Venafi Trust Protection Platform: nShield HSM Integration Guide

Install the Entrust nshield HSM using the instructions in the Installation Guide for the HSM.

Install the Entrust nshield Security World Software, and configure the Security World as described in the User Guide for the HSM.

Edit the cknfastrc file located in %NFAST_HOME%\cknfastrc.

Install Venafi Trust Protection Platform. For more information, see the Venafi online documentation.

Open the Venafi Configuration Console.

Select the Connectors node.

Select Create HSM Connector in the Actions panel.

Enter your Venafi TPP user credentials if required.

For Name, enter any name for the HSM connector.

For Cryptoki Dll Path, select Browse and locate the following path to the DLL file:

Select Load Slots.

Select a slot to use for the intended key protection type. This is the partition on the HSM where TPP will access the encryption keys.

For User Type, select the required user to access the HSM keys on the designated partition.

For Pin, enter the passphrase of the Card Set being used. If Module protection is being used, leave the pin blank.

Select Verify.

Open the Venafi Configuration Console.

Select Enable Advanced Key Protect in the Actions panel.

Review the information and confirm the action.

Restart the IIS, Venafi Platform, and Logging services:

Open the Venafi Configuration Console.

Select the Connectors node.

Select the HSM Connector generated in an earlier step.

Select Properties in the Actions panel under Encryption Driver.

Enter your Venafi TPP user credentials if required.

Select New Key.

On the Create New HSM Key page, enter a Name and select a Type for the key.

Select Create.

Select Apply.

Select OK.

To list the newly created key and its protection type, open a command prompt and run the following command:

nfkminfo -l

Log in to admin console: https://[IP_address_of_Venafi_TPP]/vedadmin.

Select Policy.

Select Certificate.

Under Other Information, select your HSM Connector in the Key Generation drop-down menu.

Select Save.

Select Policy.

Select Add > Certificates > Certificate.

In the General Information tab, enter the required information.

For Management Type, select Provisioning or Enrollment.

For CSR Generation, select Service Generated CSR.

For Generate Key/CSR on Application, select No.

In the Subject DN tab, enter the required information.

In the Private Key tab, enter the key information.

In the Other Information tab, search for the previously configured CA Template.

Select Save.

Select the newly generated certificate from the policy tree. The Certificate Status should be OK.

Select Renew Now.

After a minute, select Refresh. The certificate details will appear at the bottom of the screen.

If you selected Provisioning for Management Type, associate the certificate to the intended application object.

Check to see if the certificate was installed on this application server.

Install and configure the Entrust nshield HSM and Security World on the intended remote application server. The application server needs to be able to use the HSM to generate keys. For more information about compatible application servers, see the Venafi online documentation. See the Entrust nshield Integration Guides which contain integration steps for the intended application server.

Log in to admin console: https://[IP_address_of_Venafi_TPP]/vedadmin.

In the policy tree, select the application set up on the remote server.

In the Remote Generation Settings, for Private Key Location, select Entrust nshield HSM.

Select Policy.

Select Add > Certificates > Certificate.

In the General Information tab, enter the required information.

For Management Type, select Provisioning.

For CSR Generation, select Service Generated CSR.

For Generate Key/CSR on Application, select Yes.

In the Subject DN tab, enter the required information.

In the Private Key tab, enter the key information.

In the Other Information tab, search for the previously configured CA Template.

Select Save.

Select the newly generated certificate from the policy tree. The Certificate Status should be OK.

In the policy tree, select the application set up on the remote server.

In the Certificate tab, for Associated Certificate, select the previously generated certificate.

Select Save.

In the policy tree, select the certificate.

Select Renew Now.

After a minute, select Refresh. The certificate details will appear at the bottom of the screen.

Check to see if the certificate was installed on the remote application server.

To list the newly created key and its protection type, open a command prompt on the remote application server and run the following command:

nfkminfo -l

Open the Venafi Configuration Console.

Select the Connectors node.

Select the HSM Component generated in an earlier step.

Select Properties in the Actions panel under Encryption Driver.

Enter your Venafi TPP user credentials if required.

Select Allow Key Storage.

Select Apply.

Select OK.

Open the Venafi Configuration Console.

Select the System Roles node.

Select Add CodeSign Protect Administrator in the Actions panel.

Select a user to gain CodeSign Protect Administrator rights.

Open the Venafi Configuration Console.

Under the Venafi Code Signing node, select Custom Flows.

Select Add new Code Signing Flow in the Actions panel.

Enter a name for the Code Signing Flow.

Select the newly created Code Signing Flow and add an approver through the Actions panel.

Open the Venafi Configuration Console.

Under the Venafi Code Signing node, select Environment Templates.

Select Certificate in the Actions panel under Add Single Template.

Enter a name for the Code Signing Environment Template.

In the Properties window that appears, enter the Description, Certificate Container, and Signing Flow within the Settings tab.

Open the Certificate Authority tab and search for the previously configured CA Template. Select Add.

Open the Keys tab and select which key sizes to allow.

Open the Key Storage and open the drop-down menu.

Select the previously created HSM Connector.

Enter any optional information in the remaining tabs.

Log in to Aperture: https://[IP_address_of_Venafi_TPP]/Aperture/codesign.

Select Projects.

Select New Project.

Enter a Project Name and Description.

Select Create.

Select the Environments tab.

Select Add Environment.

Select an option from the drop-down.

Enter the Environment Name.

For Creation Type, select Create New. The Key Storage Location should now list your HSM Connector.

Enter any other necessary information for the certificate. Then, select Apply and OK.

Select Save.

Select Submit for Approval to generate a new certificate and private key once it is approved.

Select the Environments tab.

Select Add Environment.

Select an option from the drop-down.

Enter the Environment Name.

For Creation Type, select Use Existing. The Key Storage Location should now list your HSM Connector.

Import an existing certificate or manually enter its details.

Select an existing Private HSM Key and Public HSM Key.

Select Save.

Select Submit for Approval.

Log in to Aperture: https://[IP_address_of_Venafi_TPP]/Aperture/codesign.

Select Approvals.

Select Pending Approvals.

Select the request.

Select Approve/Reject.

Enter a Comment for the approval.

Select Approve.

If you selected the option to generate new keys, the keys are now created on the Entrust nshield HSM. To list it, open a command prompt and run the following command:

nfkminfo -l