Code signing
...
Microsoft SignTool
Configure the Vectera Plus

Configure a transaction processing connection and create an application partition

2min


Create an application partition

To segregate applications on the HSM, you must create an application partition specifically for your use case. Application partitions segment the permissions and keys between applications on an HSM.

Choose one of the following methods to create an application partition:

Excrypt Manager
FXCLI
1

Go to the Application Partitions menu and select [ Add ].

2

In the Basic Information tab, configure all of the fields as follows:

Option

Required configuration



Role Name

Specify any name that you would like for this new application partition.



Logins Required

Set to 1

If the HSM is in FIPS mode, you must set Logins Required to 2.



Ports

Set to Prod.



Connection Sources

Set to Ethernet.



Managed Roles

Leave blank because you specify the exact Permissions, Key Slots, and Commands for this application partition or role to have access to.



Use Dual Factor

Set to Never.



Upgrade Permissions

Leave unchecked.


3

In the Permissions tab, select the following key permissions:

Permission

Description



Keys

Top-level permission



Authorized

Allows for keys that require login



Import PKI

Allows trusting an external PKI. Generally not recommended, but some applications use this option for PKI symmetric key wrapping.



No Usage Wrap

Enables interoperable key wrapping without defining key usage as part of the wrapped key. Use this only if you want to exchange keys with external entities or use the HSM to wrap externally used keys.


4

In the Key Slots tab, we recommend you create a range of 1000 total keys that do not overlap with another application partition. Within the specified range, you should have ranges for both symmetric and asymmetric keys. If the application requires more keys, configure it accordingly.

5

To use the HSM functionality, you must enable particular functions on the application partition based on application requirements. Enable the following commands under Commands:

CNG communication commands:

Command

Description



ECHO

Communication Test/Retrieve Version



HASH

Retrieve device serial



GPKM

Retrieve key table information



Key operations commands:

Command

Description



RPFP

Get public components from RSA private key



APFP

Generate PKI Public Key from Private Key



Signing Commands:

Command

Description



RSAS

Generate a Signature Using a Private Key



ASYS

Generate a signature using PKI private key