Impostazione del client cluster HSM in Windows

Generare una chiave privata (pkey-c) e un CSR (pkeycsr.csr).

$ openssl req -newkey rsa:4096 -nodes -keyout pkey-c -out pkeycsr.csr -sha256
Generating a 4096 bit RSA private key
...............................................................................................................++
...................................................................++
writing new private key to 'pkey-c'
-----

You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [XX]:US
State or Province Name (full name) []:TX
Locality Name (eg, city) [Default City]:AS
Organization Name (eg, company) [Default Company Ltd]:ORC
Organizational Unit Name (eg, section) []:SEC
Common Name (eg, your name or your server's hostname) []:dkms
Email Address []:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

Ottenere il CSR (pkeycsr.csr) firmato dal proprietario della partizione utilizzando i file customerPO.key e partitionOwnerCert.pem per generare cert-c. Per informazioni su customerPO.key e partitionOwnerCert.pem, vedere Firma dell'addetto al servizio clienti.

$ openssl x509 -req -days 3650 -in pkeycsr.csr -CA partitionOwnerCert.pem -CAkey customerPO.key -out cert-c
Signature ok
subject=/C=US/ST=TX/L=AS/O=ORC/OU=SEC/CN=dkms
Getting CA Private Key