Skip to main content
Verify your environment meets these requirements.

​
Supported hardware

  • Excrypt HSM (formerly Vectera Plus), firmware 7.6.1.x or later, with the PKCS 11 feature enabled and major keys loaded.

​
Supported operating systems

  • SUSE Linux Enterprise Server 15 or openSUSE Leap 15 on x86-64

​
Supported SAP ASE versions

  • SAP Adaptive Server Enterprise 16.0 SP04 running the threaded kernel, with the ASE_ENCRYPTION option licensed.
SAP ASE supports an external keystore only in threaded kernel mode.

​
Required software

  • The latest 6.x version of the Futurex PKCS #11 (FXPKCS11) module for Linux x86-64, from the Futurex Portal.
SAP ASE loads the module into its own server process, which contains its own encryption provider. Install Futurex PKCS #11 (FXPKCS11) explains how to confirm that the module is compatible before you install it.

​
Required access

  • Both default administrator identities (Admin1 and Admin2), or two identities with equivalent permissions. Creating application partitions and identities requires dual control, so both must log in.
  • Root access on the SAP ASE host, to install the library and its configuration.
  • The operating system account that runs SAP ASE (this guide uses sybase) and the $SYBASE installation directory (this guide uses /opt/sap).
  • An SAP ASE login with sso_role and keycustodian_role, or with the manage security configuration and manage master key permissions when granular permissions are enabled.

​
Network and firewall

  • Allow outbound TCP port 9100 (default Excrypt port) from the SAP ASE host to the Excrypt HSM, specified by FQDN (for example, hsm.example.com) or CIDR (for example, 10.0.0.0/24). The library carries every key operation over this port.
  • If you configure the HSM over the network with FXCLI or Excrypt Manager, allow TCP port 9009 (default admin port) from that workstation to the HSM. Administrator logins work only on the admin port.
TLS inspection or SSL proxies can break mutual TLS handshakes. Exempt the Excrypt HSM FQDNs from inspection. Configure the HSM with an FQDN so the exemption applies.

​
Plan for availability

SAP ASE decrypts each HSM-protected master key through the HSM before it uses it, including after every restart. If the HSM is unreachable or the stored credential is wrong, SAP ASE can’t open the keys or the encrypted data until the HSM is reachable again. Before you encrypt production data, do the following:
  • Keep a password-protected recovery copy of each master key, as described in the SAP ASE Database Encryption guide.
  • Back up the HSM key according to your HSM backup procedure, so that the key survives a hardware failure.

​
Other

  • OpenSSL on the configuration workstation, to create the client TLS key and certificate signing request if you use mutual authentication.