Key Attestation

Tip

In the European Union such as eIDAS, it is often the case that the issuance of qualified digital certificates (QTSP) comply with specific legal and regulatory requirements. The ability to generate CSRs through a REST API helps streamline the certificate issuance process and ensures compliance with relevant standards and regulations.

Key Attestation procedure

Using the TSB / REST API the following sequence must be followed in order the create a CSR.

• (Create Key Attestation key.) This is not required, since the TSB will automatically create one.
• Create Signing key
• Generate CSR
• Export Key Attestation
• Verify Key Attestation
• Submit CSR and Key Attestation File to the QTSP

For a high-level guide, see the Create Key Attestations tutorial.

1. Create a signing key

Take care

IMPORTANT: A sample request to create a RSA-Key is shown here if you are generating keys for qualified Signature / Document signing / sealing) the following key flags are important and must be set: sign=true, extractable=false, sensitive=true)

POST: /v1/key, Create key request.

Replace <keyname> and password. The password is optional and can be deleted completely.

{
    "label": "<keyname>",
    "password": [ "R","E","P","L","A","C","E" ],
    "algorithm": "RSA",
    "keySize": 2048,
    "attributes": {
        "sign": true,
        "extractable": false,
        "modifiable": true,
        "destroyable": true,
        "sensitive": true,
        "decrypt": false,
        "unwrap": false
    }
}

2. Generate a CSR

For CSR generation please follow the guide Create a CSR

3. Export Key Attestation

POST: /v1/key/keyAttestation

Description: Generate key attestation files for a key

Swagger

Replace <keyname> and password. The password is optional and can be deleted completely.

{
  "label": "<keyname>",
  "password": null
}

CURL

• Replace <keyname> and password. Password is optional.
• Update the URL and Authorization in the header accordingly.

curl "https://sbx-rest-api.cloudshsm.com/v1/key/keyAttestation" \
--header "Authorization: Bearer <bearer_token>" \
--json '{
          "label": "<keyname>",
          "password": null
        }' \
 --output 'keyname-attestation.zip'

4. Verify Key Attestation

Follow the Verify Key Attestations tutorial to learn how to verify key attestations. For the verification, an auditor requires the ZIP file and (optionally) the CSR.