Certificate command

Before generating the key, decide on the type of key (--algorithm <key_type>) and its parameters, such as key size (--size <size>) for RSA or the curve (--curve <curve>)for ECC.

If you also want to generate the corresponding public key, you can use the --output-pub-file option to specify the output file for the public key.

You can enhance the security of your private key by protecting it with a password using the --protect option. After running the command, you will be prompted to enter a password to protect the private key.

After generating the key, you can verify that the file was created by listing the contents of the directory:

ls -l keystore/keys/

This command will display the files in the keystore/keys/ directory, including the newly created private key, and public key if generated.

Once the CSR configuration file is ready, you can generate the CSR by specifying the configuration file and signing it with a private key.

If you need to include a signing certificate with your CSR, you can include the --signing-cert option. Make sure the specified signing certificate filename is located in the keystore/cert directory.

After generating the CSR, you can verify that the file was created by listing the contents of the directory:

ls -l keystore/*

This command will display the all directories and files in the keystore/ directory, including the newly created CSR.

Before generating the x.509 certificate, ensure that you have a properly configured CSR configuration file (.cnf). This file contains the necessary details about the subject (such as country, organization, and common name) and key usage, which will be included in the certificate.

Once the CSR configuration file is ready, you can generate the x.509 certificate by specifying the configuration file and using either a self-signed certificate or an existing signing key and certificate.

After generating the x.509 certificate, verify that the file was created correctly by listing the contents of the directory:

ls -l keystore/certs/

This command will display the files in the keystore/certs/ directory, including the newly created x.509 certificate.

You can further customize the TAP key generation by specifying additional TAP-related options, such as key usage or signature schemes.

After generating the key, verify that the file was created correctly by listing the contents of the directory:

ls -l keystore/keys/

This command will display the files in the keystore/keys/ directory, including the newly created TAP-protected private key.

This section describes the ASN.1 module for TAP keys. The PrivateKeyInfo structure is defined in PKCS #8 and includes an algorithm identifier and the private key data, which is wrapped in an OCTET STRING.

These are the Object Identifiers (OIDs) used to build the OIDs in this document:

mocana OBJECT IDENTIFIER ::= {
iso(1) identified-organization(3) dod(6) internet(1) private(4) enterprise(1)
mocana (14421)
mocana-tap OBJECT IDENTIFIER ::= { mocana 19 }

When the following OIDs are used in an AlgorithmIdentifier, the parameters MUST be present and MUST be NULL:

mocana-tap-rsakey OBJECT IDENTIFIER ::= { mocana-tap 0x01 }
mocana-tap-ecckey OBJECT IDENTIFIER ::= { mocana-tap 0x02 }
mocana-tap-dsakey OBJECT IDENTIFIER ::= { mocana-tap 0x03 }

mocana-tap-rsaProtectedkey OBJECT IDENTIFIER ::= { mocana-tap 0x21 }
mocana-tap-eccProtectedkey OBJECT IDENTIFIER ::= { mocana-tap 0x22 }
mocana-tap-dsaProtectedkey OBJECT IDENTIFIER ::= { mocana-tap 0x23 }

Example definitions:

For RSA keys, the PrivateKey will be an OCTET STRING wrapping data encoded as follows:

MocanaTapRSAPrivateKey ::= SEQUENCE {
  version Version,
  moduleId ModuleId,
  modulus INTEGER,
  publicExponent INTEGER,
  tapPrivateKey TapPrivateKey
}

For ECC keys, the PrivateKey will be an OCTET STRING wrapping data encoded as follows (ECParameters and ECPoint are defined in other standards, such as RFC 5480):

MocanaTapECCPrivateKey ::= SEQUENCE {
  version Version,
  moduleId ModuleId,
  parameters ECParameters,
  publicKey ECPoint,
  tapPrivateKey TapPrivateKey
}

For DSA keys, the PrivateKey will be an OCTET STRING wrapping data encoded as follows (Dss-Parms and DSAPublicKey are defined in other standards, such as RFC 3279):

MocanaTapDSAPrivateKey ::= SEQUENCE {
  version Version,
  moduleId ModuleId,
  parameters Dss-Parms,
  publicKey DSAPublicKey,
  tapPrivateKey TapPrivateKey
}

Version ::= INTEGER { v1(0) } (v1, ...)
ModuleId ::= INTEGER {
  tpm-1-2(1),
  tpm-2-0(2)
} (tpm-1-2, tpm-2-0, ...)
TapPrivateKey ::= OCTET STRING