CRIPTOGRAFIA - FESP

[ pkcs11_section ]
engine_id = pkcs11
#dynamic_path = /usr/lib/engines/engine_pkcs11.so
dynamic_path = /usr/lib/openssl/engines/engine_pkcs11.so
#MODULE_PATH = $ENV::PKCS11_MODULE_PATH
MODULE_PATH = /usr/lib/opensc-pkcs11.so
#PIN = $ENV::PKCS11_PIN
init = 0
Do not forget to comment out pkcs11 = pkcs11_section as shown above.
Now, do as with the normal pki (as described previously), but from
/etc/openvpn/easy-rsa/2.0/ instead of /etc/openvpn/easy-rsa/ or
/etc/openvpn/easy-rsa/1.0/.
If you wish to create a certificate directly in a usb token, use the --pkcs11 option
to the easy-rsa scripts.
But I'd recommend to build certificates localy, and to place the keys in the usb
token manualy.
To do so, do as follows:
Initialise the usb token if it has not been done:
pkcs15-init --erase-card -T
pkcs15-init --create-pkcs15 -T
pkcs15-init --store-pin --auth-id 0 --label "YourLabelToTheKey"
To store a CA do as follows:
pkcs15-init --store-certificate keys/ca.crt --authority --label "Mandriva CA" --id
"D1:FB:AF:27:EB:B7:34:99:52:20:D2:33:19:C0:E8:69:51:7A:ED:B6" --auth-id 0
In the above example, I decided to use the key's fingerprint as an id, but you can
use omit this and automatic default id's will be set (i.e. id "46" is a standard).
The --auth-id 0 is compulsary parameter.
How did I previously read the id of my CA? Well with this command:
openssl x509 -noout -text -in keys/ca.crt | less
Do the same the read the other certificates ids.
To store a public key do as follows:
pkcs15-init --store-certificate keys/client1.crt --label "Client1" --id
"DC:EF:ED:19:74:73:DA:44:B6:A4:EE:F5:8B:1F:C5:43:33:2D:1F:A0" --auth-id 0
To store a private key, first store the public key as explained above, and then
store the private key as follows:
pkcs15-init --store-private-key keys/client1.key --public-key-label "Client1" --
label "Client1 Private Key" --id
"DC:EF:ED:19:74:73:DA:44:B6:A4:EE:F5:8B:1F:C5:43:33:2D:1F:A0" --auth-id 0