Using HSM-backed keys in ADSS Server

This section is informational. Configuration of individual ADSS services is outside the scope of this integration guide. For service-specific configuration steps, refer to the ADSS Server Admin Guide available within the running ADSS Server console at https://[adss-host]:8774/adss/console/docs/help/welcome.html.

Service signing keys

ADSS Service	Key Purpose	ADSS Admin Guide Reference
Signing Service	Signs documents and data on behalf of business applications. Supports PDF/PAdES, XML/XAdES, CMS/CAdES, PKCS#7, S/MIME, and ASiC.	Signing Service > Signing Profiles
TSA Service	Signs RFC 3161 / RFC 5816 timestamp tokens.	TSA Service > TSA Profiles
OCSP Service	Signs OCSP responses (RFC 2560 / 6960 / 5019) on behalf of one or more registered CAs.	OCSP Service > OCSP Profiles
Certification Service	Signs end-entity certificates and CRLs as an internal Certification Authority.	Certification Service > Certificate Authorities
SCVP Service	Signs Server-based Certificate Validation Protocol responses (RFC 5055).	SCVP Service > SCVP Profiles
LTANS Service	Signs long-term archive evidence records (RFC 4998 / RFC 6283) and optional notary signatures.	LTANS Service > Archive Profiles
Go>Sign Service	Signs hashes in server-side signing flows and produces signature enhancements.	Go>Sign Service > Go>Sign Profiles
RAS / SAM Service	Holds end-user signing keys for Remote Authorised Signing flows under sole control.	RAS Service / SAM Service
CSP Service	Holds end-user signing keys exposed via the Cloud Signature Consortium (CSC) API.	CSP Service

Infrastructure and operational keys

Key	Purpose	ADSS Admin Guide Reference
TLS Server Authentication certificate	Secures TLS communication between the Core, Console, and Service Tomcat instances and external clients.	Key Manager > Service Keys; Global Settings > System Certificate
System Master Key (HSM-based startup)	Protects ADSS database encryption material when the master key is held on the HSM rather than in software. Selected during installation.	Installation Guide > Master Key Configuration
Key Encrypting Key (KEK)	Wraps end-user signing keys for encrypted storage in the ADSS database. Keys are unwrapped only inside the HSM at signing time.	Key Manager > Crypto Source > Key Wrapping Settings

​Service signing keys

​Infrastructure and operational keys

Service signing keys

Infrastructure and operational keys