Configure Venafi TPP to use the Vectera Plus

13min
Perform the tasks in this section to integrate the Venafi Trust Protection Platform (TPP) with a   HSM for data encryption, key generation, and key storage.
1 | Create an HSM connector and generate an HSM-protected encryption key
1
Open the Venafi Configuration Console application.
2
Select the Connectors node.
3
Select [ Create HSM Connector ] in the Actions panel.
4
Enter the local master admin username and password and select [ OK ].
5
In the Create new HSM (Cryptoki) Connector window, for Name, enter any name for the HSM connector.
6
For Cryptoki Dll Path, select [ Browse ] and locate the following path to the  PKCS #11 DLL file:
C:\Program Files\Futurex\fxpkcs11\fxpkcs11.dll
7
Select [ Load Slots ].
8
Select the slot number configured in your  PKCS #11 configuration file (the default is slot 0). This is where TPP accesses the encryption keys.
9
For User Type, leave the default option selected, Crypto Officer (User). Venafi uses the identity configured in the  PKCS #11 file to connect to the .
10
For Pin, enter the password for the identity configured in the  PKCS #11 file.
11
Select [ Verify ].
If the connection to the HSM succeeds, a new Permitted Keys section displays.
12
Select [ New Key ].
13
In the Create New HSM Key window, enter a Name and select the Type for the key. Then, select [ Create ].
14
If you plan to use Venafi CodeSign Protect to store private code signing keys in the  select the Allow Key Storage checkbox.
15
Select [ Create ] to save and close the window.
2 | Enable Venafi Advanced Key Protect
You need Venafi Advanced Key Protect to generate HSM private keys. In addition, Venafi Code Signing Certificate Private Key Storage requires you to enable the feature. To enable Venafi Advanced Key Protect, perform the following steps. 
1
Open the Venafi Configuration Console application.
2
Select [ Enable Venafi Advanced Key Protect ] in the Actions panel.
3
Enter the local master admin username and password and select [ OK ].
4
Review the information in the following dialog, and select [ Enable ] if you want to proceed.
5
Perform the following steps to restart the IIS, Venafi Platform, and Logging services:
Select the Product node.
Select Website and select [ Restart ] in the Actions panel.
Select Venafi Platform and select [ Restart ] in the Actions panel.
Select Logging and select [ Restart ] in the Actions panel.
3 | Generate an HSM private key
Venafi Trust Protection Platform uses the  HSM to generate private keys for SSH keys and certificates.
You must create a Certificate Authority (CA) template object in Venafi TPP to manage the certificate life cycle and generate an HSM key. See Venafi documentation for more information.
Perform the following tasks the enable key generation and create a certificate:
a | Configure the Venafi platform policy to enable the Vectera Plus for HSM key generation
1
Log in to the admin console: https://[IP_address_of_Venafi_TPP]/vedadmin.
2
Select Policy Tree in the main menu at the top of the page.
3
In the Policy : Certificate window, go to the Certificate tab.
4
Under Other Information:
Select the name of the HSM Connector you created for the  in the Key Generation drop-down menu.
Select the name of the HSM-Protected Encryption Key you created on the  HSM.
Select [ Save ] at the bottom of the page.
b | Generate the certificate
1
Select Policy Tree in the main menu at the top of the page.
2
On the left-hand side of the page, select [ Add ] under the Policy drop-down menu and select Certificates > Certificate.
3
Under General Information, enter the required information, and for Management Type, select Provisioning or Enrollment.
4
Under CSR Handling, leave Service Generated CSR selected for CSR Generation and leave Generate Key/CSR on Application set to No.
5
Under Subject DN, enter the required information.
6
Under Private Key, select the Key Algorithm to use and the desired Key Strength in bits.
7
Under Other Information, search for and select the previously configured CA Template.
8
Select [ Save ].
9
Select the newly generated certificate from the policy tree. 
The Certificate Status should be OK.
10
Select [ Renew Now ]. 
The Certificate Status changes to Queued for renewal.
11
After about a minute, select [ Refresh ]. 
The certificate details appear in the window.
12
Opyionally, if you selected Provisioning for Management Type, associate the certificate to the intended application object.
4 | Configure code signing
Venafi CodeSign Protect can store private code signing keys in the  HSM. This section describes the basic steps to configure this functionality for the integration. See Venafi documentation for more details
Venafi TPP uses Certificate Authority (CA) template objects to manage the certificate life cycle. You must create one to use code signing. See Venafi documentation for more information.
To use the  for key storage, you must enable Key Storage on the HSM Connector.
a | Assign permissions to a code signing administrator
1
Open the Venafi Configuration Console application.
2
Select the System Roles node.
3
Select [ Add CodeSign Protect Administrator ] in the Actions panel.
4
Select a user to grant CodeSign Protect Administrator permissions.
b | Create a code signing Flow
1
Open the Venafi Configuration Console application.
2
Under the Code Signing node, select Custom Flows.
3
Select [ Add new Code Signing Flow ] in the Actions panel.
4
Enter a name for the code signing flow.
5
Select the newly created code signing flow and add an approver through the Actions panel.
c | Create an Environment Template for the code signing project
1
Open the Venafi Configuration Console application.
2
Under the Code Signing node, select Environment Templates.
3
Select Certificate in the Actions panel under Add Single Template.
4
Enter a name for the Code Signing Environment Template and select [ Create ].
5
In the Properties window, within the Settings tab, enter a Description and select a Certificate Container and Signing Flow.
6
Go to the Certificate Authority tab and select a CA Template, and select [ Add ].
7
Go to the Keys tab and select which key sizes to allow for RSA and Elliptic Curve keys.
8
Go to the Key Storage tab and select the Futurex HSM Connector. Then, select [ Add ].
9
Enter any optional information in the remaining tabs, and select [ OK ].
d | Create a new code signing project
1
Log in to Aperture: https://[IP_address_of_Venafi_TPP]/aperture/codesign.
2
Select Projects in the main menu at the top of the page.
3
Select [ Create Project ].
4
Enter a Project Name and Description.
5
Select [ Create ].
e | Create an Environment for the project with a new HSM private key and certificate
1
Inside the newly created code signing project, go to the Environments tab and select Add Environment > Certificate & Key.
2
Enter the Environment Name.
3
Select the Environment Template that you created for this code signing project.
4
For Creation Type, select Create New. 
The Key Storage Location should now list the Futurex HSM Connector.
5
Enter any other necessary information for the certificate.
6
Select [ Save ].
7
Select [ Submit For Approval ] to generate a new certificate and private key after you approve it in the next step.
f | Approve the Project
1
Log in to Aperture: https://[IP_address_of_Venafi_TPP]/aperture/codesign.
2
Select Approvals in the main menu at the top of the page.
3
Under Pending Approvals, select the Project Creation request you just submitted.
4
Select [ Approve ]. 
You should see a message similar to Approval processed successfully.
5
Go back to the project, and on the Environments tab, make sure you see that a Certificate & Key were created in Hardware (such as the ).
﻿
﻿
Edit the Futurex PKCS #11 configuration file
View the keys and certificates that Venafi TPP created on the HSM