Initializing the Root Key Store

This tutorial shows how to set up the Root Key Store (RKS).

The Root Key Store is required for using attestation. This is why certain applications and integrations require the RKS to be set up, for example those that use the Transaction Security Broker and Smart Key Attributes.

The RKS only needs to be initialized once per HSM. First check whether it is already set up. It may have been set up during the Initial Wizard.

tip

In CloudHSM, the RKS is already set up.

Check Whether the Root Key Store is Set Up

If the Root Key Store is fully set up, it will be shown as "active" in the following diagnostics:

UI

System ➜ Diagnostics Device ➜ Firmware

Console

hsm_diagnostics fw

Initialize the Root Key Store

If the Root Key Store is not yet set up, run the following commands. The HSM may prompt you to insert an USB stick with your license file.

UI

System ➜ Root Key Element ➜ Install Root Key Element

System ➜ Root Key Element ➜ Setup Root Key Store

Console

hsm_sec_install_rke
hsm_sec_setup_rks

warning

This will delete any previously installed Root Key Store! This step only needs to be done once per HSM. Skip this step if you have already set up the Root Key Store before.

If you re-setup the Root Key Store, the intermediate device key is re-generated, replacing the previous device key. Any attestations created after this event will use the new device key. Any existing attestations created before this event remain verifiable, because the root certificate has not changed.

Clusters

In a cluster of Primus HSMs, the above steps need to be repeated on every device.

References

• Section 6 "Attestation and Audit (Device, User, Key)" of the Primus HSM User Guide.
• Section 6.1 "Initialize Root Key Store, Device Intermediate Key and Audit Key" of the Primus HSM User Guide.