Oracle Cloud Infrastructure Documentation

Setting up HSM Cluster Client

Configure HSM client configuration.

You must complete the following configuration steps for a new user configuration.
  1. You must generate a private key (pkey-c) and a CSR (pkeycsr.csr).
    $ openssl req -newkey rsa:4096 -nodes -keyout pkey-c -out pkeycsr.csr -sha256
Generating a 4096 bit RSA private key
...............................................................................................................++
...................................................................++
writing new private key to 'pkey-c'
-----

You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [XX]:US
State or Province Name (full name) []:TX
Locality Name (eg, city) [Default City]:AS
Organization Name (eg, company) [Default Company Ltd]:ORC
Organizational Unit Name (eg, section) []:SEC
Common Name (eg, your name or your server's hostname) []:dkms
Email Address []:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
  2. You must get the CSR (pkeycsr.csr) signed by Partition Owner using customerPO.key and partitionOwnerCert.pem to generate cert-c.
    $ openssl x509 -req -days 3650 -in pkeycsr.csr -CA partitionOwnerCert.pem -CAkey customerPO.key -out cert-c
Signature ok
subject=/C=US/ST=TX/L=AS/O=ORC/OU=SEC/CN=dkms
Getting CA Private Key
  3. Copy pkey-c, cert-c, and partitionOwnerCert.pem to the path /opt/oci/hsm/data/.