iTP Secure WebServer System Administrators Guide (Version 7.5+)

Storing unencrypted private keys in disk files is not
recommended.
Do not use –nocrypt with –crypt/-encode options.
If the key-file does not exist, you are prompted to create the file. If the key-file already
exists, it is overwritten.
If the specified DN does not exist in the key database file, an error message is displayed.
The following examples illustrate the export options:
./keyadmin -keydb demo.db -exportpriv priv.key –dn \
'CN=www.hp.com, L=Cupertino, O=HP, OU=NED, C=US' \
–encode DER –crypt 3DES
./keyadmin -keydb demo.db -exportpriv priv.key –dn \
'CN=www.hp.com, L=Cupertino, O=HP, OU=NED, C=US' \
–encode PEM –crypt AES256
./keyadmin -keydb demo.db -exportpriv priv.key –dn \
'CN=www.hp.com, L=Cupertino, O=HP, OU=NED, C=US'
./keyadmin -keydb demo.db -exportpriv priv.key –dn \
'CN=www.hp.com, L=Cupertino, O=HP, OU=NED, C=US' -nocrypt
Generating Diffie-Hellman Parameters
You can use the -dhparams option in the Keyadmin utility to generate Diffie-Hellman parameters.
This option can:
• Generate Diffie-Hellman parameters with different sizes and store them in the specified file.
• Overwrite previous parameter file with new parameters.
To generate the Diffie-Hellman parameters, use the following keyadmin command:
bin/keyadmin -dhparams [-out filename][-length paramsize][-overwrite]
The command’s arguments have these functions:
-out filename
specifies the output filename for parameters to be stored. If the filename you specify is nonexistent,
the keyadmin creates a new file and notifies you that the new file is created.
-length paramsize
specifies that the parameter set generated must be of parameter size paramsize. The default
value of paramsize is 1024 bits. The minimum value of paramsize is 512 bits. The maximum
value of paramsize is 4096 bits.
-overwrite
specifies that you want to overwrite the existing file.
NOTE: The parameters generated by keyadmin are Privacy Enhanced Mail (PEM) encoded.
PEM encoded Diffie-Hellman parameters use the header and footer lines:
-----BEGIN DH PARAMETERS-----
-----END DH PARAMETERS-----
iTP Secure WebServer supports only the PKCS#3 formatted structure.
For example, to generate Diffie-Hellman parameters with output filename dh_params and parameter
size 1024 the syntax is:
bin/keyadmin –dhparams –out dh_params —length 1024
Managing Certificates 71