About This Guide
This guide provides step-by-step instructions for integrating ZetaCA, a sovereign Certificate Authority solution by ZetaCert Technologies, with the Utimaco u.trust GP HSM SecurityServer and QuantumProtect modules. It covers HSM setup, PKCS#11 configuration, CA key generation on the HSM, and end-to-end certificate issuance - including post-quantum cryptography (PQC) using ML-DSA via QuantumProtect.
Target Audience
This guide is intended for Partner Product and Utimaco Hardware Security Module (HSM) administrators.
Purpose of the Integration
ZetaCA is a full-featured Certificate Authority that supports hardware-protected key storage via PKCS#11. Integrating with Utimaco SecurityServer HSM provides FIPS 140-2 Level 4 physical protection for CA private keys, hardware-accelerated RSA and ECDSA operations, and post-quantum readiness via QuantumProtect ML-DSA support. CA root and intermediate keys never leave the HSM boundary, meeting eIDAS, Common Criteria, and PCI-DSS compliance requirements.
Abbreviations
|
Abbreviation |
Meaning |
|---|---|
|
HSM |
Hardware Security Module |
|
PKI |
Public Key Infrastructure |
|
TDE |
Transparent Data Encryption |
|
PKCS |
Public Key Cryptography Standards |
|
PKCS#11 |
PKCS Part 11: The Cryptographic Token Interface Standard |
|
SO |
The PKCS#11 cryptographic slot Security Officer |
|
DB |
Database |
|
JRE |
Java Runtime Environment |
|
MBK |
Master backup key |
|
P11CAT |
the PKCS#11 graphical interface tool |
|
CXI |
Cryptographic eXtended Interface |
|
FIPS |
Federal Information Processing Standards |
|
OCSP |
Online Certificate Status Protocol |
|
CRL |
Certificate Revocation List |
|
PQC |
Post-Quantum Cryptography |
|
ML-DSA |
Module Lattice Digital Signature Algorithm |
|
KEK |
Key Encryption Key |
|
DEK |
Data Encryption Key |
|
VDM |
Vendor Defined Mechanism |
|
CLM |
Certificate Lifecycle Management |
|
API |
Application Programming Interface |
|
HA |
High Availability |
|
TLS |
Transport Layer Security |
|
CN |
Common Name |
|
RMA |
Return Merchandise Authorization |
|
CET |
Central European Time |
Abbreviations
Document Conventions
The following conventions are used in this guide:
|
Convention |
Use |
Example |
|---|---|---|
|
Bold |
Items of the Graphical User Interface (GUI), e.g., menu options |
Press OK |
|
|
Code that is given for explanation or as an example, file paths |
|
|
Italic |
References and important terms |
See Sample Chapter in the CryptoServer - Sample Manual |
Document conventions
We use special icons to highlight the most important notes and information.
Here you will find important safety information that should be followed.
Here you will find additional notes or supplementary information.
This message indicates the expected result after the successful execution of an instruction.