Breadcrumbs

Setting up the CSP/CNG Provider

The CS_CNG_CFG environment variable contains the path and name of the configuration file. By default, it is located at C:\ProgramData\Utimaco\CNG\cs_cng.cfg.

For advanced configuration, refer CryptoServer_Manual_CSP_CNG.pdf found on the product CD in the Documentation directory.

  1. Open the cs_cng.cfg file with an appropriate text editor.

›_ Console

 
notepad %CS_CNG_CFG%

  1. For this installation set the path to the log file and set the log level to "TRACE".

example.file

 
# Path to the logfile (name of logfile is attached by the API)
Logpath = C:\Logs\CNG\
# Loglevel (0 = NONE; 1 = ERROR; 2 = WARNING; 3 = INFO; 4 = TRACE)
Logging = 4

To make your testing easier, it would be good to enable the CNG log file. That can be enabled by editing the Logging Loglevel. Set the LogPath and Logging Loglevel to 1. For testing you may want to increase it to 4.

The added LogPath points to a writable directory, not to a file.

If you encounter problems, check the log file named cs_cng.log in the LogPath defined directory. When you are done testing, you should change Logging to 1 or 2. This will limit the logging to only critical and important messages.

  1. Set the Login. In this case, the name of the Cryptographic User is "Ca1User" with an HMAC password "Utimaco19".

example.file

 
Login = Ca1User,HMACPwd=Utimaco19

If using Smartcard or KeyFile protection make the appropriate change in the Login Section as shown below:

Login = username,RSASign=filename#password

Login = "SmartCardUser,RSASign=:cs2:auto:USB0@<HSM-IP>"

For additional information refer CryptoServer_csadm_Manual_Systemadministrators.pdf document, found on the product CD in the Documentation directory.

  1. Set the IP address of the HSM.

example.file

 
[CryptoServer]
# Device specifier (here: CryptoServer is CSLAN with IP address 10.44.223.141)
Device = 10.44.223.141

  1. The Configuration File used in this document.

example.file

 
# Path to the logfile (name of logfile is attached by the API)
Logpath = C:\Logs\CNG\

# Loglevel (0 = NONE; 1 = ERROR; 2 = WARNING; 3 = INFO; 4 = TRACE)
Logging = 4

# Maximum size of the logfile in bytes 
Logsize = 8mb

# Keys are stored in an external or internal database 
KeysExternal = false

# Path to the external keystore. Directory must be given, not file!
KeyStore = C:\ProgramData\Utimaco\CNG\keys

# Export policy for newly created keys: 0=allow all, 1=deny plain export (standard), 2=deny all
ExportPolicy = 1

# Prevents expiring session after inactivity of 15 minutes 
KeepAlive = true

# Timeout of the open connection command in ms 
ConnectionTimeout = 3000

# Timeout of command execution in ms 
CommandTimeout = 60000

# CXI group for all keys. The user has to have access to this group.
Group = CngCa1

# Auto-login for CNG provider. This should be used for automated server (re)start.
Login = Ca1User,HMACPwd=Utimaco19

# default device and fallback devices 
Device = 10.44.223.141

For more information regarding the commands and command parameters please check the Utimaco documentation. The device may be a CryptoServer (PCIe or LAN) device. The device line will follow one of these patterns, based on the HSM form-factor:

Device = 288@<HSM IP address> Hardware (LAN) HSM

OR

Device = /dev/cs2.0 Hardware (PCIe) HSM