Test the integration

This test validates the key created in the HSM during Integrate the Entrust Cryptographic Security Platform PKI Hub and the Entrust nShield HSM.

Log in to the Entrust Cryptographic Security Platform PKI Hub Management Console web interface.
In the content pane, under Certificate Authorities, select Manage Solution.
Select the download arrow icon to the right of Export Configuration. The compressed file (pkihub-configuration.zip) downloads to your computer.
Extract the compressed file, pkihub-configuration.zip.
Navigate to Downloads\pkihub-configuration to find kmdata.tar.
Extract the kmdata.tar archive.
```
% tar -xvf kmdata.tar
```
The kmdata/local folder now contains the HSM files.

The key_ncore_pkihub-attila-wrapping-key file is the key blob for the key created in the Entrust nShield HSM.
To validate the key, copy the key blob to an HSM client using the same Security World and place it in /opt/nfast/kmdata/local/.

Run the following commands and note the key name.

% nfkminfo -k

Key list - 1 keys
 AppName ncore                Ident pkihub-attila-wrapping-key


% rocs
`rocs' key recovery tool
Useful commands: `help', `help intro', `quit'.
rocs> list keys
  No. Name                           App   Protected by
    1 Id: pkihub-attila-wrapping-key ncore testOCS

rocs> exit

Verify the key.

% nfkmverify ncore pkihub-attila-wrapping-key

** [Security world] **
    Ciphersuite: DLf3072s256mAEScSP800131Ar1
    128-bit security level
    7 Administrator Card(s)
    (NOT IN ANY SLOT of an attached module)
    HKNSO b5cb518930e8dd1fea1bd8a3e99347b598382d85
    Cardset recovery ENABLED
    Passphrase recovery disabled
    Common Criteria CMTS 419221-5 disabled
    Strict FIPS 140-2 level 3 (does not improve security) disabled
    SEE application non-volatile storage ENABLED
    real time clock setting ENABLED
    SEE debugging ENABLED
    SEE debugging restricted
    Foreign Token Open authorization ENABLED
    Generating module ESN 92C8-8591-52EB NOT ATTACHED to this host

---


** [Application key ncore pkihub-attila-wrapping-key] **
    [Not named]
    Useable by HOST applications
    Cardset protected: 1/6 ephemeral [0s `testOCS']
    Cardset hash 321b143185fc939504893270ed821ba4ed38319a
     (Currently in Module #1 Slot #2: Card #6)
    Key useable INDEFINITELY (after card loading)
    Recovery ENABLED
    Type HMACSHA256 256 bits
    Key may be used for: GENERATING or verifying message authentication codes
    Generating module ESN 201E-03E0-D947 currently #1 (in same incarnation)
    nCore hash 8eab3b67885df5fdfb8b1a05300ea34d366afe55
    Public half is ABSENT

Verification successful, confirm details above.  1 key verified.

Delete this key blob from the HSM client or server. The key remains in the Entrust PKI Hub.