Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.futurex.com/llms.txt

Use this file to discover all available pages before exploring further.

Perform the following tasks to configure key labels on the KMES.

​
Create a key group

Perform the following steps to create a key group :
If the key group has already been created, skip to the Set permissions section.
1
Go to Key Management > Keys and select [ Create ] under Key Groups.
2
Select Symmetric or Asymmetric as the Key type, and set HSM Trusted for the storage location. Then, select [ OK ].
3
Enter a name for the key group, and select [ OK ].

​
Set permissions

Perform the following steps to set permissions:
1
After you create a new key group or select a pre-existing group, select [ Permissions ].
2
Give the user group the Use permission, and select [ OK ].
3
Select [ OK ] again to save and close the Key Group Editor.

​
Connect to a Guardian

To use key labels, you must make an authorized connection to the Guardian Series 3, by using one of the following methods:
  1. Log onto a Guardian by using the RKLG command in the Remote Host API.
  2. Set up a TLS connection to the Guardian by using certificates where the Common Name is the name of an identity under the role authorized to access the correct keys through Key Labeling.

​
Log on with RLKG

You can execute the RKLG command in the remote host API whenever you make a new connection to the Guardian. Issue the command with the following tokens:
TokenDefinition
DAUser Name
CHPassword
The following example shows the command using each token:
Shell
[AORKLG;DATest_User1;CHsafest;]
For more information on this command, refer to the Remote Host API technical reference guide.

​
Set up a TLS connection

The Guardian can recognize a secure connection between the host application and the Guardian when you use TLS as an authorized connection. However, for the Guardian to recognize the connection as authorized, the client must connect with a valid certificate where the Common Name is a valid user on the Guardian.
This method replaces the password authentication method in the following steps.
1
Ensure the connection for the host application Encryption Device Group for HSMs is set to SSL (under Settings).
2
The host application creates a CSR with the Common Name set to a valid user to be signed under a Certificate Authority (CA).
3
If the CA is not on the Guardian accepting the connection, you need to import it on the appropriate Guardian device.
4
Under Administration > Configuration > Network Options > TLS/SSL Settings, choose the TLS setting defined for the connection on which the host application connects. If you are using the default, this is the Balancer setting.
5
Under Certificates, select [ Edit ].
6
Right-click a trusted CA with nothing loaded, and select Import.
7
Import the CA from step 3 of this procedure.
8
Go to Identity Management > Identity Providers, right-click the background of the screen, and select Add > Provider > PKI.
9
In the Info tab, specify a name. If you are using a single user, uncheck Enforce Dual-Factor.
10
In the PKI Options tab, press [ Select ]. Choose the certificate for the CA imported in step 3, and select [ OK ].
11
Right-click the identity provider and select Add > Mechanism > PKI.
12
Set a name for the mechanism, and leave all other values set to the default values. Select [ OK ].
13
Go to Identity Management > Identities and remove the previously configured Password for the identity. Select [ Add ] and then set the Type to PKI Certificate. Then, select [ OK ].