TLS connection with Thales Payshield 9000

Question

I would like to set up a TLS connection between a host and an hsm thales payshield. On the HSM I have generated the RSA key pair but I can only get the csr.

Can't I generate a self signed certificate? Are there alternative methods?

Answer 1

first of all, you need to create your own ROOT CA, use it to sign the CRT of the payShield, then create a client certificate using your ROOT CA. The certificates you generate need to be version v3!

Then you can finally upload them to your payShield using the payShield Manager or though USB stick (I tried on the 10k).

You need to upload to the payShield three certificates: the CRT of your CA the CRT of your payShield obtained signing the certificate request of it the CRT of your client.

Kind regards, Marco - StockTrader