Install with PKCS#11

This guide shows how to integrate the Cascade DNSSEC signer with a Securosys Primus HSM or CloudHSM via the PKCS#11 API.

tip

Even though Cascade natively supports KMIP, it cannot (yet) be used with the Securosys KMIP Server. This is because the only authentication mechanism supported by the Securosys KMIP Server are mTLS client certificates. Cascade, however, does yet not support mTLS.

Prerequisites

You need:

• A Securosys Primus HSM or CloudHSM.
• A server to deploy Cascade on.

Step 1: Install Cascade

Follow the Cascade documentation to install Cascade.

Step 2: Install Primus PKCS#11 Provider

Install the Primus PKCS#11 Provider on the same machine as Cascade. Primus PKCS#11 Provider 2.7.0 or later is required, as 2.6.2 and earlier do not work with Cascade.

Next, add the cascade-hsm-bridge user (which the Cascade DEB/RPM install created) to the primus group (which the PKCS#11 Provider install created). This ensures that the bridge can access the PKCS#11 Provider. For example, on Debian-based systems:

sudo usermod -aG primus cascade-hsm-bridge

If you run into problems, follow the PKCS#11 Provider troubleshooting steps.

Step 3: Configure Cascade

Follow the Cascade documentation to set up cascade-hsm-bridge and add the HSM to Cascade. Use the application settings described in the Primus PKCS#11 Provider docs.

Next Steps

Read the Cascade documentation for more information about operating Cascade.