Nitrokey HSM and Certificate Export

When Nitrokey HSM 2 (or rather Smartcard-HSM SIM Card inside of it) generates a key-pair, it just does that - no X.509 certificate you probably expect is generated automatically. This makes sense, since you probably want that certificate to be signed by some other certificate authority. To do this, just create a certificate signing request using the key generated on the HSM and pass it over to the certificate authority of your choice.

The certificate you are seing right now comes in a format defined in BSI TR-03110 Part 3 - if I am not mistaken the tags are described in the section “D.2. Data objects” and explanation of each of them is elsewhere in the document.

The purpose of this is to have a Card Verifiable Certificate - it certifies that “this key belongs to Nitrokey HSM serial number DENKxxxyyyy0000. This Nitrokey HSM key has been signed by central Nitrokey authority” etc. - see [Nitrokey HSM] What are C.DevAut and C.DICA? - #2 by sc-hsm for some details.

If you upload X.509 certificate for the key, this CV certificate gets replaced.