Breadcrumbs

On Linux

Download and Install Utimaco Software

If you have not already done so, please create and request an Utimaco Support Portal Account. This will allow you to download the software components needed for this installation.

  1. Copy the downloaded software at the appropriate location on the Server.

  2. Create an utimaco folder under the /opt directory and further create 2 directories:

    1. /opt/utimaco/bin

    2. /opt/utimaco/lib

›_ Console

# mkdir -p /opt/utimaco/bin # mkdir -p /opt/utimaco/lib

  1. Copy pkcs11 library file libcs_pkcs11_R3.so from Utimaco CryptoServer software to the /opt/utimaco/lib directory.

›_ Console

# cp ~/path_to_application_folder/lib/libcs_pkcs11_R3.so /opt/utimaco/lib

  1. Copy the csadm and p11tool2 files from Utimaco CryptoServer software to /opt/utimaco/bin directory and make both files executable.

›_ Console

# cd ~/path_to_application_folder

# cp csadm p11tool2 /opt/utimaco/bin

# chmod +x /opt/utimaco/bin/csadm /opt/utimaco/bin/p11tool2

u.trust GP HSM PKCS#11 Configuration

  1. Create the directory /etc/utimaco. Locate the Utimaco PKCS#11 configuration file in your SecurityServer directory, Linux/x86-64/Crypto_APIS/PKCS11_R3/sample. Copy the Utimaco PKCS#11 configuration file cs_pkcs11_R3.cfg into the /etc/utimaco directory.

›_ Console

# mkdir /etc/utimaco

# cd <install directory>/Software/Linux/x86-64/Crypto_APIs/PKCS11_R3/sample # cp cs_pkcs11_R3.cfg /etc/utimaco

# cd /etc/utimaco

  1. Edit the cs_pkcs11_R3.cfg file and make the appropriate changes to the file.

cs_pkcs11_R3.cfg

[Global]

# For unix:

Logpath = /tmp

# Loglevel (0 = NONE; 1 = ERROR; 2 = WARNING; 3 = INFO; 4 = TRACE)

Logging = 1 Keepalive = true

# Set the Device to connect with [CryptoServer]

# Device specifier Device = <HSM_IP>

This integration is not supported with external keystore.

For more information regarding the commands and command parameters, please check the Utimaco CryptoServer documentation. The device may be a CryptoServer (PCIe or LAN) device. The device line will follow one of these patterns, based on the HSM form-factor:

Device = 288@<HSM IP address> Hardware (LAN) HSM

or

Device = /dev/cs2.0 Hardware (PCIe) HSM

To make your testing easier, it would be good to enable the PKCS#11 log file. That can be enabled by editing the Logging Loglevel. Set the LogPath and Logging Loglevel to 1. For testing you may want to increase it to 4.

The added LogPath points to a writable directory, not to a file.

If you encounter problems, check the log file named cs_pkcs11_R3.log in the LogPath defined directory. When you are done testing, you should change Logging to 1 or 2. This will limit the logging to only critical and important messages.

Create SO, User and Initialize a Slot

You must initialize a slot with a custom label using p11tool2.

First using p11tool2 create, the SO or Security Officer and then using the p11tool2 command initialize the Slot that you want to use, as well as the slot user, as shown below.

›_ Console

# ./p11tool2 slot=<slot_no> Label=<token_label> Login=ADMIN,ADMIN.key InitToken=<SO_PIN>

# ./p11tool2 slot=<slot_no> LoginSO=<SO_PIN> InitPin=<CryptoUser_PIN>