How to find which key on the HSM corresponds to a OneStep SSL certificate

3 years ago

Originally Published: 2003-06-24

Article Number

000052731

Applies To

Keon Certificate Authority 6.5
Microsoft Windows 2000 Advanced Server SP2
nCipher Hardware Security Module

Issue

How to find which key on the HSM corresponds to a OneStep SSL certificate
Using OneStep setupSSL to create keys on HSM

Resolution

If you are using OneStep setup (e.g. setupSSL) to generate the keys, you will end up with a cert file and a key file. The key file contains a PEM encoded ASN.1 construct that contains information about the HSM stored private key. It will look something like the following:

-----BEGIN RSA NFAST PRIVATE KEY-----
MDUWDnJzYS1rZW9uLWNhLTY1FhAxMDMzNDMzODEwOTgxNDk1FghzcGFyY1NldAEB
/wIBAQIBAg==
-----END RSA NFAST PRIVATE KEY-----

You can use any ASN.1/BER viewing tool to look at the contents. One freely available tool that will do this is dumpasn1. Running dumpasn1 with the key file as input (you can leave it in its PEM encoded form) will produce output something like this:

  0 30   53: SEQUENCE {
  2 16   14:   IA5String 'rsa-keon-ca-65'
18 16   16:   IA5String '1033433810981495'
36 16    8:   IA5String 'sparcSet'
46 01    1:   BOOLEAN TRUE
49 02    1:   INTEGER 1
52 02    1:   INTEGER 2
           :   }

The three string values are the application name, the key id, and the card set name. You should be able to match the key id with one listed by KeySafe to find the key using that tool.

Don't see what you're looking for?

Related Articles

Trending Articles