For creating certificates, keys are needed. All keys are stored encrypted in the database using the 3DES algorithm. The password can be changed for each certificate. The password type means:
All keys carry a use counter which counts the times it is used. For new requests or certificates the list of available keys is reduced to the keys with a use counter of 0.
The dialog asks for the internal name of the key and the keysize in bits. For EC keys, a list of curves is shown. It contains all X9.62 curves. When importing an EC key with explicit curve parameters, the corresponding curve OID is searched and set if found. Even if the drop-down list only shows the most usual key sizes, any other value may be set here by editing this box. While searching for random prime numbers a progress bar is shown in the bottom of the base application. After the key generation is done the key will be stored in the database.
For every connected token providing the Key-generate facility an entry in the drop-down menu of the keytypes will be shown. It contains the name of the token and the valid key-sizes.
Keys can be exported by either selecting the key and pressing Export or by using the context-menu. This opens a Dialogbox where the following settings can be adjusted:
The filename is the internal name plus a pem
, der
or pk8
suffix.
When changing the fileformat, the suffix of the filename changes accordingly.
Only PKCS#8 or PEM files can be encrypted, because
the DER format (although it could be encrypted)
does not support a way to supply the encryption algorithm
like e.g. DES
.
Of course, encryption does not make sense if the private part is not exported.