# HSM4 SSL: Leveraging HSMs for Enhanced Intra-Domain Security +
## 3 HSM4 SSL Architecture
### HSM4 SSL: Low-Level Architecture
#### 3.3.7. HSM4 SSL CLI Tool  
The developed _\"ssleverywhere\"_ command-line interpreter (CLI) tool serves as a versatile interface for interacting with the HSM4 SSL architecture from the terminal. It offers various commands to initiate secure sessions, generate certificates, and perform essential cryptographic operations. The design of this tool prioritizes user-friendliness, enabling users to effortlessly harness the capabilities of the HSM4 SSL architecture. Once installed and configured, the _\"ssleverywhere\"_ tool generates several folders within the system, namely _\"private\"_, _\"csr\"_, and _\"certs\"_. Within these folders, specific functionalities are organized. The _\"private\"_ folder serves as the repository for server key pairs. The _\"csr\"_ folder is designated for CSRs to be sent to the HSM4 SSL, be signed, and create X.509 certificates. Finally, the _\"certs\"_ folder stores the issued certificates obtained after successful CSR submissions. The _\"ssleverywhere\"_ tool accepts multiple parameters, each serving a specific purpose and contributing to the customization of commands. For example, the _\"gen_cert\"_ command is responsible for creating an X.509 certificate and saving it in the _\"certs\"_ folder. The process starts by providing the following parameters:  
* _-name_: Specifies the name associated with the certificate; this name can either be manually entered or can be modified by administrators to remain consistent for repeated usage of the command. * _-default_: An option that can be used with the _\"gen_cert\"_ command to indicate default certificate generation settings. Default parameters include key type set to _RSA_, key length set to _2048_, encryption set to _AES_, and hash set to _SHA256_. * _-manual_: An option that can be used with the _\"gen_cert\"_ command to enable manual configuration of certificate generation settings. * _-key_type_: Specifies the type of private key when manually configuring certificate generation settings. * _-key_length_: Specifies the desired length of the private key when manually configuring certificate generation settings. * _-encryption_: Specifies the encryption method to be used for private keys when manually configuring certificate generation settings. * _-hash_: Specifies the hashing algorithm for cryptographic operations when manually configuring certificate generation settings. Another command is _\"-keypair_gen\"_. This command is used to request HSM4 SSL to generate a cryptographic key pair and return it to the user. It accepts three parameters:  
* _-label_: Specifies a label or name for the generated key pair, so the public key can be saved in the HSM4 SSL database. * _-key_type_: Specifies the type of cryptographic key to be generated. * _-length_: Specifies the desired length of the key. The usage example of the _ssleverywhere_ tool involves two machines on the same network establishing secure communication. Machine A, the server, generates a certificate named \"SE\" using the _ssleverywhere_ command:  
```
$ssleverywhere-gen_cert-nameSE-default %Total%Received%XfordAverageSpeed %TimeTimeTimeCurrent %DloadUploadTotalSpentLeftSpeed
```  
Machine B, the client, follows a specific configuration to generate its certificate:$saleverywhere-gen_cert-nameCL-manual-key_typersa-key_length4096-encryptiondes3-hashsha512 %Total%Received%XfredAverageSpeedTimeTimeTimeCurrentDloadUploadTotalSpentLeftSpeed100705910053311001728204890991---:---:---:---:---37951 ```  
Machine B generates a certificate named \"CL\" with specific configurations: RSA key type, 4096-bit key length, DES3 encryption, and SHA-512 hashing algorithm. After successful generation, both machines have their certificates, enabling secure communication. Both machines possess certificates from the HSM4 SSL architecture, as per their specific requirements. To utilize these certificates, Machine A acts as the server, employing a Python socket programming code to listen for connections on a predetermined port.