webserver example: generate private key on nethsm instead of external…

…ly & importing it

container/apache/generate.sh

@@ -1,25 +1,55 @@
-#!/bin/sh
+#!/bin/bash
 
 set -e
 
 HOST='localhost:8443'
 ADMIN_ACCOUNT='admin'
 ADMIN_ACCOUNT_PWD='adminadmin'
 
+OPENSSL_PKCS11_ENGINE_PATH="/usr/lib/x86_64-linux-gnu/engines-3/libpkcs11.so"
+NETHSM_PKCS11_LIBRARY_PATH="/usr/lib/x86_64-linux-gnu/pkcs11/libnethsm_pkcs11.so"
+
+
 CREDENTIALS="${ADMIN_ACCOUNT}:${ADMIN_ACCOUNT_PWD}"
 
-openssl req -x509 -newkey rsa:2048 -keyout ./_privatekey.pem -out ./_certificate.pem -days 365 -nodes -subj "/C=US/ST=California/L=San Francisco/O=Your Company/OU=Your Department/CN=yourdomain.com"
+#Use here-documents to temporarily store the OpenSSL configuration. After this command the temporary file will be available at /dev/fd/3.
+exec 3<<< "
+openssl_conf = openssl_init
 
-curl -k -u $CREDENTIALS -i -X DELETE \
-  https://$HOST/api/v1/keys/webserver
+[openssl_init]
+engines = engine_section
 
-curl -k -i -w '\n' -u $CREDENTIALS -X PUT \
-  'https://'$HOST'/api/v1/keys/webserver' \
-  -H 'Content-Type: multipart/form-data' \
-  -F 'arguments={"mechanisms":["RSA_Decryption_RAW","RSA_Decryption_PKCS1","RSA_Decryption_OAEP_MD5","RSA_Decryption_OAEP_SHA1","RSA_Decryption_OAEP_SHA224","RSA_Decryption_OAEP_SHA256","RSA_Decryption_OAEP_SHA384","RSA_Decryption_OAEP_SHA512","RSA_Signature_PKCS1","RSA_Signature_PSS_MD5","RSA_Signature_PSS_SHA1","RSA_Signature_PSS_SHA224","RSA_Signature_PSS_SHA256","RSA_Signature_PSS_SHA384","RSA_Signature_PSS_SHA512"]}' \
-  -F 'key_file=@_privatekey.pem'
+[engine_section]
+pkcs11 = pkcs11_section
+
+[pkcs11_section]
+engine_id = pkcs11
+dynamic_path = ${OPENSSL_PKCS11_ENGINE_PATH}
+MODULE_PATH = ${NETHSM_PKCS11_LIBRARY_PATH}
+init = 0
+"
+
+curl --include --insecure --user $CREDENTIALS --request DELETE \
+  "https://${HOST}/api/v1/keys/webserver"
+
+curl --include --insecure --user $CREDENTIALS --request POST \
+  "https://${HOST}/api/v1/keys/generate" \
+  --header 'Content-Type: application/json' \
+  --data '
+    {
+      "mechanisms": ["RSA_Decryption_RAW", "RSA_Decryption_PKCS1", "RSA_Decryption_OAEP_MD5", "RSA_Decryption_OAEP_SHA1", "RSA_Decryption_OAEP_SHA224", "RSA_Decryption_OAEP_SHA256", "RSA_Decryption_OAEP_SHA384", "RSA_Decryption_OAEP_SHA512", "RSA_Signature_PKCS1", "RSA_Signature_PSS_MD5", "RSA_Signature_PSS_SHA1", "RSA_Signature_PSS_SHA224", "RSA_Signature_PSS_SHA256", "RSA_Signature_PSS_SHA384", "RSA_Signature_PSS_SHA512"],
+      "type": "RSA",
+      "length": 2048,
+      "id": "webserver"
+    }  
+  '
+
+export OPENSSL_CONF="/dev/fd/3"
+
+openssl req -new -x509 -out ./_certificate.pem -days 365 -subj "/CN=yourdomain.com" -engine pkcs11 -keyform engine -key "pkcs11:object=webserver;type=public"
 
 curl -k -i -w '\n' -u $CREDENTIALS -X PUT \
-  'https://'$HOST'/api/v1/keys/webserver/cert' \
+  "https://${HOST}/api/v1/keys/webserver/cert" \
   -H 'Content-Type: application/octet-stream' \
   --data-binary '@_certificate.pem'
+

container/apache/p11nethsm.conf

@@ -7,5 +7,5 @@ slots:
       username: "operator"
       password: "operatoroperator"
     instances:
-      - url: "https://192.168.178.177:8443/api/v1"
+      - url: "https://localhost:8443/api/v1"
         danger_insecure_cert: true

container/nginx/generate.sh

@@ -1,25 +1,55 @@
-#!/bin/sh
+#!/bin/bash
 
 set -e
 
 HOST='localhost:8443'
 ADMIN_ACCOUNT='admin'
 ADMIN_ACCOUNT_PWD='adminadmin'
 
+OPENSSL_PKCS11_ENGINE_PATH="/usr/lib/x86_64-linux-gnu/engines-3/libpkcs11.so"
+NETHSM_PKCS11_LIBRARY_PATH="/usr/lib/x86_64-linux-gnu/pkcs11/libnethsm_pkcs11.so"
+
+
 CREDENTIALS="${ADMIN_ACCOUNT}:${ADMIN_ACCOUNT_PWD}"
 
-openssl req -x509 -newkey rsa:2048 -keyout ./_privatekey.pem -out ./_certificate.pem -days 365 -nodes -subj "/C=US/ST=California/L=San Francisco/O=Your Company/OU=Your Department/CN=yourdomain.com"
+#Use here-documents to temporarily store the OpenSSL configuration. After this command the temporary file will be available at /dev/fd/3.
+exec 3<<< "
+openssl_conf = openssl_init
 
-curl -k -u $CREDENTIALS -i -X DELETE \
-  https://$HOST/api/v1/keys/webserver
+[openssl_init]
+engines = engine_section
 
-curl -k -i -w '\n' -u $CREDENTIALS -X PUT \
-  'https://'$HOST'/api/v1/keys/webserver' \
-  -H 'Content-Type: multipart/form-data' \
-  -F 'arguments={"mechanisms":["RSA_Decryption_RAW","RSA_Decryption_PKCS1","RSA_Decryption_OAEP_MD5","RSA_Decryption_OAEP_SHA1","RSA_Decryption_OAEP_SHA224","RSA_Decryption_OAEP_SHA256","RSA_Decryption_OAEP_SHA384","RSA_Decryption_OAEP_SHA512","RSA_Signature_PKCS1","RSA_Signature_PSS_MD5","RSA_Signature_PSS_SHA1","RSA_Signature_PSS_SHA224","RSA_Signature_PSS_SHA256","RSA_Signature_PSS_SHA384","RSA_Signature_PSS_SHA512"]}' \
-  -F 'key_file=@_privatekey.pem'
+[engine_section]
+pkcs11 = pkcs11_section
+
+[pkcs11_section]
+engine_id = pkcs11
+dynamic_path = ${OPENSSL_PKCS11_ENGINE_PATH}
+MODULE_PATH = ${NETHSM_PKCS11_LIBRARY_PATH}
+init = 0
+"
+
+curl --include --insecure --user $CREDENTIALS --request DELETE \
+  "https://${HOST}/api/v1/keys/webserver"
+
+curl --include --insecure --user $CREDENTIALS --request POST \
+  "https://${HOST}/api/v1/keys/generate" \
+  --header 'Content-Type: application/json' \
+  --data '
+    {
+      "mechanisms": ["RSA_Decryption_RAW", "RSA_Decryption_PKCS1", "RSA_Decryption_OAEP_MD5", "RSA_Decryption_OAEP_SHA1", "RSA_Decryption_OAEP_SHA224", "RSA_Decryption_OAEP_SHA256", "RSA_Decryption_OAEP_SHA384", "RSA_Decryption_OAEP_SHA512", "RSA_Signature_PKCS1", "RSA_Signature_PSS_MD5", "RSA_Signature_PSS_SHA1", "RSA_Signature_PSS_SHA224", "RSA_Signature_PSS_SHA256", "RSA_Signature_PSS_SHA384", "RSA_Signature_PSS_SHA512"],
+      "type": "RSA",
+      "length": 2048,
+      "id": "webserver"
+    }  
+  '
+
+export OPENSSL_CONF="/dev/fd/3"
+
+openssl req -new -x509 -out ./_certificate.pem -days 365 -subj "/CN=yourdomain.com" -engine pkcs11 -keyform engine -key "pkcs11:object=webserver;type=public"
 
 curl -k -i -w '\n' -u $CREDENTIALS -X PUT \
-  'https://'$HOST'/api/v1/keys/webserver/cert' \
+  "https://${HOST}/api/v1/keys/webserver/cert" \
   -H 'Content-Type: application/octet-stream' \
   --data-binary '@_certificate.pem'
+

container/nginx/p11nethsm.conf

@@ -5,5 +5,5 @@ slots:
       username: "operator"
       password: "operatoroperator"
     instances:
-      - url: "https://192.168.3.161:8443/api/v1"
+      - url: "https://localhost:8443/api/v1"
         danger_insecure_cert: true