Configuring the ESA with HSMs supporting PKCS#11 Interface

Verifying the Prerequisites

Ensure that the following prerequisites are met:

1. Ensure that you have downloaded HSM Client on your local machine.

2. Ensure that the HSM partition is initialized.

3. Ensure that you have downloaded the required libraries, configuration files, and certificates required for connecting to the HSM. The certificates can include the server certificate of the HSM, the client certificate for the ESA appliance, and the CA certificate.
   For more information required about the files required for connecting to the HSM, refer the documentation for the corresponding HSM.

Configuring Connection with HSM

To configure a connection with an HSM:

1. On the ESA Web UI, navigate to Key Management > Key Stores.

   The Key Stores screen appears.

2. Click New Key Store.

   The Create New Key Store screen appears.

3. In the Key Store Information section, enter the following details.

   • Name: Type a unique name for HSM. The name that you type will update the Key Store installation path field.
   • Type: Select PKCS #11.

4. In the PKCS#11 details section, enter the following details:

   • User pin: Specify the user pin for the given slot ID of the HSM.
   • Slot: Enter the slot ID for the HSM.

5. Perform the following steps to add the environment variables.
   To configure the PKCS #11 connection, you need to override the default location of the HSM configuration file. You can do this by setting the environment variable for the HSM-specific library.

   1. In the Key Store files and environment variables > Key Store environment variables section, click Add environment variable.
      The Add Key Store environment variable dialog box appears.

   2. Enter the following details:

   • Environment variable name: Specify the environment variable name for the HSM.
     For example, specify the ChrystokiConfigurationPath for Thales Luna HSM.
   • Environment variable value: Specify the value for the environment variable.
     For example, specify /opt/protegrity/keystore/<Keystore_name>, which is the value of the Key Store installation path field, for the Thales Luna HSM.
     If you want to mask the value of the variable in the UI, then click the Sensitive toggle to the on position. This ensures that the variable value is hidden while typing and is replaced with asterisks of a fixed-length in the list of environment variables.
   3. Click Save.

6. In the Key Store files and environment variables > Key Store files section, click Add File.
   The Add Key Store File dialog box appears.

7. Select the specific file type from the drop-down menu. The following table provides more detail on each selectable type. Note that only one type of file can be selected at a time.

8. Click Add File to add the file to the Key Store files section.

9. Repeat steps 7 to 8 till you have added all the files required to connect to the Key Store.

10. Perform the following steps to edit the configuration file.
    a. Click the Edit icon next to the configuration file.
    The Edit Key Store File screen appears.

    b. Update the path of the required configuration parameters to match the path displayed in the Key Store installation path field.

    c. Click Save.
    The Edit Key Store File screen closes.

11. Click Save.
    The Key Store saved successfully message appears.

12. Click Test to test the Key Store connection.
    The Test Key Store Connection dialog box appears.

13. Click OK to close the Test Key Store Connection dialog box.

14. Click Set As Active to activate the Key Store.