# Self signed certificate authority: pkcs11 engine and openssl
**URL:** https://support.nitrokey.com/t/self-signed-certificate-authority-pkcs11-engine-and-openssl/1855
**Category:** Nitrokeys
**Created:** [July 10, 2019, 1:54pm UTC](https://support.nitrokey.com/t/self-signed-certificate-authority-pkcs11-engine-and-openssl/1855 "2019-07-10T13:54:47Z")
**Posts on this page:** 15
**Page:** 1
### Author:  [@svenvantieghem](https://support.nitrokey.com/u/svenvantieghem)
#### Post date: [July 10, 2019, 1:54pm UTC](https://support.nitrokey.com/t/self-signed-certificate-authority-pkcs11-engine-and-openssl/1855/1 "2019-07-10T13:54:47Z")
Hi all,
I wan’t to use the Nitrokey HSM module to sign a self sign certificate with a self signed certificate authority. Below you can find the procedure that I’ve followed:
#Create self signed CA certificate (server certificate)
## Create private key -
```auto
pkcs11-tool --module opensc-pkcs11.so -l --keypairgen --key-type EC:prime256v1 --id 10 --label "CA_private2"
```
## Self-sign private key -
```auto
OPENSSL_CONF=./hsm.conf openssl req -engine pkcs11 -keyform engine -new -key 0:10 -sha256 -x509 -days 12775 -out CA_cert2.pem -subj /CN=CA -config <(echo '[req]'; echo 'distinguished_name=dn'; echo '[dn]'; echo '[ext]'; echo 'basicConstraints=CA:TRUE') -extensions ext
```
# Creating device certificates
## Create private key -
```auto
openssl ecparam -out bootstrap_device_private.pem -name prime256v1 -genkey
```
## Convert private key to DER format -
```auto
openssl ec -in bootstrap_device_private.pem -out bootstrap_device_private.der -outform der
```
## Create a certificate signing request for the private key -
```auto
openssl req -key bootstrap_device_private.pem -new -sha256 -out bootstrap_device_private_csr.pem -subj /CN=device_endpoint_name
# Sign the certificate signing request with the CA key and certificate -
OPENSSl_CONf=./hsm.conf openssl x509 -req -CAkeyform engine -engine pkcs11 -in bootstrap_device_private_csr.pem -sha256 -out bootstrap_device_cert.der -outform der -CA CA_cert2.pem -CAkey 0:10 -CAcreateserial -days 3650
```
**But this doesn’t work. I receive the following terminal output:**
```auto
der -outform der -CA CA_cert2.pem -CAkey 0:10 -CAcreateserial -days 3650
engine "pkcs11" set.
Signature ok
subject=CN = device_endpoint_name
Getting CA Private Key
Invalid slot number: 0
Invalid slot number: 0
PKCS11_get_private_key returned NULL
cannot load CA Private Key from engine
140208201277888:error:80067065:pkcs11 engine:ctx_load_privkey:object not found:eng_back.c:876:
140208201277888:error:26096080:engine routines:ENGINE_load_private_key:failed loading private key:../crypto/engine/eng_pkey.c:78:
unable to load CA Private Key
```
**Any suggestions?**
---
### Author:  [@nitroalex](https://support.nitrokey.com/u/nitroalex)
#### Post date: [July 11, 2019, 2:48pm UTC](https://support.nitrokey.com/t/self-signed-certificate-authority-pkcs11-engine-and-openssl/1855/2 "2019-07-11T14:48:34Z")
Hi Sven,
can you provide me with the hsm.conf you have used so that I can test it myself? Furthermore, which system, OpenSSL and OpenSC version did you use?
Kind regards
Alex
---
### Author:  [@svenvantieghem](https://support.nitrokey.com/u/svenvantieghem)
#### Post date: [July 11, 2019, 3:25pm UTC](https://support.nitrokey.com/t/self-signed-certificate-authority-pkcs11-engine-and-openssl/1855/3 "2019-07-11T15:25:47Z")
Hi Alex, Thank you very much for your answer. I changed the pin in the hsm.conf file to the default pin. Below you can find the content:
/# PKCS11 engine config
openssl\_conf = openssl\_def
[openssl\_def]
engines = engine\_section
[req]
distinguished\_name = req\_distinguished\_name
[req\_distinguished\_name]
/# empty.
[engine\_section]
pkcs11 = pkcs11\_section
[pkcs11\_section]
engine\_id = pkcs11
dynamic\_path = /usr/lib/x86\_64-linux-gnu/engines-1.1/pkcs11.so
MODULE\_PATH = /usr/lib/x86\_64-linux-gnu/opensc-pkcs11.so
PIN = 648219
init = 0
---
### Author:  [@nitroalex](https://support.nitrokey.com/u/nitroalex)
#### Post date: [July 16, 2019, 2:22pm UTC](https://support.nitrokey.com/t/self-signed-certificate-authority-pkcs11-engine-and-openssl/1855/4 "2019-07-16T14:22:50Z")
Hi Sven,
a short notice that I looked at this last week for a while and that I can confirm, that there is the described problem. I do not know how to overcome this problem yet though. I am sorry. I try to look at it again these days.
Kind regards
Alex
---
### Author:  [@jimmypw](https://support.nitrokey.com/u/jimmypw)
#### Post date: [July 17, 2019, 6:21am UTC](https://support.nitrokey.com/t/self-signed-certificate-authority-pkcs11-engine-and-openssl/1855/5 "2019-07-17T06:21:57Z")
I do this. See my repo here [https://github.com/jimmypw/ca-root-scripts](https://github.com/jimmypw/ca-root-scripts)
---
### Author:  [@svenvantieghem](https://support.nitrokey.com/u/svenvantieghem)
#### Post date: [August 5, 2019, 8:14am UTC](https://support.nitrokey.com/t/self-signed-certificate-authority-pkcs11-engine-and-openssl/1855/6 "2019-08-05T08:14:33Z")
Hi Alex and Jimmypw,
Thank you for your answers!
@Jimmypw: I’m not a software developer so I’m a bit confused about your answer; Do I need to rebuild the sourcecode of something or do I need to replace some files?
Thank you for your answer!
Kind regards,
Sven
---
### Author:  [@szszszsz](https://support.nitrokey.com/u/szszszsz)
#### Post date: [August 5, 2019, 9:09am UTC](https://support.nitrokey.com/t/self-signed-certificate-authority-pkcs11-engine-and-openssl/1855/7 "2019-08-05T09:09:57Z")
Hi!
The repository @jimmypw has linked provides a self-building package with the scripts for making the self-signed certificate via OpenSSL. The scripts can be used directly as well, if your OS is not RPM based (e.g. Fedora, RHEL, Centos etc.), though with manual work required. For the content please look at the following paths:
- [https://github.com/jimmypw/ca-root-scripts/tree/master/ca/opt/ca/bin](https://github.com/jimmypw/ca-root-scripts/tree/master/ca/opt/ca/bin)
- [https://github.com/jimmypw/ca-root-scripts/tree/master/ca/opt/ca/sbin](https://github.com/jimmypw/ca-root-scripts/tree/master/ca/opt/ca/sbin)
This one contains the default configuration:
- [https://github.com/jimmypw/ca-root-scripts/tree/master/ca/opt/ca/etc](https://github.com/jimmypw/ca-root-scripts/tree/master/ca/opt/ca/etc)
---
### Author:  [@szszszsz](https://support.nitrokey.com/u/szszszsz)
#### Post date: [August 5, 2019, 9:22am UTC](https://support.nitrokey.com/t/self-signed-certificate-authority-pkcs11-engine-and-openssl/1855/8 "2019-08-05T09:22:25Z")
I have just stumbled in the documentation on [https://github.com/sektioneins/micro-ca-tool](https://github.com/sektioneins/micro-ca-tool). Would that help?
---
### Author:  [@jimmypw](https://support.nitrokey.com/u/jimmypw)
#### Post date: [August 5, 2019, 9:35am UTC](https://support.nitrokey.com/t/self-signed-certificate-authority-pkcs11-engine-and-openssl/1855/9 "2019-08-05T09:35:03Z")
I wrote these scripts because I had some pretty specialized requirements. If you are not a coder and would like a point and click interface I would highly recommend the xca tool [https://hohnstaedt.de/xca/](https://hohnstaedt.de/xca/).
---
### Author:  [@svenvantieghem](https://support.nitrokey.com/u/svenvantieghem)
#### Post date: [August 5, 2019, 1:43pm UTC](https://support.nitrokey.com/t/self-signed-certificate-authority-pkcs11-engine-and-openssl/1855/10 "2019-08-05T13:43:07Z")
Hi,
Thank you for your answers. Now I’m starting to understand it :). The git repository contains scripts, that I can use to obtain the same result? So I suppose that I just need to clone the git repo to my Ubuntu machine and execute a bash script and pipe some variables?
I’m a newbie in bash scripting :). I just don’t understand how and which variables I need to pass to your script to obtain the same result?
Thank you!
Best regards,
Sven
---
### Author:  [@szszszsz](https://support.nitrokey.com/u/szszszsz)
#### Post date: [August 7, 2019, 8:33am UTC](https://support.nitrokey.com/t/self-signed-certificate-authority-pkcs11-engine-and-openssl/1855/11 "2019-08-07T08:33:20Z")
Hi!
All variables are set here:
- [https://github.com/jimmypw/ca-root-scripts/blob/master/ca/opt/ca/etc/config.vanilla](https://github.com/jimmypw/ca-root-scripts/blob/master/ca/opt/ca/etc/config.vanilla)
and loaded by all the Bash scripts. To use it as a stand-alone scripts set, I think it would be best to copy all files to one directory, and change all paths to the `config` file to load from the local directory, where needed. The XCA looks like a good GUI as well, though I have not used it myself.
---
### Author:  [@jimmypw](https://support.nitrokey.com/u/jimmypw)
#### Post date: [August 7, 2019, 10:17am UTC](https://support.nitrokey.com/t/self-signed-certificate-authority-pkcs11-engine-and-openssl/1855/12 "2019-08-07T10:17:50Z")
If you will be giving my scripts a go you will also need two dependencies
> **[jimmypw/serialgen](https://github.com/jimmypw/serialgen)**
>
> Contribute to jimmypw/serialgen development by creating an account on GitHub.
and
> **[jimmypw/sha2wordlist](https://github.com/jimmypw/sha2wordlist)**
>
> PGP Words implemented in go. Contribute to jimmypw/sha2wordlist development by creating an account on GitHub.
You can get by without sha2wordlist and comment out the relevant lines but the serialgen binary is used to create non-sequential serial numbers for resulting certificates.
I should probably package this up properly at some point if there is interest. Maybe this weekend if you can wait?
---
### Author:  [@svenvantieghem](https://support.nitrokey.com/u/svenvantieghem)
#### Post date: [August 8, 2019, 9:47am UTC](https://support.nitrokey.com/t/self-signed-certificate-authority-pkcs11-engine-and-openssl/1855/13 "2019-08-08T09:47:06Z")
Hi Jimmypw,
Thanks a lot for all the help and information. I will try if I can make them work this afternoon :). I’ll let you know if it worked :).
---
### Author:  [@svenvantieghem](https://support.nitrokey.com/u/svenvantieghem)
#### Post date: [August 8, 2019, 10:31am UTC](https://support.nitrokey.com/t/self-signed-certificate-authority-pkcs11-engine-and-openssl/1855/14 "2019-08-08T10:31:43Z")
Hi Jimmypw,
I’m unable to use the make files on ubuntu? Any suggestions about how to install it with the necessary dependencys?
Thank you!
---
### Author:  [@svenvantieghem](https://support.nitrokey.com/u/svenvantieghem)
#### Post date: [August 8, 2019, 10:33am UTC](https://support.nitrokey.com/t/self-signed-certificate-authority-pkcs11-engine-and-openssl/1855/15 "2019-08-08T10:33:51Z")
By the way, maybe a stupid question :). What’s wrong with using my command:
OPENSSl\_CONf=./hsm.conf openssl x509 -req -CAkeyform engine -engine pkcs11 -in bootstrap\_device\_private\_csr.pem -sha256 -out bootstrap\_device\_cert.der -outform der -CA CA\_cert2.pem -CAkey 0:10 -CAcreateserial -days 3650
is there a bug in openssl or in opensc?