7b - Activate the Cluster - SDK3

To activate the cluster, do the following:

1. SSH into the EJBCA instance if not already done so.

2. Use the following command to start the AWS CloudHSM cloudhsm_mgmt_util command line tool:

   # sudo /opt/cloudhsm/bin/cloudhsm_mgmt_util /opt/cloudhsm/etc/cloudhsm_mgmt_util.cfg
   

   If you get an error “connection timed out”, the security group has not been added to the instance.  If you get the error "E2E failed: unable to establish ssl connection" this is because there is no customerCA.crt (or the file is incorrect) in /opt/cloudhsm/etc.
   

3. Use the enable_e2e command to enable end-to-end encryption:

   aws-cloudhsm> enable_e2e
   E2E enabled on server 0(server1)
   

4. Use the loginHSM command to log in to the HSM as the precrypto officer (PRECO) user:

   aws-cloudhsm> loginHSM PRECO admin password
   loginHSM success on server 0(server1)
   

5. Use the changePswd command to change the precrypto officer (PRECO) user's password:

   aws-cloudhsm> changePswd PRECO admin <NewPassword>
   *************************CAUTION********************************
   This is a CRITICAL operation, should be done on all nodes in the
   cluster. Cav server does NOT synchronize these changes with the
   nodes on which this operation is not executed or failed, please
   ensure this operation is executed on all nodes in the cluster.
   ****************************************************************
    
   Do you want to continue(y/n)?y
   Changing password for admin(PRECO) on 1 nodes
   

6. Log out as user PRECO:

   aws-cloudhsm> logoutHSM
   logoutHSM success on server 0
   

7. From now on, use the following syntax to log in to the HSM:

   loginHSM <usertype><username><password>

   For example:

   aws-cloudhsm> loginHSM CO admin <password>