Testing OpenSSL Engine

perform the following tasks to test openssl engine set fxpkcs11 environment variables explore some openssl engine examples set fxpkcs11 environment variables in a terminal, run the following sequence of commands to set the required fxpkcs11 environment variables export fxpkcs11 module=/path/to/libfxpkcs11 so; export fxpkcs11 cfg=/path/to/fxpkcs11 cfg; create a key pair perform the following steps to create a key pair on the {{vectera}} by using pkcs11 tool in a terminal, run the following command to use pkcs11 tool to create a new key pair on the {{vectera}} pkcs11 tool module $fxpkcs11 module login keypairgen key type rsa 2048 label "my rsa2048 key" id "123456" usage sign usage decrypt enter the password of the identity configured in the fxpkcs11 cfg file when prompted for the user pin if the command succeeds, the keys display in the output, as shown in the following example key pair generated private key object; rsa label my rsa2048 key id 123456 usage decrypt, sign, unwrap access sensitive, local public key object; rsa 2048 bits label my rsa2048 key id 123456 usage encrypt, verify, wrap access local the command creates the following keys, which the next section uses in the test openssl commands a private rsa 2048 key with asymmetric sign and verify usage a public rsa 2048 key with verify usage openssl example commands most of the following openssl example commands use the keys created on the {{vectera}} in the previous section all the commands that use the keys created on the hsm specify the pkcs11 openssl engine this section does not provide an exhaustive list of openssl commands that you can run by using the pkcs11 openssl engine instead, it provides a few examples of use cases and confirms that you configured everything correctly refer to the openssl documentation ( www openssl org/docs/ http //www openssl org/docs/ ) for the full list of compatible commands example 1 output the public key in a terminal, run the following command to output the public key from the hsm openssl rsa engine pkcs11 pubout inform engine in "pkcs11\ object=my rsa2048 key" if the command succeeds, you should see output similar to the following example engine "pkcs11" set writing rsa key \ begin public key miibijanbgkqhkig9w0baqefaaocaq8amiibcgkcaqeaoqfl+qygj9ou+tycldcm 7rstkxycytiqa2yd3wgfrd72x8iakub2ql/if/kande1gsracts5vnc0jz9sp0nu j3by9b0gfxkr5kjsqgdqoks29m0kyhjge7qrt6rfzuhhj8trfqppnznnzu9mflmx 85xltle2huv+e1vkhfkfc1gqruldq1rob8hzke13k7siv4imozrswq7qgvyffwov 3kn27ynsakormaoepewc5hre3rwjrp/w9i+effpdtmzi7wwpaqork3ae+bv3c8dd +iv7fnxkpjk/n+4ctjnmfett/tg99shkhkjkhrqgr4vnfv34hoqlwcjyr6nlrca4 eqidaqab \ end public key example 2 encrypt and decrypt data perform the following steps to encrypt data with the public key and decrypt with the hsm stored private key in a terminal, run the following command to generate a file, clear data , containing random ascii data echo "this is a test file" > /clear data retrieve the public key from the hsm openssl rsa engine pkcs11 inform engine in "pkcs11\ object=my rsa2048 key" pubout outform pem out pubkey pem encrypt the clear data file by using the public key retrieved from the hsm and output the results to a file, encrypted data openssl pkeyutl pubin inkey pubkey pem in /clear data encrypt out /encrypted data pkeyopt rsa padding mode\ oaep decrypt the encrypted data file by using the hsm stored private key and output the results to a file, clear data2 openssl pkeyutl engine pkcs11 keyform engine inkey "pkcs11\ object=my rsa2048 key" decrypt in /encrypted data out /clear data2 pkeyopt rsa padding mode\ oaep confirm that the contents of clear data and clear data2 files are identical diff clear data clear data2 example 3 sign a file and verify the signature perform the following step to sign a data file using the hsm stored private key and verify the signature by using the public key sign the clear data file by using the hsm stored private key and output the signature to a file, clear data sig openssl pkeyutl engine pkcs11 keyform engine inkey "pkcs11\ object=my rsa2048 key" sign in /clear data out /clear data sig verify the signature by using the public key openssl pkeyutl pubin inkey pubkey pem verify in /clear data sigfile /clear data sig a message should display on the screen confirming that the signature was verified successfully example 4 create a self signed root ca perform the following steps to create a self signed root ca generate a self signed ca certificate with the hsm stored private key openssl req new x509 engine pkcs11 keyform engine key "pkcs11\ object=my rsa2048 key" out ssl ca cert pem days 365 when prompted, enter information about the self signed ca certificate after you enter the information, the command creates the follwoing file ssl ca cert pem example 5 generate a csr perform the following steps to generate a csr generate a csr with the hsm stored private key openssl req new engine pkcs11 keyform engine key "pkcs11\ object=my rsa2048 key" out ssl client cert req pem days 365 when prompted, enter information about the certificate after you enter the information, the command creates the following file ssl client cert req pem example 6 sign a csr execute the following command to sign a csr by using the hsm stored private key openssl x509 req engine pkcs11 in ssl client cert req pem ca ssl ca cert pem cakeyform engine cakey "pkcs11\ object=my rsa2048 key" cacreateserial out signed client cert pem days 365 the command outputs the signed certificate to the signed client cert pem file