Configure PKCS#11 for Check Point

This page explains how to configure Check Point Security Gateway to delegate generation and storage of the HTTPS interception CA private keys and certificates to a Securosys HSM.

Various Check Point Environment Requirements

• In a Check Point Cluster, you must configure all the Cluster Members in the same way.
• In a VSXClosed environment, you must perform this step in the context of each Virtual System (on the VSX GatewayClosed or each VSX Cluster MemberClosed).
• On Scalable Platforms, you must run the applicable commands in Gaia Clish Closed of the applicable Security Group.

Before starting with the integration, it's recommended to verify HTTPS inspection is working with your existing Security Gateway. Follow the Check Point HTTPS Inspection documentation.

Install Primus PKCS#11 Provider

1. Install the Primus PKCS#11 Provider on your Security Gateway / each Cluster Member / Security Group.
2. Authenticate as root and copy the libprimusP11.so into the /usr/lib/hsm_client/ directory. (Do not create a symbolic link)

Create Cryptographic Objects

Log in to your HSM Partition via the HSM Client Workstation and specify or create the following cryptographic objects:

1. CA certificate
2. CA certificate private and public key
3. At least one RSA key pair
4. Optionally create additional key pairs for fake certificates.

Supported algorithms and sizes:

• RSA 1024, 2048, 4096
• ECDSA 256, 384, 521

Note down the cryptographic objects' labels as they will be used when configuring the HTTPS inspection.

Configure HTTPS Inspection

Connect to the command line on your Security Gateway / each Cluster Member / Security Group and log in to Gaia Clish.

1. Configure the HTTPS Inspection so that it uses the Primus PKCS#11 Provider. These settings include the library filename, Partition details, the CA certificate label.

   set param path https_inspection.hsm.lib_filename param-value "libprimusP11.so"
   set param path https_inspection.hsm.hsm_vendor_name param-value "Securosys SA"
   set param path https_inspection.hsm.hsm_model_name param-value "Securosys Primus HSM"
   set param path https_inspection.hsm.token_label param-value "<Name of HSM Partition>"
   set param path https_inspection.hsm.token_id param-value "<PKCS#11 Password for HSM Partition>"
   set param path https_inspection.hsm.ca_cert.buffer_label param-value "<Label for the CA certificate object>"
   set param path https_inspection.hsm.ca_cert.public_key_label param-value "<Public Key Name for the CA Certificate>"
   set param path https_inspection.hsm.ca_cert.private_key_label param-value "<Private Key Name for the CA Certificate>" 

2. Configure the key labels for the RSA fake certificate. At least one key pair is required:

   set param path https_inspection.hsm.inspection_keys.rsa_4096.private_key_label param-value "<Key Label>"
   set param path https_inspection.hsm.inspection_keys.rsa_4096.public_key_label param-value "<Key Label>"
   #set param path https_inspection.hsm.inspection_keys.rsa_2048 .private_key_label param-value "<Key Label>"
   #set param path https_inspection.hsm.inspection_keys.rsa_2048 .public_key_label param-value "<Key Label>" 

3. Configure the key labels for the ECDSA fake certificate. At least one key pair is required:

   set param path https_inspection.hsm.inspection_keys.ecdsa_521.private_key_label param-value "<Key Label>"
   set param path https_inspection.hsm.inspection_keys.ecdsa_521.public_key_label param-value "<Key Label>" 
   #set param path https_inspection.hsm.inspection_keys.ecdsa_384.private_key_label param-value "<Key Label>"
   #set param path https_inspection.hsm.inspection_keys.ecdsa_384.public_key_label param-value "<Key Label>"
   #set param path https_inspection.hsm.inspection_keys.ecdsa_256.private_key_label param-value "<Key Label>"
   #set param path https_inspection.hsm.inspection_keys.ecdsa_256.public_key_label param-value "<Key Label>" 

4. Enable the HSM configuration and save it:

   set param path https_inspection.hsm.enabled param-value true 
   save config 
   fw fetch local

5. Verify and validate the settings. Log into Expert mode and run:

   printHSMSlotInformation /usr/lib/hsm_client/libprimusP11.so
   checkHSMconfiguration

Ensure the Security Gateway / each Cluster Member / Security Group can connect to the HSM Server and that HTTPS Inspection is activated successfully on the outbound traffic.

Expected successful output:

HSM partition access (Accessible/Not Accessible): Accessible
Outbound status (HSM on/HSM off/HSM error): HSM on

Check Point provides monitoring capabilities for HTTPS Inspection integrated with an HSM. See Monitoring HTTPS Inspection with HSM in CLI

HSM Availability

If the HSM Server is not available when you fetch the local policy or install the policy in SmartConsole, the HTTPS Inspection cannot inspect the Outbound HTTPS traffic. As a result, internal computers behind the Security Gateway / Cluster / Security Group / VSX Virtual System cannot access HTTPS web sites.

References

• Check Point HTTPS Inspection documentation
• Check Point HSM documentation