Security: Configuring an Utimaco HSM

A Hardware Security Module (HSM) can be configured to store and protect cryptographic keys in a centralized, high-assurance appliance, providing a root of trust for sensitive cryptographic data transactions.
Optionally, you can use the software-based SoftHSM implementation for demonstration or testing purposes.

The following describes how to configure an Utimaco HSM for the Software Appliance by registering the Software Appliance and connecting it to the HSM.

For more information, refer to the Utimaco HSM product CD that you received with your purchase of the HSM.

If you are using the Firmware Version:
SecurityServer-Se2-Series-4.32.0.3-FIPS from Utimaco, you should select this driver: SecurityServer 4.32.0.6 FIPS.

Choose between one of the following Utimacto software packages:

• SecurityServer 4.32.0.6 FIPS

• SecurityServer 4.45.5.1

• SecurityServer 4.51.0.1

• Utimaco u.trust Anchor Product Bundle 4.70.0.0

To configure an Utimaco HSM for your Software Appliance, follow the steps below.

If you run into issues after the configuration, you can get HSM specific log messages from a HSM Support Package. For further information please refer to Create an HSM Log.

Connect the Software Appliance with the Utimaco HSM

1. Log in to your Software Appliance and open the Security page or click Configure HSM in the Overview.

2. In the HSM Configuration section, click + Add External HSM in the HSM Selection field.
   

   

3. The Add an external HSM window opens.
   Select Utimaco HSM to access the Configuration fields.

4. Click Select HSM Type to continue. 
   

   

5. The HSM Client Version section is displayed on the Security page.

6. Click on the HSM client version to be used.
   
   

   

7. Connection Settings

   • HSM IP Address / FQDN:
     Enter the IP address or the Fully Qualified Domain Name (FQDN) of the HSM. Only IPv4 addresses are supported.

   • HSM Port:
     Enter the Port of the Utimaco HSM.

   • Connection Timeout:
     Enter the timeout in milliseconds to wait for a non-responding device.

     

8. PKCS#11 Related Settings

   • Command Timeout:
     Enter the time in milliseconds to wait for the answer from the HSM after sending a command.
     Increase the default value if you know that your device is slow.

   • Slot Count:
     Enter the amount of slots configured on your Utimaco HSM.
     

     

9. Usage Information

CryptoWorker Configuration
The following note can be found in the info box:

In order to use this HSM in SignServer, you need to select the following
PKCS#11 library in the P11NG CryptoWorker configuration:
Reference: PKCS#11 Proxy - Utimaco HSM

The last line in Usage Information displays the options:

Remove HSM Configuration
To remove the HSM configuration you need to type REMOVE HSM CONFIGURATION into the Confirm Action field.
Click Cancel/Remove.
If remove is chosen the application will restart.

If changes have been made to the sections:
HSM Client Authentication Configuration
Secure Channel Client Configuration
Miscellaneous Configurations

these can be made with undone with Cancel or saved with Save HSM Configuration.

Abort
Click Abort to terminate the process of configuring a HSM.

Save HSM Configuration
Click Save HSM Configuration to save changes made on the HSM configuration.

10. Confirm with Save HSM Configuration.

11. A modal dialog requests to confirm your configuration.
    Save HSM configuration

12. Proceed with Activate.

The HSM device is now configured and HSM Status information will be displayed.

On the Security page of the appliance, the status of the HSM Driver will change from Not Connected to Connected as soon as the configuration is completed.

On the Overview page of the appliance, the status in the HSM Overview also changes to Connected as soon as the configuration is completed. 

During reconfiguration, the application is not available and displays Restarting.

Once the SignServer is running again, you can proceed with adding a Crypto Worker.

Add a Crypto Worker in SignServer

To create a Crypto Worker:

1. In the Overview page of the Software Appliance, click Admin Web for SignServer.

2. The SignServer page opens.

3. Click Add... to continue.
   

   

4. In the top menu, select Worker.
   You can choose the method you want to use to configure the Worker. In this example we will work with From Template.
   Click From Template to continue.
   

   

5. Open the drop-down menu under Load from Template. Here you can select the worker to be configured. In this example we will work with p11ng-crypto.properties.
   Click Next to continue.
   

   

   

6. The Add Worker/Load Configuration page opens.
   Type of worker and implementation:
   Uses a HSM or smart card through PKCS#11:
   Name for other workers to reference this worker: WORKERGENID1.NAME=CryptoTokenP11NG1: this name can be customized (CryptoTokenP11NG1) as desired.
   

   

7. Scroll down a little bit.
   WORKERGENID1.SHAREDLIBRARYNAME
   In Webconf open the Security page.
   Scroll down to HSM Configuration.
   The Usage Information displays the requested entry.
   Here: PKCS#11 Proxy - Utimaco HSM
   

   

   
   

   

8. Scroll down a little bit.
   Method for pointing out which slot to use:
   # Method will specifying the slot to use.

   1. If the Slot is to be addressed by number:
      type SLOT_NUMBER SLOTLABELTYPE=SLOT_LABEL.

   2. If the Slot is to be addressed by label:
      type SLOT_LABEL SLOTLABELTYPE=SLOT_INDEX.

   3. To address the Slot via the SLOT_ INDEX of occurrence is not recommended because the list order is not stable.
      To deselect it, put # in front of it.
      To enable it, remove # in front of it.
      The # can be replaced for the slot to be used and specify the number of the HSM slot instead.
      

      

9. Scroll down a little bit.
   Optional password of the slot.
   #WORKERGENID1.PIN=foo123 here the password can be enabled or disabled.
   To deselect it, put # in front of it.
   To enable it, remove # in front of it.
   

   

10. Scroll down a little bit.
    Optional PKCS#11 attributes used for key generation
    # Optional PKCS#11 attributes is used for key generation, you can select the attributes.
    To deselect it, put # in front of it.
    To enable it, remove # in front of it.
    

    

11. Scroll down a little bit.
    One key to test activation with is required.
    WORKERGENID1.DEFAULTKEY=testkey0 here you can add an existing key or use the default key.
    Click Apply to save the settings.
    

    

    The token (CryptoTokenP11NG1) is automatically logged in when the PIN is set in the Crypto Worker configuration.

12. The worker is not activated yet. Click on the created token and you will see the information about the token in the Status Summary.
    
    

    

13. Click the Configuration tab to view the full configuration of the token.
    
    

    

14. If the configuration meets your needs, click the Crypto Token tab. Edit them if necessary.
    
    

    

15. Click Activate.
    
    

    

16. This step is optional!
    The latest version of SignServer logs on automatically if the correct PIN is defined in the configuration as described in step 6.

    In the field Authentication Code enter the optional password from Step 6. Here foo123.
    Click Activate.
    
    

    

17. If the default key exists and has been activated, the Crypto Worker is now ACTIVE.
    
    

    

For more information please see Worker Crypto Token Page.

HSM Troubleshooting

In the section HSM Driver Controls the current HSM Driver Status is displayed.
In case of HSM problems, the HSM driver can be restarted via the Restart button.