Tocreate a custom conguration le:
1. Createa conguration le called as-install/mypkcs11.cfg with the following code and save
thele.
name=HW1000
library=/opt/SUNWconn/crypto/lib/libpkcs11.so
slotListIndex=0
disabledMechanisms = {
	CKM_RSA_PKCS
	CKM_RSA_PKCS_KEY_PAIR_GEN
}
omitInitialize=true
2. Updatethe NSS database, if necessary. In this case, update the NSS database so that it will
disableRSA.
Runthe following command :
modutil -undefault "Sun Crypto Accelerator"-dbdir AS_NSS_DB -mechanisms RSA
Thename of the algorithm on the mechanisms list diers from the one in the default
conguration.For a list of valid mechanisms in NSS, see the modutil documentation on the
NSSSecurity Tools site at
http://www.mozilla.org/projects/security/pki/nss/tools.
3. Updatethe server with this change by adding a property in the appropriate location, as
follows:
<property name="mytoken"value="&InstallDir;/mypkcs11.cfg"/>
Thelocation for the property could be one of the following:
■Ifthe provider is for a DAS or server instance, add the property under the associated
<security-service>.
■Ifthe provider is for a node agent, add the property under the associated
<node-agent>element in the domain.xml le.
4. Restartthe Enterprise Server.
Thecustomized congurations will be in eect after the restart.
UsingHardwareCrypto Accelerator With Enterprise Server
Chapter9 •Conguring Security 125