Installation and Configuration | Aventra Oy APM and u.trust GP HSM

The following section outlines the procedures required to configure the Utimaco SecurityServer Software.

Setting Up Utimaco SecurityServer Software

If you have not already done so, create and request an Utimaco Support Portal Account at https://support.hsm.utimaco.com/support . This will allow you to download the software components needed for this installation.

On Windows:

On Windows, cs_pkcs11_R3.cfg will be automatically created and available in the C: \ProgramData\UtimacoPKCS11_R3 folder as part of the SecurityServer software installation. Edit the cs_pkcs11_R3.cfg file and make the appropriate changes to the file. A sample cs_pkcs11_R3.cfg file is mentioned below.

library = C:\oracle\extapi\64\hsm\utimaco\6.1.1.0\cs_pkcs11_R3.dll 
 slot = 0 
 pin = Oracle123 
 [Global] 
 # For Unix: 
 Logpath = /tmp 
 # For Windows: 
 # Logpath = C:/ProgramData/Utimaco/PKCS11_R3 
 # Loglevel (0 = NONE; 1 = ERROR; 2 = WARNING; 3 = INFO; 4 = TRACE) 
 Logging = 1 
 # Prevents expiring session after inactivity of 15 minutes 
 KeepAlive = true 
 # Set the Device to connect with 
 #[CryptoServer] 
 # Device specifier 
 Device = <HSM_IP>

For detailed guidance on commands and their parameters, please refer to the Utimaco u.trust GP HSM documentation. The device could be a u.trust GP HSM Se-Series, available in either PCIe or LAN form factors. Depending on the type, the device configuration line will follow one of these formats:

LAN-based HSM: Device = 288@ipaddress
PCIe-based HSM: Device = /dev/cs2.0

Select the appropriate format based on your specific hardware setup.

library specifies the path where the cs_pkcs11_R3.dll file is located.

Slot indicates the slot number associated with the created USER.

Pin represents the password assigned to the USER.

To simplify your testing process, it's recommended that you enable the PKCS#11 log file by adjusting the logging settings. Specifically:

Set the LogPath to a writable directory (not a specific file).
Set the Logging log level to 1 for basic logging. Increase it to 4 for more detailed output during testing.

This will generate a log file named cs_pkcs11_R3.log within the specified LogPath directory. Reviewing this log can help with troubleshooting if you encounter issues. Once testing is complete, it's advisable to reduce Logging log level to 1 or 2 to limit output to only critical or important messages.

On Linux:

Setting up SecurityServer on Linux is out-of-scope of this document. Please refer to Utimaco’s documentation provided with the tools if you plan to run the HSM simulator on Linux and connect it to APM using over the network.

Setting Up Active Process Manager

Install Active Process Manager using the installer executable. Follow APM’s User Guide for guidance on setting up the basic settings and user privileges. It is recommended to also read the APM tutorial and check out the included sample solutions to get familiar with general functionality of APM. Please contact Aventra for the documentation and samples. You can find contact information at https://aventra.fi , a contact form is also available at https://aventra.fi/products/active-process-manager/. Aventra provides APM with a free evaluation license upon request.

Network and Security Configurations

Ensure that the computer running APM can connect the HSM or cHSM on the IP address and port it is running.

It is NOT recommended to store the HSM’s PKCS#11 User or SO PINs in plaintext form in the APM solution. Use APM’s security features to protect the PIN, or request users to enter it using a Password field in an InputConsole or DataEditor plug-in. Password values are encrypted in APM’s Alias files.