Configurer le client du cluster HSM dans Windows

Générez une clé privée (pkey-c) et un CSR (pkeycsr.csr).

$ openssl req -newkey rsa:4096 -nodes -keyout pkey-c -out pkeycsr.csr -sha256
Generating a 4096 bit RSA private key
...............................................................................................................++
...................................................................++
writing new private key to 'pkey-c'
-----

You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [XX]:US
State or Province Name (full name) []:TX
Locality Name (eg, city) [Default City]:AS
Organization Name (eg, company) [Default Company Ltd]:ORC
Organizational Unit Name (eg, section) []:SEC
Common Name (eg, your name or your server's hostname) []:dkms
Email Address []:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

Obtenez le CSR (pkeycsr.csr) signé par le responsable de la partition à l'aide des fichiers customerPO.key et partitionOwnerCert.pem pour générer cert-c. Pour plus d'informations sur customerPO.key et partitionOwnerCert.pem, voir Signature de la demande de signature de certificat.

$ openssl x509 -req -days 3650 -in pkeycsr.csr -CA partitionOwnerCert.pem -CAkey customerPO.key -out cert-c
Signature ok
subject=/C=US/ST=TX/L=AS/O=ORC/OU=SEC/CN=dkms
Getting CA Private Key