Breadcrumbs

Configure PKCS#11 R2

The PKCS#11 R2 library and configuration files for Linux operating system must be installed manually. Here are some of the basic steps to install and configure PKCS#11 R2.

  • Make a directory, mount the installation media (CDROM, USB) and copy files from the installation media to the server.

# mkdir /mnt/usb OR mkdir /mnt/cdrom

# mount /dev/sdb1 /mnt/usb	for usb mouting

# mount /dev/sr0 /mnt/cdrom for CDROM mounting

# cp /mnt/usb/SG_SecurityServer-V3.10.3/Software/Linux/x86-64/Crypto_APIs/PKCS11_R2 '

/lib/libcs_pkcs11_R2.so /usr/local/lib64/

# cp /mnt/usb/SG_SecurityServer-V3.10.3/Software/Linux/x86-64/Crypto_APIs/PKCS11_R2 '

/bin/p11tool2 /usr/local/bin/

# chmod +x /usr/local/lib64/libcs_pkcs11_R2.so /usr/local/bin/p11tool2

  • Create HSMs configuration file (edit a version taken from the installation media):

# mkdir /etc/utimaco

# cp SG_SecurityServer-V3.10.3/Software/Linux/x86-64/Crypto_APIs/PKCS11_R2 '

/sample/cs_pkcs11_R2.cfg /etc/utimaco/

# chmod +x /etc/utimaco/cs_pkcs11_R2.cfg

  • Edit the CryptoServer section to specify the device or the network address/port of the HSMs, e.g. for a simulator running on a PC at the 127.0.0.1 address.

[CryptoServer]

# Device specifier (here: CryptoServer is CSLAN with IP address 192.168.0.1)

Device = 3001@127.0.0.1

Check the connectivity with the HSM by using below command:

# /usr/local/bin/p11tool2 GetTokenInfo

For more information, look into the PKCS#11 R2 Manual [3].