Install with KMIP
This guide shows how to integrate the Cascade DNSSEC signer with a Securosys Primus HSM or CloudHSM via the KMIP API.
Prerequisites
You need:
- A Securosys Primus HSM or CloudHSM.
- A server to deploy CyberVault KMS on.
- A server to deploy Cascade on.
Step 1: Install Cascade
Follow the Cascade documentation to install Cascade. Cascade 0.1.0-beta8 or later is required.
Step 2: Install KMIP Server
Install the KMIP Server on a machine of your choice. The KMIP Server is part of the CyberVault KMS installation.
Step 3: Obtain mTLS Credentials
Use the Key Manager UI to create a new KMIP client. Download the client keystore and the client truststore as PEM files. You will need these to configure mTLS on the Cascade side.
Step 4: Configure Cascade
Follow the Cascade documentation to add the HSM to Cascade.
Use the following settings:
| Setting | Value |
|---|---|
| KMIP Server IP/FQDN | Your KMIP Server URL, e.g. kmip-server.cloudshsm.com |
| KMIP port | 5696 |
| Client certificate and key | client-cert.pem, client-key.pem, as obtained in step 3. |
| Server certificate | kmip-server-cert.pem, as obtained in step 3. |
Next Steps
Read the Cascade documentation for more information about operating Cascade.