Open the Venafi Configuration Console application.

Select the Connectors node.

Select [ Create HSM Connector ] in the Actions panel.

Enter the local master admin username and password and click [ OK ]. This will pull up the Create new HSM (Cryptoki) Connector window.

Specify a Name for the HSM connector.

For Cryptoki Dll Path, select [ Browse... ] and select the Futurex PKCS #11 DLL file at the following path:

Click [ Load Slots ].

Select the slot number configured in the FXPKCS11 configuration file (the default is slot 0). This is where Venafi Control Plane will access the encryption keys.

For User Type, leave the default option selected, Crypto Officer (User). Venafi will use the identity configured inside the FXPKCS11 configuration file when connecting to the .

For Pin, enter the identity password configured inside the <CRYPTO-OPR-PASS> tag in the fxpkcs11.cfg file.

Select [ Verify ].

If the connection to the is successful, a new Permitted Keys section will populate in the window.

Select [ New Key... ]. This will open the Create New HSM Key window.

Enter a Name and select the Type for the key, then click [ Create ].

If key creation is successful, the key is now viewable inside the Venafi Control Plane service on the . the name of the key is shown in the list of Permitted Keys in the Create New HSM Key window.

Select [ Create ] to save and close the window.

Open the Venafi Configuration Console application.

Select [ Enable Venafi Advanced Key Protect... ] in the Actions panel.

Enter the local master admin username and password and click [ OK ].

Review the information in the following dialog, and select [ Enable ] if you wish to proceed.

Restart the IIS, Venafi Platform, and Logging services.

Log in to the admin console: https://[IP_address_of_Venafi_TPP]/vedadmin

Select Policy Tree in the main menu at the top of the page.

In the Policy : Certificate window, select the Certificate tab.

Under Other Information:

Click the [ Save ] button at the bottom of the page.

Select Policy Tree in the main menu at the top of the page.

On the left hand side of the page, click the [ Add ] button under the Policy dropdown and select Certificates > Certificate.

Under General Information, enter the required information, and for Management Type, select Provisioning or Enrollment.

Under CSR Handling, leave Service Generated CSR selected for CSR Generation and leave Generate Key/CSR on Application set to No.

Under Subject DN, enter the required information.

Under Private Key, select the Key Algorithm to use and the desired Key Strength in bits.

Under Other Information, search for and select the previously configured CA Template.

Click the [ Save ] button.

Select the newly generated certificate from the policy tree. The Certificate Status should be OK.

Select [ Renew Now ]. The Certificate Status will change to Queued for renewal.

After about a minute, click [ Refresh ]. The certificate details will appear in the window.

If you selected Provisioning as the Management Type, associate the certificate to the intended application object.

Open the Venafi Configuration Console application.

Select the System Roles node.

Select [ Add CodeSign Protect Administrator ] in the Actions panel.

Select a user to grant CodeSign Protect Administrator permissions.

Open the Venafi Configuration Console application.

Under the Code Signing node, select Custom Flows.

Select Add new Code Signing Flow in the Actions panel.

Enter a name for the Code Signing Flow.

Select the newly created Code Signing Flow and add an approver through the Actions panel.

Open the Venafi Configuration Console application.

Under the Code Signing node, select Environment Templates.

Select Certificate in the Actions panel under Add Single Template.

Enter a name for the Code Signing Environment Template and select [ Create ].

In the Settings tab of the Properties window, enter a Description and select a Certificate Container and Signing Flow.

Go to the Certificate Authority tab and select a CA Template, then select [ Add ].

Go to the Keys tab and select which key sizes to allow for RSA and Elliptic Curve keys.

Open the Key Storage tab and select the Futurex HSM Connector, and select [ Add ].

Enter any optional information in the remaining tabs, and select [ OK ].

Log in to Aperture: https://[IP_address_of_Venafi_TPP]/aperture/codesign

Select Projects in the main menu at the top of the page.

Select [ Create Project ].

Enter a Project Name and Description.

Select [ Create ].

Inside the newly created Code Signing Project, go to the Environments tab and select Add Environment > Certificate & Key.

Enter the Environment Name.

Select the Environment Template you created for this Code Signing project.

For Creation Type, select Create New.

Enter any other necessary information for the certificate.

Select [ Save ].

Select [ Submit For Approval ] to generate a new certificate and private key once it is approved.

Log in to Aperture: https://[IP_address_of_Venafi_TPP]/aperture/codesign

Select Approvals in the main menu at the top of the page.

Under Pending Approvals, select the Project Creation request you just submitted.

Select [ Approve ].