ssl-fipsKey¶

The following operations can be performed on "ssl-fipsKey":

create ssl fipsKey¶

Generates a FIPS key within the Hardware Security Module (HSM) of the FIPS card.

Synopsis¶

create ssl fipsKey <fipsKeyName> -keytype ( RSA | ECDSA ) [-exponent ( 3 | F4 )] [-modulus <positive_integer>] [-curve ( P_256 | P_384 )]

Arguments¶

fipsKeyName

Name for the FIPS key. Must begin with an ASCII alphanumeric or underscore (_) character, and must contain only ASCII alphanumeric, underscore, hash (#), period (.), space, colon (:), at (@), equals (=), and hyphen (-) characters. Cannot be changed after the FIPS key is created.

The following requirement applies only to the Citrix ADC CLI: If the name includes one or more spaces, enclose the name in double or single quotation marks (for example, "my fipskey" or 'my fipskey').

keytype

Only RSA key and ECDSA Key are supported.

Possible values: RSA, ECDSA Default value: RSA

exponent

Exponent value for the FIPS key to be created. Available values function as follows: 3=3 (hexadecimal) F4=10001 (hexadecimal)

Possible values: 3, F4 Default value: 3

modulus

Modulus, in multiples of 64, of the FIPS key to be created. Minimum value: 0 Maximum value: 4096

curve

Only p_256 (prime256v1) and P_384 (secp384r1) are supported.

Possible values: P_256, P_384 Default value: P_256

Example¶

create fipskey fips1 -modulus 1024 -exp f4

rm ssl fipsKey¶

Removes all the FIPS keys, or the specified FIPS key, from the appliance.

Synopsis¶

rm ssl fipsKey <fipsKeyName> ...

Arguments¶

fipsKeyName

Name of the FIPS key to remove.

Example¶

rm fipskey fips1

show ssl fipsKey¶

Displays information about all the FIPS keys configured on the appliance, or displays detailed information about the specified FIPS key.

Synopsis¶

show ssl fipsKey [<fipsKeyName>]

Arguments¶

fipsKeyName

Name of the FIPS key for which to show detailed information.

Output¶

modulus

The modulus of the RSA key.

exponent

The exponent value for the RSA key.

curve

The curve id for the ECDSA key.

keytype

The type for the key.

size

Size.

devno

count

stateflag

Example¶

1) An example of output of show ssl fipskey command is as follows: show fipskey 2 FIPS keys: 1) FIPS Key Name: fips1 2) FIPS Key Name: fips2

2) An example of output of show fipskey command with FIPS key name specified is as follows: show fipskey fips1 FIPS Key Name: fips1 Modulus: 1024 Public Exponent: 3 (Hex: 0x3)

import ssl fipsKey¶

Imports a FIPS key into the Hardware Security Module (HSM) of the FIPS card. Can import an existing FIPS key, or can import, as a FIPS key, an external private key, such as a key that was created on an Apache or IIS external Web server.

Synopsis¶

import ssl fipsKey <fipsKeyName> -key <string> [-inform <inform>] [-wrapKeyName <string>] [-iv <string>] [-exponent ( 3 | F4 )]

Arguments¶

fipsKeyName

Name for the FIPS key to be imported. Must begin with an ASCII alphanumeric or underscore (_) character, and must contain only ASCII alphanumeric, underscore, hash (#), period (.), space, colon (:), at (@), equals (=), and hyphen (-) characters. Cannot be changed after the FIPS key is created.

The following requirement applies only to the Citrix ADC CLI: If the name includes one or more spaces, enclose the name in double or single quotation marks (for example, "my fipskey" or 'my fipskey').

key

Name of and, optionally, path to the key file to be imported. /nsconfig/ssl/ is the default path.

inform

Input format of the key file. Available formats are: SIM - Secure Information Management; select when importing a FIPS key. If the external FIPS key is encrypted, first decrypt it, and then import it. PEM - Privacy Enhanced Mail; select when importing a non-FIPS key.

Possible values: SIM, DER, PEM Default value: SIM

wrapKeyName

Name of the wrap key to use for importing the key. Required for importing a non-FIPS key.

iv

Initialization Vector (IV) to use for importing the key. Required for importing a non-FIPS key.

exponent

Exponent value for the FIPS key to be created. Available values function as follows: 3=3 (hexadecimal) F4=10001 (hexadecimal)

Possible values: 3, F4 Default value: 3

Example¶

1)import fipskey fips1 -key /nsconfig/ssl/fipskey.sim The above example imports a FIPS key stored in the file fipskey.sim in the system. 2)import fipskey fips2 -key /nsconfig/ssl/key.der -inform DER -wrapKeyName wrapkey1 -iv wrap123 The above example imports a non-FIPS key stored in the file key.der in the system.

export ssl fipsKey¶

Exports a FIPS key from one appliance to another or backs up a FIPS key in a secure manner. The exported key is secured by using a strong asymmetric key encryption method.

Synopsis¶

export ssl fipsKey <fipsKeyName> -key <string>

Arguments¶

fipsKeyName

Name of the FIPS key to export.

key

Name of and, optionally, path to the exported key file. /nsconfig/ssl/ is the default path.

Example¶

export fipskey fips1 -key /nsconfig/ssl/fips1.key