Hardware Security Module
2.
Generate SSL certificate in the user slot:
a.
At a terminal, enter:
ctcert c -s<UserSlotID> -k -z<KeySize> -l<CertificateName>
where
<UserSlotID>
is the ID of the slot on which the certificate should be generated,
<KeySize>
is
the length of private key required (minimum size is 1024), and
<CertificateName>
is the name you
want to give the certificate.
b.
Enter the requested information.
3.
Transfer the certificate to admin slot:
a.
To do this via a terminal, enter:
ctcert x -l<CertificateName> -s<UserSlotID> -f<CertExportFileName>
ctcert i -f<CertExportFileName> -s<AdminSlotID> -l<CertificateName>
where
<CertificateName>
is the name of the certificate that you entered when generating the
certificate,
<UserSlotID>
is the ID of the slot in which the certificate was generated,
<CertExportFileName>
is the file name of the certificate, and
<AdminSlotID>
is the ID of the
administration slot to which the certificate is being copied.
4.
Mark the certificate as trusted:
a.
At a terminal, enter:
ctcert t -l<CertificateName> -s<AdminSlotID>
where
<CertificateName>
is the name of the certificate that you entered when generating the
certificate, and
<AdminSlotID>
is the ID of the administration slot to which the certificate has been
copied.
5.
Use the trusted certificate to sign the VACMAN Controller Firmware Module:
a.
At a terminal, enter:
mkfm -k"<UserSlotLabel>(<PIN>)/<CertificateName>" -faal2sdk -oaal2sdk.fm
where
<UserSlotLabel>
is the label for the user slot on which the certificate was generated,
<PIN>
is
the administrator PIN for the token, and
<CertificateName>
is the name of the certificate that you
entered when generating the certificate.
6.
Upload the firmware module into the HSM:
a.
At a terminal, enter:
ctconf -b<CertificateName> -jaal2sdk.fm
where
<CertificateName>
is the name of the certificate that you entered when generating the
certificate.
Note
Storage and Sensitive Data Keys cannot be created on the admin slot.
IDENTIKEY Appliance Installation and Maintenance
102
