Installing and Configuring Utimaco SecurityServer Software

Download and Install the Utimaco Software

If you have not already done so, create and request an Utimaco Support Portal Account at https://support.hsm.utimaco.com/support . This will allow you to download the software components needed for this installation.

Log in to the Utimaco Support Portal, and download the u.trust GP HSM package:

https://support.hsm.utimaco.com/support/downloads/u.trust-anchor-se-series
Create a utimaco folder in the /opt directory and create 2 directories /opt/utimaco/bin and /opt/utimaco/lib in it.

# mkdir -p /opt/utimaco/bin 
# mkdir -p /opt/utimaco/lib

Copy the pkcs11 library libcs_pkcs11_R3.so from the u.trust GP HSM software package to the /opt/utimaco/lib directory.

# cp ~/path_to_application_folder/lib/libcs_pkcs11_R3.so /opt/utimaco/lib

Copy the csadm and p11tool2 files to /opt/utimaco/bin directory and make both files executable.

# cd /home/admin/Downloads/SecurityServer-V6.6.0.0/Software/Linux/Administration/
# cp csadm p11tool2 /opt/utimaco/bin
# chmod +x /opt/utimaco/bin/csadm /opt/utimaco/bin/p11tool2

PKCS#11 Configuration

Create the directory /etc/utimaco. Locate the Utimaco PKCS#11 configuration file in your SecurityServer directory, Linux/x86-64/Crypto_APIS/PKCS11_R3/sample. Copy the Utimaco PKCS#11 configuration file cs_pkcs11_R3.cfg to the /etc/utimaco directory.

# mkdir /etc/utimaco
# cd <install directory>/Software/Linux/x86-64/Crypto_APIs/PKCS11_R3/sample 
# cp cs_pkcs11_R3.cfg /etc/utimaco
# cd /etc/utimaco

Edit the cs_pkcs11_R3.cfg file and make the appropriate changes to the file.

[Global]
# For unix:
Logpath = /etc/utimaco
# Loglevel (0 = NONE; 1 = ERROR; 2 = WARNING; 3 = INFO; 4 = TRACE)
Logging = 3
Keepalive = true
# Set the Device to connect with 
[CryptoServer]
# Device specifier 
Devices = <HSM_IP>

Create an environment variable to map to the cs_pkcs11_R3.cfg file.

# echo 'export CS_PKCS11_R3_CFG=/etc/utimaco/cs_pkcs11_R3.cfg' | sudo tee /etc/profile.d/utimaco_env.sh

For more information regarding the commands and command parameters, please see the Utimaco u.trust GP HSM documentation. The device may be a PCIe or LAN device. The device line will follow one of these patterns, based on the HSM form-factor:

Device = 288@<HSM IP address> Hardware (LAN) HSM or Device = /dev/cs2.0 Hardware (PCIe) HSM

It would be good to enable the PKCS#11 logging to make your testing easier.

It can be enabled by editing the Logging Loglevel. Set the LogPath and Logging Loglevel to 1. For testing, you may want to increase it to 4.

The added LogPath points to a writable directory, not to a file.

If you encounter problems, check the log file cs_pkcs11_R3.log in the LogPath defined directory. When you are done testing, you should change Logging Loglevel to 1 or 2.

This will limit the logging to only critical and important messages.