Utilities Reference Guide

User Manual:

Open the PDF directly: View PDF .
Page Count: 146 [warning: Documents this large are best viewed by clicking the View PDF Link!]

PREFACE About the Utilities Reference Guide
1 Certificate Management Utility (CMU)
2 CKdemo
CKlog
- cklog Utility
3 Lunadiag
- Lunadiag Utility
  - Using Lunadiag
  - Verify Successful Installation
4 Multitoken
- Accessing Multitoken
- Using Multitoken
  - Operating Modes
  - Named and User-defined Curves
5 Pedserver and Pedclient
6 Remote Backup Service (RBS)
7 SAlogin
- Using the salogin Utility
8 SCP and PSCP
- Using the scp and pscp Utilities
9 Ureset Utility
- ureset
  - Example
10 Vreset Utility
- vreset
  - Example
11 VTL

SafeNet Network HSM 6.2.2

Document Information

Product Version 6.2.2

Document Part Number 007-011136-012

Release Date 01 December 2016

Revision History

Revision Date Reason

A 01 December 2016 Initial release.

Trademarks, Copyrights, and Third-Party Software

Gemaltoand/or its subsidiaries and are registered in certain countries. All other trademarks and service marks, whether

registered or not in specific countries, are the property of their respective owners.

Acknowledgements

This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit.

(http://www.openssl.org)

This product includes cryptographic software written by Eric Young (eay@cryptsoft.com). This product includes

software written by Tim Hudson (tjh@cryptsoft.com).

This product includes software developed by the University of California, Berkeley and its contributors.

This product uses Brian Gladman’s AES implementation.

Refer to the End User License Agreement for more information.

Disclaimer

All information herein is either public information or is the property of and owned solely by Gemalto and/or its

subsidiaries who shall have and keep the sole right to file patent applications or any other kind of intellectual property

protection in connection with such information.

Nothing herein shall be construed as implying or granting to you any rights, by license, grant or otherwise, under any

intellectual and/or industrial property rights of or concerning any of Gemalto’s information.

This document can be used for informational, non-commercial, internal, and personal use only provided that:

•The copyright notice, the confidentiality and proprietary legend and this full warning notice appear in all copies.

•This document shall not be posted on any publicly accessible network computer or broadcast in any media, and no

modification of any part of this document shall be made.

Use for any other purpose is expressly prohibited and may result in severe civil and criminal liabilities.

The information contained in this document is provided “AS IS” without any warranty of any kind. Unless otherwise

expressly agreed in writing, Gemaltomakes no warranty as to the value or accuracy of information contained herein.

SafeNet Network HSM Utilities Reference Guide

The document could include technical inaccuracies or typographical errors. Changes are periodically added to the

information herein. Furthermore, Gemaltoreserves the right to make any change or improvement in the specifications

data, information, and the like described herein, at any time.

Gemalto hereby disclaims all warranties and conditions with regard to the information contained herein, including all

implied warranties of merchantability, fitness for a particular purpose, title and non-infringement. In no event shall

Gemalto be liable, whether in contract, tort or otherwise, for any indirect, special or consequential damages or any

damages whatsoever including but not limited to damages resulting from loss of use, data, profits, revenues, or

customers, arising out of or in connection with the use or performance of information contained in this document.

Gemalto does not and shall not warrant that this product will be resistant to all possible attacks and shall not incur, and

disclaims, any liability in this respect. Even if each product is compliant with current security standards in force on the

date of their design, security mechanisms' resistance necessarily evolves according to the state of the art in security

and notably under the emergence of new attacks. Under no circumstances, shall Gemaltobe held liable for any third

party actions and in particular in case of any successful attack against systems or equipment incorporating Gemalto

products. Gemaltodisclaims any liability with respect to security for direct, indirect, incidental or consequential

damages that result from any use of its products. It is further stressed that independent testing and verification by the

person using the product is particularly encouraged, especially in any application in which defective, incorrect or

insecure functioning could result in damage to persons or property, denial of service, or loss of privacy.

Regulatory Compliance

This product complies with the following regulatory regulations. To ensure compliancy, ensure that you install the

products as specified in the installation instructions and use only Gemalto-supplied or approved accessories.

USA, FCC

This device complies with Part 15 of the FCC rules. Operation is subject to the following conditions:

•This device may not cause harmful interference.

•This device must accept any interference received, including interference that may cause undesired operation.

Note: This equipment has been tested and found to comply with the limits for a “Class B”

digital device, pursuant to part 15 of the FCC rules. These limits are designed to provide

reasonable protection against harmful interference in a residential installation. This equipment

generates, uses and can radiate radio frequency energy and, if not installed and used in

accordance with the instructions, may cause harmful interference to radio communications.

However, there is no guarantee that interference will not occur in a particular installation.

If this equipment does cause harmful interference to radio or television reception, which can be determined by turning

the equipment off and on, the user is encouraged to try to correct the interference by one or more of the following

measures:

•Reorient or relocate the receiving antenna

•Increase the separation between the equipment and receiver

•Connect the equipment into an outlet on a circuit different from that to which the receiver is connected

•Consult the dealer or an experienced radio/TV technician for help

Changes or modifications not expressly approved by Gemalto could void the user’s authority to operate the equipment.

Canada

This class B digital apparatus meets all requirements of the Canadian interference- causing equipment regulations.

SafeNet Network HSM Utilities Reference Guide

Europe

This product is in conformity with the protection requirements of EC Council Directive 2004/108/EC. Conformity is

declared to the following applicable standards for electro-magnetic compatibility immunity and susceptibility; CISPR22

and IEC801. This product satisfies the CLASS B limits of EN 55022.

SafeNet Network HSM Utilities Reference Guide

CONTENTS

PREFACE About the Utilities Reference Guide 11

Customer Release Notes 11

Gemalto Rebranding 12

Audience 12

Document Conventions 12

Notes 12

Cautions 13

Warnings 13

Command Syntax and Typeface Conventions 13

Support Contacts 14

1 Certificate Management Utility (CMU) 16

About the CMU Functions 16

Authentication 16

cmu certify 17

cmu delete 19

cmu export 20

cmu generatekeypair 21

cmu getattribute 25

cmu getpkc 26

cmu import 27

cmu importkey 28

cmu list 30

cmu requestcertificate 32

cmu selfsigncertificate 35

cmu setattribute 38

cmu verifypkc 40

2 CKdemo 41

Accessing the ckdemo Utility 41

Using the ckdemo Menu 42

Executing a Menu Function 43

The AUDIT/LOG Menu Functions 44

(130) Get Config 44

(131) Set Config 44

(132) Verify Logs 44

(133) Get Time 44

(134) Set Time 44

(135) Import Secret 44

(136) Export Secret 44

(137) Init Audit 44

(138) Get Status 44

(139) Log External 45

SafeNet Network HSM Utilities Reference Guide

The CA Menu Functions 45

(70) Set Domain 45

(71) Clone Key 45

(72) Set MofN 45

(73) Generate MofN 45

(74) Activate MofN 45

(75) Generate Token Keys 45

(76) Get Token Cert 46

(77) Sign Token Cert 46

(78) Generate CertCo Cert 46

(79) Modify MofN 46

(86) Dup. MofN Keys 46

(87) Deactivate MofN 46

(88) Get Token Certificates 46

(112) Set Legacy Cloning Domain 46

The CLUSTER EXECUTION Menu Functions 46

(111) Get Cluster State 47

The HIGHAVAILABILITY RECOVERY Menu Functions 47

(50) HA Init 47

(51) HA Login 47

(52) HA Status 47

The KEY Menu Functions 47

60) Wrap Key 47

61) Unwrap Key 47

62) Generate Random Number 47

63) Derive Key 48

64) PBE Key Generation 48

65) Create Known Keys 48

66) Seed RNG 48

67) EC User Defined Curves 48

The OBJECT MANAGEMENT Menu Functions 48

(20) Create Object 48

(21) Copy Object 48

(22) Destroy Object 49

(23) Object Size 49

(24) Get Attribute 49

(25) Set Attribute 49

(26) Find Objects 49

(27) Display Object 49

(30) Modify Usage Count 49

(31) Destroy Multiple Objects 49

(32) Extract Public Key 49

The OFFBOARD KEY STORAGE Menu Functions 50

(101) Extract Masked Object 50

(102) Insert Masked Object 50

(103) Multisign With Value 50

(104) Clone Object 50

(105)SIMExtract 50

(106) SIMInsert 50

SafeNet Network HSM Utilities Reference Guide

(107) SimMultiSign 50

(118) Extract Object 50

(119) Insert Object 50

The OTHERS Menu Functions 50

90) Self Test 51

94) Open Access 51

95) Close Access 51

97) Set App ID 51

98) Options 51

100) LKM Commands 52

The PED INFO menu functions 52

120) Set PED Info 52

121) Get PEDInfo 52

122) Init RPV 52

123) Delete RPV 53

The SCRIPT EXECUTION Menu Functions 53

(108) Execute Script 53

(109) Execute Asynchronous Script 53

(110) Execute Single Part Script 53

The SECURITY Menu Functions 53

(40) Encrypt File 53

(41) Decrypt File 53

(42) Sign 53

(43) Verify 54

(44) Hash 54

(45) Simple Generate Key 54

(46) Digest Key 54

The SRK Menu Functions 54

(200) SRK Get State 54

(201) SRK Restore 54

(202) SRKResplit 54

(203) SRK Zeroize 54

(204) SRK Enable/Disable 54

The TOKEN Menu Functions 55

(1) Open Session 55

(2) Close Session 55

(3) Login 55

(4) Logout 55

(5) Change PIN 55

(6) Init Token 55

(7) Init PIN 56

(8) Mechanism List 56

(9) Mechanism Info 56

(10) Get Info 56

11) Slot Info 56

12) Token Info 56

13) Session Info 56

14) Get Slot List 57

15) Wait for Slot Event 57

SafeNet Network HSM Utilities Reference Guide

18) Factory Reset 57

19) Clone MofN 57

CKlog 58

cklog Utility 58

Windows Example 58

UNIX Example 59

Selective Logging 59

3 Lunadiag 61

Lunadiag Utility 61

Using Lunadiag 61

Verify Successful Installation 63

4 Multitoken 64

Accessing Multitoken 64

Using Multitoken 64

Operating Modes 66

Named and User-defined Curves 70

5 Pedserver and Pedclient 73

Overview 73

The pedserver Utility 73

The pedclient Utility 73

The pedclient Command 74

General Syntax 74

PedClient on SafeNet Network HSM 77

The pedserver Command 77

Syntax 77

Sample Outputs 79

6 Remote Backup Service (RBS) 81

RBS Overview 81

rbs 82

rbs config 83

rbs daemon 84

rbs genkey 85

rbs nopassword 86

7 SAlogin 87

Using the salogin Utility 87

The salogin Command 87

Examples 88

Other options 88

8 SCP and PSCP 89

Using the scp and pscp Utilities 89

SafeNet Network HSM Utilities Reference Guide

9 Ureset Utility 91

ureset 91

Example 91

10 Vreset Utility 93

vreset 93

Example 93

11 VTL 95

VTL Overview 96

vtl addServer 98

vtl backup 99

vtl backup append 101

vtl backup delete 103

vtl backup restore 104

vtl backup token 105

vtl backup token factoryreset 106

vtl backup token init 107

vtl backup token resize 108

vtl backup token show 109

vtl backup token show licenses 110

vtl backup token update 111

vtl cklogsupport 112

vtl createCert 113

vtl deleteServer 115

vtl examineCert 116

vtl fingerprint 118

vtl haAdmin 119

vtl haAdmin addMember 120

vtl haAdmin autoRecovery 122

vtl haAdmin deleteGroup 123

vtl haAdmin haLog 125

vtl haAdmin HAOnly Client 127

vtl haAdmin HAOnly disable 128

vtl haAdmin HAOnly enable 129

vtl haAdmin HAOnly show 130

vtl haAdmin newGroup 131

vtl haAdmin recover group 133

vtl haAdmin removeMember 134

vtl haAdmin show 135

vtl haAdmin standbyMembers 136

vtl haAdmin standbyMembers -remove 137

vtl haAdmin standbyMembers -set 138

vtl haAdmin synchronize 139

vtl listServers 140

vtl listSlots 141

vtl logging configure 142

vtl logging show 143

SafeNet Network HSM Utilities Reference Guide

vtl replaceserver 144

vtl supportInfo 145

vtl verify 146

SafeNet Network HSM Utilities Reference Guide

PREFACE About the Utilities Reference Guide

PREFACE

About the Utilities Reference Guide

This document describes how to use the various utilities included with the SafeNet HSM client. It contains the following

chapters:

•"Certificate Management Utility (CMU)"on page 16

•"CKdemo"on page 41

•"CKlog"on page 58

•"Lunadiag"on page 61

•"Multitoken"on page 64

•"Pedserver and Pedclient"on page 73

•"Remote Backup Service (RBS)"on page 81

•"SAlogin"on page 87

•"SCP and PSCP"on page 89

•"Ureset Utility"on page 91

•"Vreset Utility"on page 93

•"VTL"on page 95

This preface also includes the following information about this document:

•"Customer Release Notes"below

•"Gemalto Rebranding"on the next page

•"Audience"on the next page

•"Document Conventions"on the next page

•"Support Contacts"on page 14

For information regarding the document status and revision history, see "Document Information"on page 2.

Customer Release Notes

The customer release notes (CRN) provide important information about this release that is not included in the customer

documentation. It is strongly recommended that you read the CRN to fully understand the capabilities, limitations, and

known issues for this release. You can view or download the latest version of the CRN for this release at the following

location:

•http://www.securedbysafenet.com/releasenotes/luna/crn_luna_hsm_6-2-2.pdf

SafeNet Network HSM Utilities Reference Guide

PREFACE About the Utilities Reference Guide

Gemalto Rebranding

In early 2015, Gemalto completed its acquisition of SafeNet, Inc. As part of the process of rationalizing the product

portfolios between the two organizations, the Luna name has been removed from the SafeNet HSM product line, with

the SafeNet name being retained. As a result, the product names for SafeNet HSMs have changed as follows:

Old product name New product name

Luna SA HSM SafeNet Network HSM

Luna PCI-E HSM SafeNet PCIe HSM

Luna G5 HSM SafeNet USB HSM

Luna PED SafeNet PED

Luna Client SafeNet HSM Client

Luna Dock SafeNet Dock

Luna Backup HSM SafeNet Backup HSM

Luna CSP SafeNet CSP

Luna JSP SafeNet JSP

Luna KSP SafeNet KSP

Note: These branding changes apply to the documentation only. The SafeNet HSMsoftware

and utilities continue to use the old names.

Audience

This document is intended for personnel responsible for maintaining your organization's security infrastructure. This

includes SafeNet HSM users and security officers, key manager administrators, and network administrators.

All products manufactured and distributed by Gemalto are designed to be installed, operated, and maintained by

personnel who have the knowledge, training, and qualifications required to safely perform the tasks assigned to them.

The information, processes, and procedures contained in this document are intended for use by trained and qualified

personnel only.

It is assumed that the users of this document are proficient with security concepts.

Document Conventions

This document uses standard conventions for describing the user interface and for alerting you to important information.

Notes

Notes are used to alert you to important or helpful information. They use the following format:

SafeNet Network HSM Utilities Reference Guide

PREFACE About the Utilities Reference Guide

Note: Take note. Contains important or helpful information.

Cautions

Cautions are used to alert you to important information that may help prevent unexpected results or data loss. They use

the following format:

CAUTION: Exercise caution. Contains important information that may help prevent

unexpected results or data loss.

Warnings

Warnings are used to alert you to the potential for catastrophic data loss or personal injury. They use the following

format:

WARNING! Be extremely careful and obey all safety and security measures. In this

situation you might do something that could result in catastrophic data loss or

personal injury.

Command Syntax and Typeface Conventions

Format Convention

bold The bold attribute is used to indicate the following:

•Command-line commands and options (Type dir /p.)

•Button names (Click Save As.)

•Check box and radio button names (Select the Print Duplex check box.)

•Dialog box titles (On the Protect Document dialog box, click Yes.)

•Field names (User Name: Enter the name of the user.)

•Menu names (On the File menu, click Save.) (Click Menu > Go To > Folders.)

•User input (In the Date box, type April 1.)

italics In type, the italic attribute is used for emphasis or to indicate a related document. (See the

Installation Guide for more information.)

<variable> In command descriptions, angle brackets represent variables. You must substitute a value for

command line arguments that are enclosed in angle brackets.

[optional]

[<optional>]

Represent optional keywords or <variables> in a command line description. Optionally enter the

keyword or <variable> that is enclosed in square brackets, if it is necessary or desirable to

complete the task.

{a|b|c}

{<a>|<b>|<c>}

Represent required alternate keywords or <variables> in a command line description. You must

choose one command line argument enclosed within the braces. Choices are separated by vertical

(OR) bars.

SafeNet Network HSM Utilities Reference Guide

PREFACE About the Utilities Reference Guide

Format Convention

[a|b|c]

[<a>|<b>|<c>]

Represent optional alternate keywords or variables in a command line description. Choose one

command line argument enclosed within the braces, if desired. Choices are separated by vertical

(OR) bars.

Support Contacts

Contact method Contact

Address Gemalto

4690 Millennium Drive

Belcamp, Maryland 21017

USA

Phone Global +1 410-931-7520

Australia 1800.020.183

China (86) 10 8851 9191

France 0825 341000

Germany 01803 7246269

India 000.800.100.4290

Netherlands 0800.022.2996

New Zealand 0800.440.359

Portugal 800.1302.029

Singapore 800.863.499

Spain 900.938.717

Sweden 020.791.028

Switzerland 0800.564.849

United Kingdom 0800.056.3158

United States (800) 545-6608

Web www.safenet-inc.com

Support and Downloads www.safenet-inc.com/support

Provides access to the Gemalto Knowledge Base and quick downloads for

various products.

Technical Support Customer

Portal

https://serviceportal.safenet-inc.com

Existing customers with a Technical Support Customer Portal account can log in

SafeNet Network HSM Utilities Reference Guide

PREFACE About the Utilities Reference Guide

Contact method Contact

to manage incidents, get the latest software upgrades, and access the Gemalto

Knowledge Base.

SafeNet Network HSM Utilities Reference Guide

Certificate Management Utility (CMU)

This chapter provides a detailed description of each of the functions available in the SafeNet Certificate Management

Utility. It contains the following topics:

•"About the CMU Functions"below

•"cmu certify"on the next page

•"cmu delete"on page 19

•"cmu export"on page 20

•"cmu generatekeypair"on page 21

•"cmu getattribute"on page 25

•"cmu getpkc"on page 26

•"cmu import"on page 27

•"cmu importkey"on page 28

•"cmu list"on page 30

•"cmu requestcertificate"on page 32

•"cmu selfsigncertificate"on page 35

•"cmu setattribute"on page 38

•"cmu verifypkc"on page 40

About the CMU Functions

This section provides a detailed description of each function available in the Certificate Management Utility.

The command function is the first parameter on the command line that invokes the CMU application. It does not require

a leading dash character. All options follow the command function and do employ leading dashes. Only a single

command function can be specified with each invocation of the CMU application.

cmu <function> <-parameter_name[=parameter_value]>

Most functions take parameters, some of which may be mandatory, and some optional. Parameters may, in turn, take

values. If a parameter takes a value, then the general syntax is to write the command "cmu", followed by a space,

followed by a function name, followed by a space, followed by a leading dash "-" and parameter name and an equal sign

"=" and a value, with no spaces from the dash to the end of the parameter value. Multiple parameters are separated by

spaces.

Authentication

Where an operation requires authentication, you must provide the appropriate Password (for a Password Authenticated

HSM) or the appropriate PED Key (via SafeNet PED, for a Trusted Path HSM).

SafeNet Network HSM Utilities Reference Guide

1 Certificate Management Utility (CMU)

cmu certify

This function creates an X.509 V3 certificate from a PKCS #10 certificate request. The parent certificate and

corresponding private key must already exist on the token or HSM. The private key is located on the token using the

public key info inside the parent certificate.

Syntax

cmu certify <parameters>

Mandatory Parameters

Parameter Description

-handle=<handle#> This is a mandatory parameter that defines the handle to parent certificate. If this

parameter is omitted and there is only one certificate on the HSM, that certificate is

automatically selected. If this parameter is omitted and there are multiple certificates on

the HSM, the user is asked to select the certificate.

-inputfile This parameter defines the name of the file that contains the PKCS #10 certificate

request.

-startDate This parameter defines the validity start of the certificate, in the format YYYYMMDD.

-endDate This parameter defines the validity end of the certificate, in the format YYYYMMDD.

-serialNumber This parameter defines the serial number of the certificate, in big-endian hexadecimal

form.

Optional Parameters

Parameter Description

-keyusage This is an optional parameter that defines the key usage extension for the certificate. It

can be set to any of the following: digitalsignature, nonrepudiation, keyencipherment,

dataencipherment, keyagreement, keycertsign, crlsign, encipheronly, decipheronly. This

parameter may appear more than once in the parameter set to define multiple usages, or

it can be used once with a comma separated list of usage types.

-md5WithRsa This is an optional parameter that defines the signature algorithm for the certificate to be

pkcs-1-MD5withRSAEncryption. The default is to use sha1WithRsa.

-sha1WithRsa This is an optional parameter that defines the signature algorithm for the certificate to be

pkcs-1-SHA1withRSAEncryption. The default is to use sha1WithRsa.

-label This is an optional parameter that defines the label attribute for the certificate object that

gets created on the HSM. If omitted, the common name of the subject DN is used

instead.

-sha224withrsa This is an optional parameter that defines the signature algorithm for the certificate to be

pkcs-1-SHA224withRSAEncryption. The default is to use sha1WithRsa.

SafeNet Network HSM Utilities Reference Guide

1 Certificate Management Utility (CMU)

Parameter Description

-sha256withrsa This is an optional parameter that defines the signature algorithm for the certificate to be

pkcs-1-SHA256withRSAEncryption. The default is to use sha1WithRsa.

-sha384withrsa This is an optional parameter that defines the signature algorithm for the certificate to be

pkcs-1-SHA384withRSAEncryption. The default is to use sha1WithRsa.

-sha512withrsa This is an optional parameter that defines the signature algorithm for the certificate to be

pkcs-1-SHA512withRSAEncryption. The default is to use sha1WithRsa.

-sha1withdsa This is an optional parameter that defines the signature algorithm for the certificate to be

pkcs-1-SHA1withDSAEncryption. The default is to use sha1WithRsa.

-sha1withecdsa This is an optional parameter that defines the signature algorithm for the certificate to be

pkcs-1-SHA1withECDSAEncryption. The default is to use sha1WithRsa.

- sha224withecdsa This is an optional parameter that defines the signature algorithm for the certificate to be

pkcs-1-SHA224withECDSAEncryption. The default is to use sha1WithRsa.

-sha256withecdsa This is an optional parameter that defines the signature algorithm for the certificate to be

pkcs-1-SHA256withECDSAEncryption. The default is to use sha1WithRsa.

-sha384withecdsa This is an optional parameter that defines the signature algorithm for the certificate to be

pkcs-1-SHA384withECDSAEncryption. The default is to use sha1WithRsa.

- sha512withecdsa This is an optional parameter that defines the signature algorithm for the certificate to be

pkcs-1-SHA512withECDSAEncryption. The default is to use sha1WithRsa.

-id This optional parameter defines the CKA_ID attribute for the certificate object that gets

created on the HSM. If omitted, the CKA_ID attribute of the private key is used instead.

-certificatepolicy This optional parameter defines the certificate policy to be used.

-keyids This optional parameter indicates to use a subject key identifier from the parent. Set to

True or False (or 1 or 0).

Example

cmu certify -input=testCert.req -h=8

- create and sign a new certificate using certificate 8 as the parent.

SafeNet Network HSM Utilities Reference Guide

1 Certificate Management Utility (CMU)

cmu delete

This function deletes a key, certificate, or generic data object on the token. A confirmation message is presented to the

user, describing the class and label of the object about to be deleted.

Syntax

cmu delete <parameters>

Required Parameters

Parameter Description

-handle=<handle#> The handle of the object to be deleted. The parameter "-handle" is followed by an equal

sign "=", followed by the handle of the object (no spaces).

Optional Parameters

Parameter Description

-force This optional parameter can be used to suppress the user confirmation step.

Example

The following command deletes the key or certificate referenced by object handle 14 without a request for confirmation

of the delete operation:

cmu delete -handle=14 -force

The following command queries the user for a handle of an object to delete. The user is asked to confirm the deletion

operation:

cmu delete

SafeNet Network HSM Utilities Reference Guide

1 Certificate Management Utility (CMU)

cmu export

This function exports an X.509 certificate from the token or HSM to a file. The supported formats are Raw (binary) and

PEM (base 64 encoding).

Syntax

cmu export

Required Parameters

Parameter Description

-handle=<handle#> The handle to the X.509 certificate to be exported from the HSM to a file. The parameter

"-handle" is followed by an equal sign "=", followed by the handle of the object (no

spaces).

-outputfile This mandatory parameter defines the name of the file that receives the certificate.

Optional Parameters

Parameter Description

-binary This is an optional parameter that defines the exported certificate format to be raw binary

instead of the default PEM (base64) encoding.

Example

The following command outputs the certificate with handle 7 to file test.cer in PEM format:

cmu export -handle=7 -output=test.cer

SafeNet Network HSM Utilities Reference Guide

1 Certificate Management Utility (CMU)

cmu generatekeypair

This function generates an asymmetric key pair on the token or HSM. An optional input filename can be used to specify

a file from which mandatory and optional attributes are to be read.

For DSA key generation, the domain parameters (Prime, Subprime, and Base) are required, and must be provided either

as part of the command, or as responses to interactive prompting. If one is provided at the command line, then all three

must be provided in that manner. If none are provided at the command line, then all three are prompted for interactive

entry.

You may not provide only one or two of the parameters at the command line. Providing just one or two domain

parameters is considered an error, and the command halts with an error message.

Syntax

cmu generatekeypair <parameters>

Required Parameters

Parameter Description

-modulusBits This mandatory parameter defines the length in bits of the modulus value for the

generation of RSA key pairs. It must be set to a value between 1024 and 4096 that is a

multiple of 64 bits.

If the HSM policy 12 "Allow non-FIPS algorithms" is set to "No", then RSA key size is

limited to 2048 bits or 3072 bits.

-publicExponent This mandatory parameter defines the public exponent value to use in the generation of

RSA key pairs. It must be set to a value of 3, 17 or 65537.

Optional Parameters

Parameter Description

-binary This is an optional parameter that defines the exported certificate format to be raw binary

instead of the default PEM (base64) encoding.

-inputFile This optional parameter defines the name of a file from which to obtain additional

parameter settings, one per line, of the form name=value.

-keyType This optional parameter defines the type of asymmetric keys to generate. This

parameter is not required if the key type can be established by the presence of other

parameters. (e.g. If modulusBits and/or publicExponent parameters are present, then -

keyType=RSA is redundant). Currently, only RSA key pairs are supported.

-label This optional parameter defines a label to be applied to both of the newly generated

keys. If a multiple word label is required, the label value must be enclosed within

quotation marks.

-labelPublic This optional parameter defines a label to apply to the public key from the newly

generated key pair.

SafeNet Network HSM Utilities Reference Guide

1 Certificate Management Utility (CMU)

Parameter Description

-labelPrivate This optional parameter defines a label to apply to the private key from the newly

generated key pair.

-modifiable This optional parameter defines the modifiable setting for each of the keys in the key

pair. It must be set to True or False (or 1 or 0).

-id This optional parameter defines the Id field for the newly generated keys. It must be set

to a big-endian hexadecimal integer value.

-startDate This optional parameter defines the startDate field for the newly generated keys. The

format for the value is YYYYMMDD.

-endDate This optional parameter defines the endDate field for the newly generated keys. The

format for the value is YYYYMMDD.

-subject This optional parameter defines the subject field for the newly generated keys. It must

be set to a big-endian hexadecimal integer value. The subject field is typically set to the

DER encoding of the subject distinguished name for the key.

-encrypt This optional parameter defines the encrypt setting for the public key in the newly

generated key pair. It must be set to True or False (or 1 or 0), with False being the

default. If this parameter is set to True, then the decrypt setting for the private key

should also be set to True. Note that an HSM is often configured such that no key can

have multiple functions. Thus if encrypt is set True, then wrap and verify need to be

False.

-decrypt This optional parameter defines the decrypt setting for the private key in the newly

generated key pair. It must be set to True or False (or 1 or 0), with False being the

default. If this parameter is set to True, then the encrypt setting for the public key should

also be set to True. Note that an HSM is often configured such that no key can have

multiple functions. Thus if decrypt is set True, then unwrap and sign need to be False.

-sign This optional parameter defines the sign setting for the private key in the newly

generated key pair. It must be set to True or False (or 1 or 0), with False being the

default. If this parameter is set to True, then the verify setting for the public key should

also be set to True. Note that an HSM is often configured such that no key can have

multiple functions. Thus if sign is set True, then unwrap and decrypt need to be False.

-verify This optional parameter defines the verify setting for the public key in the newly

generated key pair. It must be set to True or False (or 1 or 0), with False being the

default. If this parameter is set to True, then the sign setting for the private key should

also be set to True. Note that an HSM is often configured such that no key can have

multiple functions. Thus if verify is set True, then encrypt and wrap need to be False.

-wrap This optional parameter defines the wrap setting for the public key in the newly

generated key pair. It must be set to True or False (or 1 or 0), with False being the

default. If this parameter is set to True, then the unwrap setting for the private key should

also be set to True. Note that an HSM is often configured such that no key can have

multiple functions. Thus if wrap is set True, then encrypt and verify need to be False.

SafeNet Network HSM Utilities Reference Guide

1 Certificate Management Utility (CMU)

Parameter Description

-unwrap This optional parameter defines the unwrap setting for the private key in the newly

generated key pair. It must be set to True or False (or 1 or 0), with False being the

default. If this parameter is set to True, then the wrap setting for the public key should

also be set to True. Note that an HSM is often configured such that no key can have

multiple functions. Thus if unwrap is set True, then decrypt and sign need to be False.

-extractable This optional parameter defines the extractable setting for the private key in the newly

generated key pair. It must be set to True or False (or 1 or 0), with False being the

default.

-curvetype This optional parameter defines the name of a curve type for ECDSA keys. Enter values

1-5 (1-NISTP 192 / 2-NISTP 224 / 3-NISTP 256 / 4-NISTP 384 / 5-NISTP 521).

-prime This optional parameter defines a prime length for DSA key generation.

-subprime This optional parameter defines a subprime bits length for DSA key generation.

-base This optional parameter defines a base length for DSA key generation.

Example

RSA

C:\Program Files\SafeNet\LunaClient>cmu gen -modulusBits=2048 -publicExp=65537 -sign=T -verify=T

Select token

[1] Token Label: myPartition1

[2] Token Label: myPartition1

Enter choice: 2

Please enter password for token in slot 2 : *******************

C:\Program Files\SafeNet\LunaClient>cmu list

Select token

[1] Token Label: myPartition1

[2] Token Label: myPartition1

Enter choice: 2

Please enter password for token in slot 2 : *******************

handle=14 label=NewPublicVerifyingKey

handle=15 label=NewPrivateSigningKey

C:\Program Files\SafeNet\LunaClient>

DSA - Domain Parameters at Command Line

cmu generatekeypair -keytype DSA -slot 6 -prime 0xfcec6182e-

b206b43c03e36c0ead-

abff56a0c2e79def44bc8f2e53699096d1ff270f159785d756921dbff9773ae08483b662fc07df7512ff68b2e5565fd7982e20c244832aba121cc0799cc09f2d5414d5f3966211365f51b83e9ffcccb3d88cdf238f7c2739131ca7aadff662fec1fb0e1d311a404260376fd011fe00d0204c3

-subprime 0xd3807353b51c5f71b22ac3d0c7e394148fcedc61 -base

0x42e3778e6ec31b0d-

b07a6b370d7f-

b6fb4a0bca6deaac371f6adbcbeba38ddf76a47c3c3d79276a0e579ce4e347180fd9b4ad461d6cf0eac51fb08cf452f624570051e518a75a5bb9c3578a14fd4f27f795b22acea62b1fdf1032c1266da081c7fb99c4266626587093fd381617238ee1578fc325548dc1c08e5f9322c3b1205e

SafeNet Network HSM Utilities Reference Guide

1 Certificate Management Utility (CMU)

DSA - Domain Parameters Entered Interactively

cmu generatekeypair -keytype DSA -slot 6

The prime, subprime and base values must be entered as a HEX byte array.

For example, to enter a 1024-bit prime value, enter a 128-byte HEX byte array using this format:

0xa0383ee692f8...

The prime value can be a 1024-bit, 2048-bit or 3072-bit value.

Enter a prime value: 0xfcec6182e-

b206b43c03e36c0eadabff56a0c2e79def44bc8f2e53699096d1ff270f159785d7 56921d-

bff9773ae08483b662fc07df7512ff68b2e5565fd7982e20c244832aba121cc0799cc09f2d5414d5f3966211365f

51b83e9ffcccb3d88cdf238f7c2739131ca7aadff662fec1fb0e1d311a404260376fd011fe00d0204c3

Enter a 160 bit subprime value: 0xd3807353b51c5f71b22ac3d0c7e394148fcedc61

Enter a 1024-bit base value: 0x42e3778e6ec31b0d-

b07a6b370d7fb6fb4a0bca6deaac371f6adbcbeba38ddf76a47 c3c3d79276a0e579ce4e347180f-

d9b4ad461d6cf0eac51fb08cf452f624570051e518a75a5bb9c3578a14fd4f27f795b22

acea62b1fdf1032c1266da081c7fb99c4266626587093fd381617238ee1578fc325548dc1c08e5f9322c3b1205e

SafeNet Network HSM Utilities Reference Guide

1 Certificate Management Utility (CMU)

cmu getattribute

This function outputs any viewable attributes for an object. An optional output filename can be used to direct the output

to a file.

Syntax

cmu getAttribute <parameters>

Required Parameters

Parameter Description

-handle=<handle#> The handle to the object. The parameter "-handle" is followed by an equal sign "=",

followed by the handle of the object (no spaces).

If this parameter is omitted and there is only one object on the HSM, that object is

automatically selected. If this parameter is omitted and there are multiple objects on the

HSM, you are prompted to select the object.

Optional Parameters

Parameter Description

-attributes This optional parameter lists the attributes to be displayed for the object as a comma

separated list. Multiple instances of this option can also be used to define multiple

attributes. If this parameter is omitted, all viewable attributes are displayed.

-outputFile This optional parameter defines the filename to which the attribute set is written. If this

parameter is omitted, the attribute set is written to the display.

Example

The following command outputs all of the viewable attributes for the object with handle 46

cmu getAttribute -handle=46

The following command outputs the label, public exponent and modulus of key 9 to file keydata.txt.

cmu getAttribute -handle=9 -attribute=label,publicExponent,modulus -outputFile=keydata.txt

SafeNet Network HSM Utilities Reference Guide

1 Certificate Management Utility (CMU)

cmu getpkc

Retrieve a Public Key Confirmation from the HSM.

Syntax

cmu getpkc

Optional Parameters

Parameter Description

-handle=<handle#> The handle to the corresponding private key for the PKC. The parameter "-handle" is

followed by an equal sign "=", followed by the handle of the object (no spaces).

-outputfile This mandatory parameter defines the name of the file that receives the PKC.

-pkctype This mandatory parameter defines the PKC type (1 - TC-TrustCenter, 2 - Chrysalis-ITS).

-verify This optional parameter sets a flag to verify the PKC against the certificate that signed

the PKC. It must be set to True or False (or 1 or 0), with False being the default.

Example

cmu getpkc –handle=5 –pkctype=1

SafeNet Network HSM Utilities Reference Guide

1 Certificate Management Utility (CMU)

cmu import

This function imports X.509 certificates from a file to the token or HSM. The file may include a single DER encoded

binary certificate or a CMSS PKCS #7 certificate or certificate set. Either type of certificate can be binary or PEM (base

64) encoded. An optional label can be defined as a function parameter. If omitted, the common name of the certificate

subject is chosen as the label.

Syntax

cmu import

Required Parameters

Parameter Description

-inputFile This parameter defines the name of the file containing the certificate to import.

Optional Parameters

Parameter Description

-label This parameter defines a label to apply to the imported certificate. If no label is defined,

the Common Name portion of the certificate Subject distinguished name is used

instead.

Example

The following example inputs the certificate in test.cer

SafeNet Network HSM Utilities Reference Guide

1 Certificate Management Utility (CMU)

cmu importkey

This function unwraps an RSA, DSA , or ECDSA private key onto the selected token or HSM. The key file may be in

any of the following formats:

•PKCS #12(PFX) RSA in a DER-encoded format (.pfx file)

•PKCS #8(Unencrypted PrivatekeyInfo) in RSA or DSA in base 64 PEM, or binary DER format

•PKCS #1 (RSA in base64 PEM, or binary DER) format.

Syntax

cmu importkey <parameters>

Required Parameters

Parameter Description

-in (Filename) This parameter defines the full path to the file containing the key to import.

-keyarg

(DSA|RSA|ECDSA)

Specifies the key's algorithm.

Optional Parameters

Parameter Description

-PKCS8 Indicates that the key to import is formatted according to the PKCS#8 standard.

-PKCS12 Indicates that the key to import is formatted according to the PKCS#12 standard. *Note

that only the private key portion is unwrapped onto the token. Any certificates in this file

are simply ignored.

It is assumed that you properly export a PKCS #12 key from Windows keystore (or other

source, as appropriate).

-wrapkey (handle) The handle of the existing key that is to be used as the wrapping key. *Note that this key

must have the CKA_WRAP attribute set to true. If this flag is not specified the default

behaviour is to autogenerate a 3DES key for the sole purpose of unwrapping the key

onto the HSM.

-setkeyattr Allows the user to manually enter the imported key’s attributes. Modifiable key attributes

are CKA_DECRYPT, CKA_SIGN, CKA_EXTRACTABLE, and CKA_UNWRAP. The

defaults are always 1=true.

Example

cmu importkey -in rawrsa1028.pem –keyalg RSA -wrapkey 11 –setkeyattr

cmu importkey –pkcs8 –in pk8privkey.pem –keyalg DSA–keyalg DSA

cmu importkey –in rsakey.pem –keyalg RSA –wrapkey 11

SafeNet Network HSM Utilities Reference Guide

1 Certificate Management Utility (CMU)

cmu importkey –in rsakey.pem –keyalg RSA

cmu importkey –PKCS12 –in p12.pfx –keyalg RSA

Notes

1. Ideally the private key should be in PKCS#8 format (privatekeyinfo) and not encrypted.

To convert a private key of either RSA or DSA type: (see PKCS#1 for RSA and PKCS#11 (11.9) for DSA) into a

PKCS#8 structure, use the following openssl command:

openssl pkcs8 -in key.pem -topk8 –nocrypt -out noenckey.pem

2. In the option to the command, the "PKCS" should be in all uppercase letters, as "cmu importkey -PKCS8" or "cmu

importkey -PKCS12".

3. If the PKCS#8 structure is already encrypted according to the PKCS#5-PBE standard, then to import via CMU, use

the following command:

openssl pkcs8 -in pk8.pem -out key.pem

*You will be prompted for the password to decrypt the PrivateKeyInfo.

4. You can export the PrivatekeyInfo contents of a .pfx file by using the following openssl command: openssl pkcs12

–in p12.pfx –out pk12_privkey.pem –nocerts –nodes

*You will be prompted for the password to decrypt the PrivateKeyInfo.

SafeNet Network HSM Utilities Reference Guide

1 Certificate Management Utility (CMU)

cmu list

This function lists all objects (keys, certificates and other general data objects) on the HSM that match an optional set

of search criteria and that are accessible given the authentication state of the HSM. Search criteria can include many of

the object attributes that are available for searching via the PKCS #11 API. If no search criteria are defined, all

accessible objects are returned. The content of the entries in the returned list is definable and can include the object

handle and/or any combination of viewable object attributes. The default is to include the handle and the label (CKA_

LABEL).

Syntax

cmu list <parameters>

Required Parameters

None

Optional Parameters

Parameter Description

-display This is a comma-separated list of attributes to be displayed for each returned object in

the list. Multiple attributes can also be specified by repeated use of the display option

instead of using the comma-separated list. The attributes supported with the display

option are index, handle, class, keyType, label and value. If this parameter is omitted,

only the handle and the label are displayed.

-class This option defines the class of object to list. It can be set to any of data, certificate,

public, private and secret.

-keyType This option specifies the type of keys to list. It can be set to any of rsa, dsa, dh, des,

2des, 3des, rc2, rc4, rc5, cast3, cast5 and generic.

-certificateType This option specifies the type of certificate to list. It can only be set to x.509 if used.

-label This option specifies the label that objects must match in order to be listed.

-application This option specifies the application attribute that objects must match in order to be

listed.

-value This option specifies the value that objects must match in order to be listed.

-issuer This option specifies the issuer that objects must match in order to be listed.

-serialNumber This option specifies the serial number that objects must match in order to be listed.

-subject This option specifies the subject that objects must match in order to be listed.

-id This option specifies the id that objects must match in order to be listed.

-token This option specifies whether permanent or temporary objects are to be listed. It can be

set to True or 1 for permanent objects and False or 0 for temporary objects.

SafeNet Network HSM Utilities Reference Guide

1 Certificate Management Utility (CMU)

Parameter Description

-private Set to True or False (or 1 or 0).

-sensitive Set to True or False (or 1 or 0).

-alwaysSensitive Set to True or False (or 1 or 0).

-extractable Set to True or False (or 1 or 0).

-neverExtractable Set to True or False (or 1 or 0).

-local Set to True or False (or 1 or 0).

-encrypt Set to True or False (or 1 or 0).

-decrypt Set to True or False (or 1 or 0).

-sign Set to True or False (or 1 or 0).

-verify Set to True or False (or 1 or 0).

-wrap Set to True or False (or 1 or 0).

-unwrap Set to True or False (or 1 or 0).

-derive Set to True or False (or 1 or 0).

startDate This option specifies the start date that objects must match in order to be listed.

endDate This option specifies the end date that objects must match in order to be listed.

modulusBits This option specifies the modulus size that RSA keys must match in order to be listed.

publicExponent This option specifies the public exponent value that RSA keys must match in order to be

listed. It can only be set to 3, 17 or 65537.

- modifiable Set to True or False (or 1 or 0).

Example

The following example displays the handle and label of each certificate that is accessible on the HSM:

cmu list -class=certificate

The following example displays the handles of all locally generated RSA private signing keys on the HSM:

cmu list -keyType=rsa -local=True -sign=True -display=handle

The following example displays the class, type and label of all signing keys on the HSM:

cmu list -display=class,keyType,label -sign=True

SafeNet Network HSM Utilities Reference Guide

1 Certificate Management Utility (CMU)

cmu requestcertificate

This function creates a PKCS #10 certificate request for an RSA/DSA/ECDSA key pair on the token or HSM. It must

be provided with the handle either to the public key or to the corresponding private key (all of the public key components

are contained within the private key). The private key must have Signing capability because it is used to sign the

certificate request structure. The signature is done using any of the mechanisms listed below. The subject name is

defined by a series of optional RDN components.

If none of these components are provided on the command line, the CKA_SUBJECT of the private key is used as the

subject of the certificate request. If the private key does not have its CKA_SUBJECT attribute set, the user will be

queried for each of the RDN components. The Subject DN should contain at least the country, organization and

common name components.

The signed certificate request is output to the specified file.

Syntax

cmu requestCertificate <parameters>

Required Parameters

Parameter Description

publichandle=

<pubkeyhandle#>

This is a mandatory parameter that defines the handle to the public key from an RSA key

pair to be certified. If this parameter is omitted and there is only one public signing key on

the HSM, that key is automatically selected. If this parameter is omitted and there are

multiple public signing keys on the HSM, the user is asked to select the public signing

key.

privatehandle

=<privkeyhandle#>

This is a mandatory parameter that defines the handle to the private key from an RSA

key pair to be certified. If this parameter is omitted and there is only one private signing

key on the HSM, that key is automatically selected. If this parameter is omitted and

there are multiple private signing keys on the HSM, the user is asked to select the

private signing key.

-outputFile This mandatory parameter defines the file that receives the certificate request.

Optional Parameters

Parameter Description

-binary This is an optional parameter that defines the certificate request format to be raw binary

instead of the default PEM (base64) encoding.

-sha1WithRsa This is an optional parameter that defines the signature algorithm for the certificate

request to be pkcs-1-SHA1withRSAEncryption. The default is to use sha1WithRsa.

- sha224withrsa This is an optional parameter that defines the signature algorithm for the certificate

request to be pkcs-1-sha224withRSAEncryption. The default is to use sha1WithRsa.

- sha256withrsa This is an optional parameter that defines the signature algorithm for the certificate

SafeNet Network HSM Utilities Reference Guide

1 Certificate Management Utility (CMU)

Parameter Description

request to be pkcs-1-sha256withRSAEncryption. The default is to use sha1WithRsa.

- sha384withrsa This is an optional parameter that defines the signature algorithm for the certificate

request to be pkcs-1-sha384withRSAEncryption. The default is to use sha1WithRsa.

- sha512withrsa This is an optional parameter that defines the signature algorithm for the certificate

request to be pkcs-1-sha512withRSAEncryption. The default is to use sha1WithRsa.

- sha1withdsa This is an optional parameter that defines the signature algorithm for the certificate

request to be pkcs-1-sha1withDSAEncryption. The default is to use sha1WithRsa.

- sha1withecdsa This is an optional parameter that defines the signature algorithm for the certificate

request to be pkcs-1-sha1withECDSAEncryption. The default is to use sha1WithRsa.

- sha224withecdsa This is an optional parameter that defines the signature algorithm for the certificate

request to be pkcs-1-sha224withECDSAEncryption. The default is to use

sha1WithRsa.

- sha256withecdsa This is an optional parameter that defines the signature algorithm for the certificate

request to be pkcs-1-sha256withECDSAEncryption. The default is to use

sha1WithRsa.

- sha384withecdsa This is an optional parameter that defines the signature algorithm for the certificate

request to be pkcs-1-sha384withECDSAEncryption. The default is to use

sha1WithRsa.

- sha512withecdsa This is an optional parameter that defines the signature algorithm for the certificate

request to be pkcs-1-sha512withECDSAEncryption. The default is to use

sha1WithRsa.

-C This optional parameter defines the two-letter country name for the subject distinguished

name (DN) of the certificate request. This parameter should be present in the subject

DN.

-S This optional parameter defines the state or province name for the subject distinguished

name of the certificate request. This parameter may be present in the Subject DN.

-L This optional parameter defines the locality (typically the city) for the subject

distinguished name of the certificate request. This parameter may be present in the

Subject DN.

-O This optional parameter defines the organization name for the subject distinguished

name (DN) of the certificate request. This parameter should be present in the subject

DN.

-OU This optional parameter defines the organization unit name for the subject distinguished

name (DN) of the certificate request. This parameter may be present in the subject DN

-CN This optional parameter defines the common name for the subject distinguished name

(DN) of the certificate request. This parameter should be present in the subject DN.

SafeNet Network HSM Utilities Reference Guide

1 Certificate Management Utility (CMU)

Example

The following example creates a PEM encoded PKCS #10 certificate request for key 6:

cmu requestCert -publichandle=6 –privatehandle=7 -C=CA -L=Ottawa -O="Rainbow-Chrysalis" -

CN="Test Certificate" -outputFile=testCert.req

SafeNet Network HSM Utilities Reference Guide

1 Certificate Management Utility (CMU)

cmu selfsigncertificate

This function creates a self-signed X.509 certificate for an RSA, DSA, or ECDSA key pair on the token or HSM. It must

be provided with the handles to both the public key and the corresponding private key (all of the public key components

are contained within the private key). The private key must have Signing capability since it is used to sign the certificate

request structure. The signature is done with any of the mechanisms listed below. The subject name is defined by a

series of optional RDN components.

If none of these components are provided on the command line, the CKA_SUBJECT of the private key is used as the

subject of the certificate. If the private key does not have its CKA_SUBJECT attribute set, the user will be queried for

each of the RDN components. The Subject DN should contain at least the country, organization and common name

components.

The certificate will, by default, have a keyUsage setting of keycertsign. The certificate is stored as a PKCS #11

certificate object on the token. The CKA_ID attribute of the certificate is defined by an optional parameter. If this

parameter is omitted, the CKA_ID of the private key is used.

Syntax

cmu selfSignCertificate <parameters>

Required Parameters

Parameter Description

publichandle=

<pubkeyhandle#>

This is a mandatory parameter that defines the handle to the public key from an RSA key

pair to be certified. If this parameter is omitted and there is only one public signing key on

the HSM, that key is automatically selected. If this parameter is omitted and there are

multiple public signing keys on the HSM, the user is asked to select the public signing

key.

privatehandle

=<privkeyhandle#>

This is a mandatory parameter that defines the handle to the private key from an RSA

key pair to be certified. If this parameter is omitted and there is only one private signing

key on the HSM, that key is automatically selected. If this parameter is omitted and

there are multiple private signing keys on the HSM, the user is asked to select the

private signing key.

-startDate This parameter defines the validity start of the certificate, in the format YYYYMMDD.

-endDate This parameter defines the validity end of the certificate, in the format YYYYMMDD.

-serialNumber This parameter defines the serial number of the certificate, in big-endian hexadecimal

form.

Optional Parameters

Parameter Description

-keyusage This is an optional parameter that defines the key usage extension for the certificate. It

can be set to any of the following: digitalsignature, nonrepudiation, keyencipherment,

SafeNet Network HSM Utilities Reference Guide

1 Certificate Management Utility (CMU)

Parameter Description

dataencipherment, keyagreement, keycertsign, crlsign, encipheronly, decipheronly.

This parameter may appear more than once in the parameter set to define multiple

usages, or it can be used once with a comma separated list of usage types. If no key

usage is specified, a default setting of keycertsign is used.

-label This is an optional parameter that defines the CKA_LABEL attribute for the certificate

object that gets created on the HSM. If omitted, the common name of the issuer and

subject DN is used instead.

-id This is an optional parameter that defines the CKA_ID attribute for the certificate object

that gets created on the HSM. If omitted, the CKA_ID attribute of the private key is used

instead.

-md5WithRsa This is an optional parameter that defines the signature algorithm for the certificate

request to be pkcs-1-MD5withRSAEncryption. The default is to use sha1WithRsa.