .
- Generate a CSR from that key pair.
- Create a CA
- Sign the CSR by using a CA that you also create on the HSM.
Run the FXCLI application.
Configure TLS certificates for communication between FXCLI and the HSM by using the tls set of commands.
Run tls help to access syntax documentation.
Connect to the HSM by using the following command:
Log in to the HSM with the default Admin1 and Admin2 identities by running the following command twice (entering the username and password when prompted):
Create a new key pair in the next available key slot on the HSM, modifying the key usage values to match your specific requirements:
Confirm which key slot the private key was added to:
Assign a PKCS11 label to the key (certutil needs you to set this external data field so that it can find the key in a later section):
The PKCS11 label value should match the name that was set for the key pair in the generate command.
Generate a CSR from the new key pair that was created:
Create a new key pair in the next available key slot on the HSM:
Create a certificate from the new key pair that you created:
Note that the CA certificate was output to a file called Ca.pem.
Confirm which key slot the private key was added to:
Assign a PKCS11 label to the key (certutil needs you to set this external data field so that it can find the key in a later section):
The PKCS11 label value should match the name that was set for the key pair in the generate command.
Sign the CSR with the CA you just created, modifying the key usage values to match your specific certificate requirements:
Note that the signed leaf certificate was output to a file called IgDemo.pem.