Use iKeyman to store keys on a PKCS11 device

For IBM HTTP Server, we can use iKeyman for storing keys on a PKCS11 device.

 

Procedure

• We will need to obtain the file name and the path location of the cryptographic driver in order to store the keys on the PKCS11 device. The following are examples of path locations for PKCS11 devices:

  • nCipher:

    • /opt/nfast/toolkits/pkcs11/libcknfast.so

    • /opt/nfast/toolkits/pkcs11/libcknfast.sl

    • /opt/nfast/toolkits/pkcs11/libcknfast.so

    • /opt/nfast/toolkits/pkcs11/libcknfast.so

    • C:\nfast\toolkits\pkcs11\cknfast.dll

  • IBM 4758

    • /usr/lib/pkcs11/PKCS11_API.so

    • $PKCS11_HOME\bin\NT\cryptoki.dll

  • IBM e-business Cryptographic Accelerator

    • /usr/lib/pkcs11/PKCS11_API.so

• Run iKeyman to store the keys on the PKCS11 device.

  After launching iKeyman:

  • Select Key Database File from the menu, then Open to navigate to the Key database information dialog

  • From the drop down for Key Database Type, select CMS Cryptographic Token

  • Enter the File Name and Location for the PKCS11 driver name and path location

  • Click OK to navigate to the Open Cryptographic Token dialog

  • Choose the Cryptographic Token Label of the PKCS11 device

  • Provide the Cryptographic Token Password for the PKCS11 device (which is a previously set password that is hardware-specific)

  • Select the Create new secondary key database file option and fill in prompts for creating a new secondary key database

 

Results

After opening a cryptographic token successfully, iKeyman will display the certificates stored in the cryptographic token.

 

What to do next

We can create, import, or receive a personal certificate as we normally would and the private key will be stored on our PKCS11 device.

---

 

Related tasks

Getting started with the cryptographic hardware for SSL (Distributed systems)
Manage keys with the iKeyman graphical interface (Distributed systems)
Creating a new key pair and certificate request