在客户端和 AWS CloudHSM 之间设置双向 TLS（推荐）

使用以下命令创建已使用 AES-256 算法加密的 4096 位 RSA 密钥。要使用此示例，请<mtls_ca_root_1.key>替换为要存储密钥的文件的名称。

$ openssl genrsa -out <mtls_ca_root_1.key> -aes256 4096

Generating RSA private key, 4096 bit long modulus
.....................................+++
.+++
e is 65537 (0x10001)
Enter pass phrase for mtls_ca_root_1.key:
Verifying - Enter pass phrase for mtls_ca_root_1.key:

使用以下命令从刚刚创建的私有密钥创建名为 mtls_ca_root_1.crt 的自签名根证书。该证书的有效期为 25 年（9130 天）。阅读屏幕上的说明，并按照提示操作。

$ openssl req -new -x509 -days 9130 -key mtls_ca_root_1.key -out mtls_ca_root_1.crt
Enter pass phrase for mtls_ca_root_1.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:
State or Province Name (full name) [Some-State]:
Locality Name (eg, city) []:
Organization Name (eg, company) [Internet Widgits Pty Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:
Email Address []:

以下示例演示如何使用 CloudHSM CLI 中的 cluster mtls register-trust-anchor 命令向 HSM 注册信任锚。要使用此命令，管理员必须登录 HSM。将这些值替换为您自己的值：

aws-cloudhsm > cluster mtls register-trust-anchor --path </path/mtls_ca_root_1.crt>

{
  "error_code": 0,
  "data": {
    "trust_anchor": {
      "certificate-reference": "0x01",
      "certificate": "<PEM Encoded Certificate>",
      "cluster-coverage": "full"
    }
  }
}

成功注册信任锚后，您可以运行 cluster mtls list-trust-anchors 命令来检查当前注册的信任锚，如下所示：

aws-cloudhsm > cluster mtls list-trust-anchors

{
  "error_code": 0,
  "data": {
    "trust_anchors": [
      {
        "certificate-reference": "0x01",
        "certificate": "<PEM Encoded Certificate>",
        "cluster-coverage": "full"
      }
    ]
  }
}

使用以下命令创建 4096 位 RSA 密钥。要使用此示例，请<ssl-client.key>替换为要存储密钥的文件的名称。

$ openssl genrsa -out <ssl-client.key> 4096

Generating RSA private key, 4096 bit long modulus
.....................................+++
.+++
e is 65537 (0x10001)

使用以下命令从您刚刚创建的私有密钥生成证书签名请求（CSR）。阅读屏幕上的说明，并按照提示操作。

$ openssl req -new -key <ssl-client.key> -out <ssl-client.csr>
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:
State or Province Name (full name) [Some-State]:
Locality Name (eg, city) []:
Organization Name (eg, company) [Internet Widgits Pty Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:
Email Address []:

使用以下命令通过我们在创建信任锚并将其注册到 HSM 上中创建和注册的根证书对 CSR 进行签名，并创建名为 ssl-client.crt 的客户端证书。该证书的有效期为 5 年（1826 天）。

$ openssl x509 -req -days 1826 -in <ssl-client.csr> -CA <mtls_ca_root_1.crt> -CAkey <mtls_ca_root_1.key> -CAcreateserial -out <ssl-client.crt>

使用以下命令将我们在创建信任锚并将其注册到 HSM 上中创建并注册的客户端证书和根证书结合起来，创建一个名为 ssl-client.pem 的客户端证书链，该证书链将在下一步的配置中使用。

$ cat <ssl-client.crt> <mtls_ca_root_1.crt> > <ssl-client.pem>