Auto Light Dark
Auto Light Dark
Breadcrumbs

Installing and Configuring Utimaco u.trust GP HSM Software

The following section outlines the procedures required to configure the Utimaco u.trust GP HSM software.

If you have not already done so, create and request an Utimaco Support Portal Account at https://support.hsm.utimaco.com/support. This will allow you to download the software components needed for this installation.

  1. Copy the downloaded software to the appropriate location on the ADSS Server.

  2. Locate the Utimaco PKCS#11 configuration file cs_pkcs11_R3.cfg in your SecurityServer folder.

    • Linux : Software/Linux/Crypto_APIs/PKCS11_R3/sample

    • Windows : C:\ProgramData\Utimaco\PKCS11_R3

  3. Edit the cs_pkcs11_R3.cfg file and make appropriate changes. A sample cs_pkcs11_R3.cfg file is mentioned below:

library = C:\oracle\xtapi\64\hsm\utimaco\6.1.1.0\cs_pkcs11_R3.dll
 slot = 0
 pin = Oracle123
 [Global]
 # For Unix:
 Logpath = /tmp
 # For Windows:
 # Logpath = C:/ProgramData/Utimaco/PKCS11_R3
 # Loglevel (0 = NONE; 1 = ERROR; 2 = WARNING; 3 = INFO; 4 = TRACE)
 Logging = 4
 # Maximum size of the logfile in bytes (file is rotated with a backup file if full) 
 Logsize = 3mb 
 # Prevents expiring session after inactivity of 15 minutes
 KeepAlive = true
 # Set the Device to connect with
 #[CryptoServer]
 # Device specifier
 Device = <HSM_IP>

  1. Copy cs_pkcs11_R3.cfg to [ADSS_Server_Install_Path]\conf\hsm\utimaco.

  2. Delete [ADSS_Server_Install_Path]\conf\hsm\utimaco\cs_pkcs#11_R2.cfg.

  3. Restart the ADSS Server Windows Services\Linux Daemons.

For detailed guidance on commands and their parameters, please refer to the Utimaco u.trust GP HSM documentation. The device could be a u.trust GP HSM Se-Series, available in either PCIe or LAN form factors. Depending on the type, the device configuration line will follow one of these formats:

  • LAN-based HSM: Device = 288@ipaddress

  • PCIe-based HSM: Device = /dev/cs2.0

Select the appropriate format based on your specific hardware setup.

library specifies the path where the cs_pkcs11_R3.dll file is located.

Slot indicates the slot number associated with the created USER.

Pin represents the password assigned to the USER.

To simplify your testing process, it is recommended that you enable the PKCS#11 log file by adjusting the logging settings. Specifically:

  • Set the LogPath to a writable directory (not a specific file).

  • Set the Logging log level to 1 for basic logging. Increase it to 4 for more detailed output during testing.

This will generate a log file named cs_pkcs11_R3.log within the specified LogPath directory. Reviewing this log can help with troubleshooting if you encounter issues. Once testing is complete, it's advisable to reduce Logging log level to 1 or 2 to limit output to only critical or important messages.