Test OpenSSL engine
Perform the following tasks to test OpenSSL engine:
- Set FXPKCS11 environment variables.
- Explore some OpenSSL Engine examples.
In a terminal, run the following sequence of commands to set the required FXPKCS11 environment variables:
In a terminal, run the following command to use pkcs11-tool to create a new key pair on the :
Enter the password of the identity configured in the fxpkcs11.cfg file when prompted for the User PIN.
If the command succeeds, the keys display in the output, as shown in the following example:
The command creates the following keys, which the next section uses in the test OpenSSL commands:
- A private RSA 2048 key with asymmetric sign and verify usage
- A public RSA 2048 key with verify usage.
Most of the following OpenSSL example commands use the keys created on the in the previous section. All the commands that use the keys created on the HSM specify the pkcs11 OpenSSL engine.
This section does not provide an exhaustive list of OpenSSL commands that you can run by using the pkcs11 OpenSSL Engine. Instead, it provides a few examples of use cases and confirms that you configured everything correctly. Refer to the OpenSSL documentation for the full list of compatible commands.
In a terminal, run the following command to output the public key from the HSM:
If the commands succeeds, you should see output similar to the following example:
In a terminal, run the following command to generate a file, clear_data, containing random ASII data:
Retrieve the public key from the HSM.
Encrypt the clear_data file by using the public key retrieved from the HSM and output the results to a file, encrypted_data.
Decrypt the encrypted_data file by using the HSM stored private key and output the results to a file, clear_ data2.
Confirm that the contents of clear_data and clear_data2 files are identical.
Example 3: Sign a data file using the HSM stored private key and verify the signature by using the public key
Sign the clear_data file by using the HSM stored private key and output the signature to a file, clear_data.sig.
Verify the signature by using the public key.
A message should display on the screen confirming that the signature was verified successfully.
Generate a self-signed CA certificate with the HSM stored private key.
When prompted, enter information about the self-signed CA certificate.
After you enter the information, the command creates a file, ssl-ca-cert.pem.
Generate a CSR with the HSM stored private key.
When prompted, enter information about the certificate.
After you enter the information, the command creates a file, ssl-client-cert-req.pem.
Sign a CSR by using the HSM-stored private key.
The command outputs the signed certificate to a file, signed-client-cert.pem.