Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.futurex.com/llms.txt

Use this file to discover all available pages before exploring further.

Before proceeding with the tasks in this section, you must install the CyberArk PAS solution. For instructions on installing this solution, refer to the CyberArk online documentation (docs.cyberark.com/Product-Doc/OnlineHelp/PAS/Latest/en/Content/PAS%20INST/InstallationOverview.htm).
After you install the CyberArk Vault and start it successfully, you can generate a new Server key on the CryptoHub. The Server Key is the key used toopen the Vault, much like the key of a physical Vault. You need the key to start the Vault, and then you can remove the Server key until you need to restart the Server. When you stop the Vault, the information stored in the Vault is completely inaccessible without that key.

​
Configure Vault initially

Perform the following steps to configure Vault for the first time:
1
To use a CryptoHub that is attached to the network, configure the Firewall to allow communication to the CryptoHub device. In DBParm.ini, configure the AllowNonStandardFWAddresses parameter to open the Firewall and allow access to the CryptoHub device, as shown in the following example:
Text
AllowNonStandardFWAddresses=[KMS-IP],Yes,1024:inbound/tcp,1024:outbound/tcp
If using a CryptoHub instance hosted in VirtuCrypt that is accessible through the internet (rather than a physical CryptoHub connected to the local network), do not define AllowNonStandardFWAddresses in the DBParm.ini file.
2
Configure the PKCS #11 provider DLL and specify it in the PKCS11ProviderPath parameter in DBParm.ini, as shown in the following example:
Text
PKCS11ProviderPath=<path to PKCS#11 provider dll>
3
Save DBParm.ini and close it.
4
Define the PIN or passphrase to be used by the Vault when accessing the CryptoHub. From a command line, run the following command, specifying your own PIN or passcode for accessing the Server key. The PIN or passcode cannot begin with a forward slash (/):
The hsmpincode you pass into the command below must be the identity password configured inside the <CRYPTO-OPR-PASS> tag in the fxpkcs11.cfg file.
Text
CAVaultManager SecureSecretFiles /SecretType HSM /Secret <hsmpincode>
Open DBParm.ini and make sure that you added the HSMPinCode parameter with the encrypted value of the PIN or passcode.
5
Restart the PrivateArk Server to apply the new firewall rules.
6
Shut down the PrivateArk Server.

​
Load the server key into the CryptoHub

The following process installs and stores the Server key in CryptoHub. After this process completes, the Server key is stored as non-exportable key on the CryptoHub and the Vault can use it.

​
Generate the server key on the CryptoHub

Perform the following steps to generate the server key on the CryptoHub:
1
Make sure that the Vault Server is not running.
2
Run the CAVaultManager command to generate the server key on the CryptoHub:
Text
CAVaultManager.exe GenerateKeyOnHSM /ServerKey
This command generates a new key for the Vault server and stores it in the CryptoHub device, returning the key generation keyword (such as HSM#5).Each time you create a key generation, the keyword allocated is one number higher than the current server key generation specified in DBParm.ini. To successfully create additional key generations, you must manually delete the first generation of the server key; otherwise, an error is returned. If the ServerKey parameter in the CAVaultManager command specifies a path instead of a CryptoHub keyword, the first key generation is created (such as HSM#1).
3
Re-encrypt the Vault data and metadata with the newly generated keys in CryptoHub.
  • Run the ChangeServerKeys command to change the encryption keys used for the Vault server.
4
Open DBParm.ini and, in the ServerKey parameter, specify the value of the key generation version generated and specified in the output of the preceding CAVaultManager command, as shown in the following example.
Text
ServerKey=HSM#1
5
Start the Vault server and make sure you can log into the Vault.