Installing and Configuring u.trust GP HSM | Utimaco Integration Guides

The following section outlines the procedures required to configure the Utimaco SecurityServer Software.

If you have not already done so, create and request an Utimaco Support Portal Account at https://support.hsm.utimaco.com/support . This will allow you to download the software components needed for this installation.

Copy the downloaded software to the appropriate location on the KeyMirror client system.
Create a utimaco folder under the /opt directory and create two directories /opt/utimaco/bin and /opt/utimaco/lib.

# mkdir -p /opt/utimaco/bin 
# mkdir /opt/utimaco/lib

Copy the pkcs11 library file libcs_pkcs11_R3.so from the Utimaco CryptoServer software to the /opt/utimaco/lib directory and make the file executable.

cp ~/path_to_application_folder/lib/libcs_pkcs11_R3.so /opt/utimaco/lib
chmod +x /opt/utimaco/lib/libcs_pkcs11_R3.so

Copy the csadm and p11tool2 files from the Utimaco CryptoServer software to the /opt/utimaco/bin directory and make both files executable.

# cd ~/path_to_application_folder 
# cp csadm p11tool2 /opt/utimaco/bin
# chmod +x /opt/utimaco/bin/csadm /opt/utimaco/bin/p11tool2

Create the directory /etc/utimaco. Locate the Utimaco PKCS#11 configuration file in your SecurityServer directory, Software\Linux\Crypto_APIs\PKCS11_R3\sample. Copy the Utimaco PKCS#11 configuration file cs_pkcs11_R3.cfg to the /etc/utimaco directory.

# mkdir /etc/utimaco
# cd ~/path_to_application_folder/Software/Linux/Crypto_APIs/PKCS11_R3/sample 
# cp cs_pkcs11_R3.cfg /etc/utimaco

Edit the cs_pkcs11_R3.cfg file and make the appropriate changes to the file.

[Global]
# For unix:
Logpath = /etc/utimaco
# Loglevel (0 = NONE; 1 = ERROR; 2 = WARNING; 3 = INFO; 4 = TRACE)
Logging = 3
Keepalive = true
# Set the Device to connect with
[CryptoServer]
# Device specifier
Devices = <HSM_IP>

For more information regarding the commands and command parameters, please see the Utimaco u.trust GP HSM documentation. The device may be a PCIe or LAN device. The device line will follow one of these patterns, based on the HSM formfactor: Device = 288@<HSM IP address> Hardware (LAN) HSM or Device = /dev/cs2.0 Hardware (PCIe) HSM

To simplify your testing process, it's recommended that you enable the PKCS#11 log file by adjusting the logging settings. Specifically:

Set the LogPath to a writable directory (not a specific file).
Set the Logging log level to 1 for basic logging. Increase it to 4 for more detailed output during testing.

This will generate a log file named cs_pkcs11_R3.log within the specified LogPath directory. Reviewing this log can help with troubleshooting if you encounter issues. Once testing is complete, it's advisable to reduce Logging log level to 1 or 2 to limit output to only critical or important messages.