cmu importkey
This function unwraps an RSA, DSA , or ECDSA private key onto the selected token or HSM. The key file may be in any of the following formats:
>PKCS #12(PFX) RSA in a DER-encoded format (.pfx file)
>PKCS #8(Unencrypted PrivatekeyInfo) in RSA or DSA in base 64 PEM, or binary DER format
>PKCS #1 (RSA in base64 PEM, or binary DER) format.
Syntax
cmu importkey <parameters>
Required Parameters
| Parameter | Description |
|---|---|
| -in (Filename) |
This parameter defines the full path to the file containing the key to import. |
| -keyarg(DSA|RSA|ECDSA) | Specifies the key's algorithm. |
Optional Parameters
| Parameter | Description |
|---|---|
| -PKCS8 |
Indicates that the key to import is formatted according to the PKCS#8 standard. |
| -PKCS12 |
Indicates that the key to import is formatted according to the PKCS#12 standard. *Note that only the private key portion is unwrapped onto the token. Any certificates in this file are simply ignored.
|
| -wrapkey (handle) |
The handle of the existing key that is to be used as the wrapping key. *Note that this key must have the CKA_WRAP attribute set to true. If this flag is not specified the default behaviour is to autogenerate a 3DES key for the sole purpose of unwrapping the key onto the HSM. |
| -setkeyattr |
Allows the user to manually enter the imported key’s attributes. Modifiable key attributes are CKA_DECRYPT, CKA_SIGN, CKA_EXTRACTABLE, and CKA_UNWRAP. The defaults are always 1=true. |
Example
cmu importkey -in rawrsa1028.pem –keyalg RSA -wrapkey 11 –setkeyattr
cmu importkey –pkcs8 –in pk8privkey.pem –keyalg DSA–keyalg DSA
cmu importkey –in rsakey.pem –keyalg RSA –wrapkey 11
cmu importkey –in rsakey.pem –keyalg RSA
cmu importkey –PKCS12 –in p12.pfx –keyalg RSA
Notes
1.Ideally the private key should be in PKCS#8 format (privatekeyinfo) and not encrypted.
To convert a private key of either RSA or DSA type: (see PKCS#1 for RSA and PKCS#11 (11.9) for DSA) into a PKCS#8 structure, use the following openssl command:
openssl pkcs8 -in key.pem -topk8 –nocrypt -out noenckey.pem
2.In the option to the command, the "PKCS" should be in all uppercase letters, as "cmu importkey -PKCS8" or "cmu importkey -PKCS12".
3. If the PKCS#8 structure is already encrypted according to the PKCS#5-PBE standard, then to import via CMU, use the following command:
openssl pkcs8 -in pk8.pem -out key.pem
*You will be prompted for the password to decrypt the PrivateKeyInfo.
4.You can export the PrivatekeyInfo contents of a .pfx file by using the following openssl command:
openssl pkcs12 –in p12.pfx –out pk12_privkey.pem –nocerts –nodes
*You will be prompted for the password to decrypt the PrivateKeyInfo.
