Prerequisites

To install CyberVault KMS, you need:

• A Securosys Primus HSM or CloudHSM
  • With firmware version 3.2.13 (or later).
  • With a license that includes the HSM features that you want to use (see the HSM Configuration below).
• A Transaction Security Broker (TSB)
  • With the REST_API license
  • With software version 2.8.12 (or later)
• A Docker environment:
  • Either a Kubernetes cluster (for example minikube)
  • Or the Docker Engine and Docker Compose

System Requirements

Every container in the Key Manager (excluding the auth container) has the following minimum requirements:

• CPU: 0.5
• RAM: 256 MB

The auth container has higher requirements because it caches more runtime state in memory:

• CPU: 1 (recommended 2)
• RAM: 2048 MB

Related components

• For the TSB (REST API), see TSB System Requirements.
• For the KMIP Server, see KMIP System Requirements.

Configuring the HSM

First, make sure that the Root Key Store is set up.

In the User Security Configuration of your Partition, enable User Configuration, JCE, and REST API.

PSO

User Config -> Edit -> (setting)

Enable:

• User Configuration
• JCE
• REST API
• Key import (for on-prem TSB and mTLS)

UI

Setup -> Configuration -> Security -> User Security -> (User) -> (setting)

Enable:

• User Configuration
• JCE
• REST API
• Key import (for on-prem TSB and mTLS)

Console

hsm_user_enter_config

hsm_user_set_config use_usr_cnf=true
hsm_user_set_config jce=true
hsm_user_set_config rest_api=true
hsm_user_set_config key_import=true  # for on-prem TSB and mTLS

hsm_user_list_config jce

hsm_user_exit_config

note

Key import needs to be enabled temporarily for installations that use an on-prem TSB with mTLS as the authentication method.

The installer imports an issuing CA key into the HSM (by default kms.tsb.user.ca), which issues the TSB client certificates. Without key import, the installer stops with KeyImportNotAllowed.

Key import is only used during this bootstrap and can be disabled afterwards. Re-enable key import if you reinstall the KMS from scratch or restore a backup (as that generates a new CA key).

info

In CloudHSM, these options are enabled by default.

Optional Features

Additionally, if you use one of the following features, enable their respective config option:

License / Config Option	Description
KM System	Enhanced Authentication Subscription, including: unlimited users, SSO, TOTP.
KMI Protocol	Required to run the KMIP Server
"Key Authorization". Optionally: "TSB Workflow Engine"	Smart Key Attributes and Approver Management

info

In CloudHSM, please request these features to be enabled. Either during ordering, or by opening a support ticket later.