WindowsでのHSMクラスタ・クライアントの設定

秘密キー(pkey-c)およびCSR (pkeycsr.csr)を生成します。

$ openssl req -newkey rsa:4096 -nodes -keyout pkey-c -out pkeycsr.csr -sha256
Generating a 4096 bit RSA private key
...............................................................................................................++
...................................................................++
writing new private key to 'pkey-c'
-----

You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [XX]:US
State or Province Name (full name) []:TX
Locality Name (eg, city) [Default City]:AS
Organization Name (eg, company) [Default Company Ltd]:ORC
Organizational Unit Name (eg, section) []:SEC
Common Name (eg, your name or your server's hostname) []:dkms
Email Address []:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

customerPO.keyおよびpartitionOwnerCert.pemファイルを使用してパーティション所有者によって署名されたCSR (pkeycsr.csr))を取得し、cert-cを生成します。customerPO.keyおよびpartitionOwnerCert.pemの詳細は、CSRへの署名を参照してください。

$ openssl x509 -req -days 3650 -in pkeycsr.csr -CA partitionOwnerCert.pem -CAkey customerPO.key -out cert-c
Signature ok
subject=/C=US/ST=TX/L=AS/O=ORC/OU=SEC/CN=dkms
Getting CA Private Key