See the prerequisites in Create CA key in Certificate Manager and Create CA in Certificate Manager.

1. Start AWB and log in.
2. Create a CA key as described in Create CA key in Certificate Manager.
   1. For generation 0, the key shall be an RSA key with a length of 1024 bits.
   2. For generation 1, the key shall be an RSA key with a length of 2048 bits.

   3. For generation 2 or 3 (CPI=0x70 or CPI=0x00), the key shall be an ECC key with a length of 256, 384, or 512 bits. SHA-2 must be used as the signature algorithm and its output size must match the key length.

      CVC can only use brainpool curves.

3. Create a CA as described in Create CA in Certificate Manager. Make sure the following values are chosen:

   1. In CA Name, enter CVC ROOT.

   2. Set State to Active.
   3. In Domain, select Root.

   4. In Issuing CA - check Self signed

   5. In Usage - check Certificate signing

   6. In Key - select the key created in step 2

   7. In Format - select cvc-ca

   8. Click the browse button and select field CV Certificate Data Elements and deselect all other options in the Fields Chooser dialog.

4. Click the browse button belonging to CV Certificate Data Elements to open the dialog box.
   This dialog is displayed. Enter the values and click OK.

   

5. When the root CA has been created, a new CA icon will appear in the CA Hierarchy. Select or open the new CA in the hierarchy and double-click the certificate icon. The certificate is displayed in a specific dialog box. It is possible to save the certificate and the public key to files.

1. Start AWB and log in.
2. Follow the instructions as stated in "Create root CA for CVC" above with this exception:
   • In Issuing CA, select the root CA (do not check Self signed).

There are two options to create a Link CA:

Manually

1. Follow the instructions in “Create root CA for CVC” above, with these exceptions:
   • In Format, select cvc-cpi00-linkca. The user has to manually select the CA to be used as Issuing CA by the new Link CA.
   • Edit the rest of the CVC attributes accordingly in order to create a valid CVC Link CA.

Use Create Link CVCA button

1. Right-click the Root CV CA that the Link CA will point to, and select Create Link CVCA button.

2. The Format field will be changed to cvc-cpi00-linkca. The rest of the attributes are copied from the Root CA for convenience.

3. If needed update the Key and the Signature Algorithm values.

4. Open the CV Certificate Data Elements, edit the Certificate Holder Reference CVC attributes and increment the Sequence Number. Update any other CVC attribute as needed.

5. Click OK to create the Link CA.

1. Create a certificate procedure as described in Create certificate procedure in Certificate Manager. Make sure to select a CVC CA as Issuing CA and cvc-card as Certificate format. If the issuing CA uses CV certs with CPI=0x70 or 0x00, the Signature algorithm must match that of the CA.

2. Create a token procedure as described in Create token procedure in Certificate Manager. Make sure to select Storage profile PKCS10.

   This step is not required for CV Certificates with CPI=0x00.

All the necessary preparations for CVCs have now been made. Use the CM Software Development Kit (SDK) to issue the certificates.