Configure the HSM

info

This step is only needed for on-premise Primus HSM setups. Skip this step if you are using CloudHSM.

This page explains how to prepare and configure a Primus HSM to be used for eIDAS use cases. The configuration changes described in this section are on the device-level. The Partition-level changes will be done in the next step.

This guide assumes that you have done the basic setup of the HSM, have completed the Initial Wizard, and have Security Officer (SO) roles configured. If you have not yet done this, please first proceed with Section 3 "Setup" of the Primus HSM User Guide.

Before you start, log in to the HSM via one of its administrative interfaces (console, device front panel, Decanus Terminal). Then activate the Security Officer (SO) role:

UI

SO Activate

Console

so

Enable JCE

In a cluster: must be done on the Master.

Make sure that the JCE API is enabled:

UI

Setup ➜ Configuration ➜ Security ➜ Device Security ➜ Crypto Policy ➜ JCE

Console

hsm_sec_list_config jce
hsm_sec_set_config jce=true

Also set up your network configurations to enable the JCE port.

If you are using PKCS#11 (instead of JCE or the TSB) to integrate your Server Signing Application, enable the PKCS#11 API instead.

Initialize the Root Key Store

In a cluster: must be done on every device.

The Root Key Store (RKS) needs to be installed and set up on every HSM. Follow this guide to check whether the RKS is already set up and, if not, set it up.

Create a Partition

In a cluster: must be done on the Master.

A "Partition" (from the HSM's perspective also called a "User") is a dedicated space on the HSM, with a separate key store and separate security settings. This allows isolating environments on the HSM, as a form of multi-tenancy.

Create a new Partition to use for your eIDAS application:

UI

Roles ➜ User ➜ Create

Console

hsm_sec_create_user

Best Practices

• Set up a cluster of HSMs, for increased uptime and to prevent data loss (since syncing to another HSM is also a form of backup).

• Take regular backups and store them safely. Ideally, take a device backup (as SO), but at least a partition backup (as PSO).

• Note down the Restore Encryption PIN (REP). Keep it safe and confidential. The REP is needed to restore a device backup on a different HSM. See Section 5.1.4 "Display Restore Encryption PIN from Genesis Card" in the Primus HSM User Guide.

  UI

  Roles ➜ Genesis ➜ Display REP

  Console

  hsm_display_rep

References

• Primus HSM User Guide