Configure KMES Series 3
This section covers the steps needed to configure TLS communication between the KMES Series 3 and the computer where you installed Java Jarsigner and the Futurex PKCS #11 library. It also includes general KMES configurations for the KMES to provide code signing and verification functionality for Java ARchive (JAR) files.
Perform the following tasks to configure TLS communication between the KMES Series 3 and the computer where you installed Jarsigner and FXPKCS11:
- Create a certificate authority.
- Generate a CSR for the System/Host API connection pair.
- Sign the System/Host API CSR.
- Export the Root CA and signed System/Host API TLS certificate.
- Load the exported TLS certificates into the System/Host API connection pair.
- Generate a signed client TLS certificate for Jarsigner/FXPKCS11.
- Allow export of certificates by using passwords.
- Export the signed Jarsigner client TLS certificate as a PKCS #12 file.
The following sections describe how to perform these tasks.
Log in to the KMES Series 3 application interface with the default Admin identities.
Go to PKI > Certificate Authorities, and select [ Add CA ] at the bottom of the page.
Enter a name for the Certificate Container, leave all other fields set to the default values, and select [ OK ].
The Certificate Container you created displays in the Certificate Authorities menu.
Right-click the Certificate Container and select Add Certificate > New Certificate.
On the Subject DN tab, set a Common Name for the certificate, such as System TLS CA Root.
On the Basic Info tab, leave the settings set th the default values.
On the V3 Extensions tab, select the Certificate Authority profile, and select [ OK ].
The root CA certificate displays now under the previously created Certificate Container.
Go to Administration > Configuration > Network Options.
In the Network Options window, go to the TLS/SSL Settings tab.
Under the System/Host API connection pair, uncheck Use Futurex certificates, and select [ Edit ] next to PKI Keys in the User Certificates section.
In the Application Public Keys window, select [ Generate ].
When warned that SSL will not be functional until new certificates are imported, select [ Yes ] if you want to continue.
In the PKI Parameters window, leave the settings set to default values and select [ OK ].
A message window shows that a PKI Key Pair is loaded in the Application Public Keys window.
Select [ Request ].
On the Subject DN tab, set a Common Name for the certificate, such as KMES.
On the V3 Extensions tab, select the TLS Server Certificate profile.
On the PKCS #10 Info tab, select a save location for the CSR, and select [ OK ].
When prompted that the certificate signing request was successfully written to the file location that was selected, select [ OK ].
Select [ OK ] again to save the Application Public Keys settings.
The main Network Options window now shows Loaded next to PKI Keys.
Go to PKI > Certificate Authorities.
Right-click the root CA certificate you created, and select Add Certificate > New Certificate.
In the file browser, find and select the CSR that you generated for the System/Host API connection pair.
After it loads, you don't need to modify any of the settings for the certificate. Select [ OK ].
The signed System/Host API certificate now shows under the root CA certificate on the Certificate Authorities page.
Right-click the root CA certificate, and select Export > Certificate(s).
Change the encoding to PEM. Select [ Browse ], specify a save location and name for the export file, and select [ Open ].
When prompted that the file was successfully written to the location that was selected, select [ OK ].
Right-click the signed System/Host API certificate and select Export > Certificate(s).
Change the encoding to PEM. Select [ Browse ], specify a save location and name for the export file, and select [ Open ].
When prompted that the file was successfully written to the location that was selected, select [ OK ].
Go to Administration > Configuration > Network Options.
In the Network Options window, go to the TLS/SSL Settings tab.
Select the System/Host API connection pair and select [ Edit ] next to Certificates in the User Certificates section.
Right-click the System/Host API SSL CA X.509 certificate container and select [ Import ].
Select [ Add ] at the bottom of the Import Certificates window.
In the file browser, find and select both the root CA certificate and signed System/Host API certificate, and select [ Open ].
When the Certificate chain appears in the window, select [ OK ] to save your changes.
In the Network Options window, the System/Host API connection pair shows Signed Loaded next to Certificates in the User Certificates section.
Select [ OK ] to save and exit the Network Options window.
Go to PKI > Certificate Authorities.
Right-click the root CA certificate and select Add Certificate > New Certificate.
On the Subject DN tab, set a Common Name for the certificate, such as Jarsigner.
Leave all fields on the Basic Info tab set to the default values.
On the V3 Extensions tab, select the TLS Client Certificate profile, and select [ OK ].
The signed Jarsigner certificate now displays under the root CA certificate.
Perform the following steps so you can export the Jarsigner client TLS certificate as a PKCS #12 file:
Go to Administration > Configuration > Options.
Select the checkbox next to the menu option Allow export of certificates using passwords.
Select [ Save ].
Go to PKI > Certificate Authorities.
Right-click the Jarsigner certificate and select Export > PKCS#12.
Select [ Set Password ], enter a password for the PKCS #12 file and select [ Save ].
In the Export Options section, select Export Selected Certificate and select [ Next ].
Specify a name for the PKCS #12 export file and select [ Open ].
A message window states that the PKCS #12 certificate export was successful.
Move this PKCS #12 file to the computer where you installed Jarsigner.
A later section shows you how to configure it in the Futurex PKCS #11 configuration file and use it for TLS communication with the KMES Series 3.
Perform the following tasks to configure the KMES Series 3 for communication with Jaesigner/FXPKCS11:
- Enable Host API commands.
- Create a Jarsigner role with the required permissions.
- Create a Jarsigner identity with the correct assigned roles.
- Create a signing approval group and give it appropriate permissions.
- Create a Jarsigner code signing certificate.
- Apply an issuance policy to the Jarsigner code signing certificate.
- Create a Jarsigner key group.
The following sections show you how to complete these tasks.
Go to Administration > Configuration > Host API Options.
Enable the following commands:
Command
Description
ECHO
Communication Test/Retrieve Version
RAFA
Enumerate issuance policies
RAGA
Retrieve issuance policy details
RAGO
Retrieve Request (Hash Signing)
RAUO
Upload Request (Hash Signing)
RKCP
Get Command Permissions
RKLN
Lookup Objects
RKLO
Login User
RKRK
Retrieve Generated Keys
TIME
Set Time
Select [ Save ] to finish.
Go to Identity Management > Roles, and select [ Add ] at the bottom of the page.
Select Application as the role Type, specify a name for the role, and set the Logins Required to 1.
On the Permissions tab, ensure that you select only the following permissions:
Permission
Additonal subpermissions (if applicable)
Certificate Authority
Export, Upload
Keys
Top-level permission only
On the Advanced tab, select only Host API for Allowed Ports.
Select [ OK ] to save and create the role.
Go to Identity Management > Identities, right-click the background, and select Add > Client Application.
On the Info tab, select Application for the storage type and specify a name for the identity.
On the Assigned Roles tab, select the role you created in the previous section.
On the Authentication tab, remove the API Key mechanism, add the password mechanism, and set a password.
Select [ OK ] to save and create the identity.
Go to PKI > Signing Workflow, and select [ Add Approval Group ] at the bottom of the page.
Set a name for the Approval Group, such as Jarsigner, and select [ OK ] to save.
Right-click the Jarsigner Approval Group and select [ Permission ].
Select the Show all roles and permissions checkbox, and grant the Jarsigner role the Use permission. Select [ OK ] to save and finish.
This section describes the following methods for issuing a code signing certificate:
- KMES CA
- External CA
Go to PKI > Certificate Authorities, and select [ Add CA ] at the bottom of the page.
In the Certificate Authority window, enter a name for the Certificate Container, such as Jarsigner. Set the owner of the field to the Jarsigner role, and select [ OK ].
The new certificate container now displays in the Certificate Authorities menu.
Right-click the Jarsigner Certificate Container and select Add Certificate > New Certificate.
On the Subject DN tab, set a Common Name for the certificate, such as Code Signing.
Go to the V3 Extensions tab, select the Code Signing Certificate profile, and select [ OK ].
The code signing certificate now displays under the Root CA certificate inside of the Jarsigner certificate container.
For this method, you must import all the external CA certificates into an empty certificate container on the KMES. Then generate a CSR, which the external CA uses to issue a code signing certificate. Finally, import the code signing certificate into the certificate container on the KMES that contains the external CA certificate.
To complete these tasks, perform the following steps:
Go to PKI > Certificate Authorities, and select [ Add CA ] at the bottom of the page.
In the Certificate Authority window, enter a name for the Certificate Container, such as Jarsigner. Set the owner field to the Jarsigner role, and select [ OK ].
The new certificate container now displays in the Certificate Authorities menu.
Right-click the Jarsigner certificate container and select Import > Certificate(s).
In the Import Certificates window, select [ Add ]. Locate and select the external CA certificates that issue the code signing certificate.
The CA certificates display in the Verified section of the Import Certificates window.
Select [ OK ] to save.
The external CA certificates now display in tree form under the Jarsigner Certificate Container.
Create a placeholder code signing certificate, from which you can generate a CSR. Right-click the lowest level CA certificate in the tree and select Add Certificate > Pending.
On the Subject DN tab, set a Common Name for the certificate, such as Code Signing.
On the V3 Extensions tab, select the Code Signing Certificate profile.
Select [ OK ].
The Code Signing placeholder certificate now displays under the external CA certificate(s).
Right-click the placeholder Code Signing certificate and select Export > Signing Request.
In the Create PKCS #10 Request window, leave all of the settings on the Subject DN tab set to the default values.
On the V3 Extensions tab, select the Code Signing Certificate profile.
In the PKCS# 10 Info tab, specify a save location for the CSR and select [ OK ].
A message window states that the certificate signing request was successfully written to the location you specified.
Send the CSR file to an external certificate authority. Using the CSR, the external CA issues a code signing certificate.
After the external CA issues the code signing certificate, copy the certificate to the storage medium configured on the KMES.
In the PKI > Certificate Authorities menu on the KMES, right-click the placeholder Code Signing certificate and select Replace > With Signed Certificate.
In the Import Certificates window, select [ Add ], and select the externally signed code signing certificate in the file browser.
The code signing certificate populates under the CA certificate(s) in the Verified section of the Import Certificates window.
Select [ OK ] to save and finish.
Go to PKI > Certificate Authorities.
Right-click the Code Signing certificate and select Issuance Policy > Add.
On the Basic Info tab, set Approvals to 0 to allow anonymous singing. Select any hashes that you want to allow. You do not need to specify an Alias.
On the X.509 tab, set the Default approval group to Jarsigner.
On the Object Signing tab, select the Allow object signing checkbox.
Select [ OK ] to apply the issuance policy to the Jarsigner code signing certificate.
Go to Key Management > Keys. In the Key Groups section, select [ Create ].
Select Symmetric for Key Type.
Select HSM Trusted for Storage Location.
Specify a name for the Key Group, such as Jarsigner.
Select Permissions and give the Jarsigner role Use permissions.
Select [ OK ] to finish creating the Jarsigner key group.