Sun Oracle Crypto Accelerator 6000 Board, User Manual

Page: 131 / 266

Chapter 4 Configuring Centralized Keystores 109
5. (Linux) Use the
certutil
utility to create a key and certificate request.
Note –
The password provided must be the password that was set when creating
the NSS certificate database. If this password is different than what is currently in
the
scakiod-pass.conf
file, change
scakiod-pass.conf
to make it the same as
this password.
6. Submit the certificate request to a certificate authority and get a digital
certificate.
Place the digital certificate somewhere on the system where
scakiod
is running
so the certificate can be imported into the certificate database (for example,
/var/sca/private/cert.pem
).
7. If the issued certificate is in ASCII encoded form, convert it to binary form as
follows:
8. Install the resulting certificate and the CA certificate into the NSS certificate
database with
certutil
:
# certutil -N -d /var/opt/sun/sca6000/private -s <BINDDN> -g 1024
-a -o /var/sca/private/certreq.pem
Enter Password or Pin for "NSS Certificate DB":
A random seed must be generated that will be used in the
creation of your key. One of the easiest ways to create a
random seed is to use the timing of keystrokes on a keyboard.
To begin, type keys on the keyboard until this progress meter
is full. DO NOT USE THE AUTOREPEAT FUNCTION ON YOUR KEYBOARD!
Continue typing until the progress meter is full:
|************************************************************|
Finished. Press enter to continue:
Generating key. This may take a few moments...
# openssl base64 -d -in /var/sca/private/cert.pem -out
/var/sca/private/cert.der