iTP Secure WebServer System Administrator's Guide (iTPWebSvr 6.0+)

Integrating the WebSafe2 Internet Security
Processor (WISP)
iTP Secure WebServer System Administrator’s Guide—523346-002
5-9
Generating the Public/Private Key Pair and
Obtaining the Certificate
The install.WS script uses a sample httpd.websafe.config file. The contents
of the sample file are listed in Section 7, Configuring the iTP Secure WebServer. You
can edit the file to modify the WebSafe2 configuration.
Be sure to complete the remaining tasks before attempting to restart the WISP.
Generating the Public/Private Key Pair and Obtaining the
Certificate
The WISP generates a public/private key pair and sends it to the HP system, where it
is stored in the file named by the keyfile statement in wid.config. A certificate is
obtained by sending a certificate request to a recognized Certificate Authority (CA). To
generate the public/private key pair and obtain a certificate, complete the following
steps:
1. Obtain a KEK pair using variant 0. This KEK pair will be used to encrypt the
public/private key pair for transmission to the HP system. You use the SCT to
generate the KEK pair. See Step 1. Obtaining a Key Exchange Key (KEK) Using
Variant 0 below for further details.
2. Generate a public/private key pair and a certificate request. You use the keyadmin
command to do this. See Step 2. Generating a Public/Private Key Pair and a
Certificate Request on page 5-11 for further details.
3. Request a certificate from a CA. See Step 3. Requesting a Certificate From a
Certificate Authority (CA) on page 5-13 for further details.
4. Obtain a KEK using variant 31. You use the SCT to perform this task. See Step 4.
Obtaining a KEK Pair Using Variant 31 on page 5-13 for further details.
5. Install the certificate received from the CA by using the keyadmin command. See
Step 5. Installing the Certificate on page 5-13 for further details.
Step 1. Obtaining a Key Exchange Key (KEK) Using
Variant 0
You use the SCT Calculate Crypto function to obtain a KEK. Following the steps
outlined below will generate two forms of double-length (16-byte) KEK: the in-the-clear
form and the form encrypted using the MFK.
For detailed information about the SCT and the Calculate Crypto function, refer to the
WebSafe Internet Security Processor Installation and Operations Manual. That manual
gives a detailed procedure for obtaining a KEK using variant 0. As you follow that
procedure, keep in mind that the double-length KEK is too long to display on the SCT
screen. Therefore you create the left part first, recording first the clear (unencrypted)
text followed by the cryptogram, then you create the right part, recording first the clear
text followed by the cryptogram:
a. Select Encryption Key MFK1.
b. Define Key Under MFK1.