Check Point R80.20 - Step 4: Creating the CA Certificate on the Gemalto HSM Appliance Server

Hardware Security Module (HSM)
Next Generation Security Gateway Guide R80.20 | 86
Step
Description
2 Download and install this software package on the HSM Client workstation computer:
SafeNet HSM Client for Workstation
http://supportcenter.checkpoint.com/file_download?id=60912
Note - Software Subscription or Active Support plan is required to download this
package https://www.checkpoint.com/support-services/support-plans/.
From Gemalto SafeNet Network HSM 6.2.2 Product Documentation , go to the
Installation
Guide > SafeNet HSM Client Software Installation
3 Establish a Trust Link between the HSM Client workstation and the HSM Appliance
Server.
On the HSM Client workstation, run in LunaCM:
lunacm:> clientconfig deploy ...
From the
Gemalto SafeNet Network HSM 6.2.2 Product Documentation , go to
Configuration Guide > [Step 7] Create a trusted link and register Client and Appliance
with each other
Note - The configuration will not work on Linux OS with
glibc version lower than 2.7 (for
example: Red Hat 5 or lower, Gaia R77.20 or lower). In such case, follow the instructions
in Establishing a Trust Link between the Check Point Security Gateway and the Gemalto
HSM Appliance Server (on page 88).
Step 4: Creating the CA Certificate on the Gemalto HSM
Appliance Server
Step
Description
1 On the HSM Client workstation computer, open a command prompt or a terminal
window.
2
Use the cmu generatekeypair command to create a key pair.
Example:
# cd /usr/safenet/lunaclient/bin
# ./cmu generatekeypair -modulusBits=2048 -publicExponent=65537
-labelPublic="
CAPublicKeyPairLabel " -labelPrivate=" CAPrivateKeyPairLabel
"
-sign=T -verify=T
3 When prompted, enter a password:
Example:
Enter a password for the token in slot 0: <
Password for the partition on HSM
Appliance Server that you configured in Step 2
>
4 Select the RSA mechanism by entering the corresponding number:
[1] PKCS [2] FIPS 186-3 Only Primes [3] FIPS 186-3 Auxiliary Primes