Configure KMES Series 3

this section starts with general {{k}} configurations that enable rhcs to integrate with the {{k}} to store various keys and certificates used in the ca subsystem operation then, it covers the steps to configure tls communication between the {{k3}} and the {{futurex}} pkcs #11 ( fxpkcs11 ) library, which rhcs uses to communicate with the {{k}} configure general kmes settings for the rhcs integration perform the following tasks to configure the {{k3}} for communication with fxpkcs #11 create an rhcs role and identity with the correct assigned permissions enable host api commands the following sections show you how to complete these tasks create a role and identity for rhcs after you create a new role on the {{k3}} , you assign it to the identity, and subsequently, the fxpkcs11 library uses the identity to connect to the {{k}} log in to the {{k3}} application interface with the default admin identities go to identity management > roles and select \[ add ] at the bottom of the page on the info tab of the role editor window, specify a name for the role, select the hardened checkbox, and set logins required to 1 on the permissions tab, enable the following permissions permission subpermission certificate authority add, upload, export cryptographic operations sign keys add on the advanced tab, set the allowed ports field to host api only select \[ ok ] to finish creating the role go to identity management > identities , right click anywhere in the window, and select add > client application change the storage to hsm and specify a name for the identity on the assigned roles tab, select the role that you created previously on the authentication tab, select \[ add ] to configure a new credential in the configure credential window, set the credential type to password , provider to futurex hsm , and mechanism to hardened password select \[ change ] and set a password for the credential, select \[ save ] , and select \[ ok ] the new password credential now displays under the api key credential that exists by default in the main identity editor window, select the api key credential, select \[ remove ] , and select \[ ok ] to save enable the host api commands because the {{futurex}} pkcs #11 library connects to the host api port on the {{k3}} , you must define which host api commands to enable for the fxpkcs11 library to use for the rhcs operation to set the enabled commands, complete the following steps go to administration > configuration > host api options and enable the following commands command description or subcommand (if applicable) atkg manipulate hsm trusted asymmetric key group add add hsm trusted asymmetric key group get retrieve hsm trusted asymmetric key group echo communication test/retrieve version rkcp get command permissions get retrieve enabled commands rkcy create certificate authority rkgp export asymmetric hsm trusted key rkgs generate signature rkic import certificate rkln lookup objects rklo login user rkpk pop generated key rkrk retrieve certificate select \[ save ] to finish configure tls communication perform the following tasks to configure tls communication between the {{k3}} and the {{futurex}} pkcs #11 ( fxpkcs11 ) library create an x 509 certificate container and root ca certificate generate a csr for the system/host api connection pair sign the system/host api csr export the root ca export the signed system/host api tls certificate load the exported certificates into the system/host api connection pair generate a tls private key and csr for the fxpkcs11 library sign the csr for the fxpkcs11 library export the signed fxpkcs11 tls certificate the following sections describe how to perform these tasks create a container and certificate perform the following steps to create an x 509 certificate container and root ca certificate go to pki > certificate authorities and select \[ add ca ] at the bottom of the page in the certificate authority window, enter a name for the certificate container, leave all other fields set to the default values, and select \[ ok ] right click the certificate container that you created and select add certificate > new certificate on the subject dn tab, select classic in the preset drop down list and set a common name for the certificate, such as system tls ca root on the basic info tab, leave all fields set to the default values on the v3 extensions tab, select certificate authority in the profile drop down list and select \[ ok ] the system tls ca root certificate now displays inside the previously created certificate container generate a csr perform the following steps to generate a csr for the system/host api connection pair go to administration > configuration > network options in the network options window, go to the tls/ssl settings tab under the system/host api connection pair, uncheck the use futurex certificates checkbox and select \[ edit ] next to pki keys in the user certificates section in the application public keys window, select \[ generate ] when warned that ssl will not be functional until new certificates are imported , select \[ yes ] to continue in the pki parameters window, leave all fields set to the default values and select \[ ok ] the application public keys window now shows that a pki key pair is loaded select \[ request ] on the subject dn tab, set a common name for the certificate, such as kmes on the basic info tab, leave all fields set to the default values on the v3 extensions tab, select tls server certificate in the profile drop down list on the pkcs #10 info tab, select \[ browse ] , select a save location for the csr, specify a name for the file, and select \[ open ] select \[ ok ] to finish generating the csr when prompted that the certificate signing request was successfully written to the file location that was selected , select \[ ok ] select \[ ok ] again to save the application public keys settings the main network options window now shows loaded next to pki keys under the system/host api connection pair select \[ ok ] sign the csr perform the following steps to sign the csr go to pki > certificate authorities right click on the system tls ca root certificate and select add certificate > from request in the file browser, select the csr that you generated for the system/host api connection pair and select \[ open ] after it loads, don't modify any certificate settings select \[ ok ] the signed kmes tls certificate now shows under the system tls ca root certificate in the certificate authorities menu export the root certificate perform the following steps to export the system tls ca root certificate go to pki > certificate authorities right click the system tls ca root certificate and select export > certificate(s) in the export certificate window, select pem in the encoding drop down list and select \[ browse ] in the file browser, go to the location where you want to save the system tls ca root certificate, specify a name for the file, and select \[ open ] select \[ ok ] a message box states that the pem file was successfully written to the location that you specified select \[ ok ] again to exit the window export the api tls certificate perform the following steps to export the signed system/host api tls certificate go to pki > certificate authorities right click the kmes certificate and select export > certificate(s) in the export certificate window, select pem in the encoding drop down list and select \[ browse ] in the file browser, go to the location where you want to save the kmes tls certificate, specify a name for the file, and select \[ open ] select \[ ok ] a message box states that the pem file was successfully written to the location that you specified select \[ ok ] again to exit the window load the certificates perform the following steps to load the exported tls certificates into the system/host api connection pair go to administration > configuration > network options in the network options window, go to the tls/ssl settings tab select \[ edit ] next to certificates in the user certificates section for the system/host api connection pair right click the system/host api ssl ca x 509 certificate container and select \[ import ] select \[ add ] at the bottom of the import certificates window in the file browser, select both the system tls ca root certificate and the signed kmes certificate, and select \[ open ] the certificate chain appears in the verified section select \[ ok ] to save the changes in the network options window, the system/host api connection pair now shows signed loaded next to certificates in the user certificates section generate a tls private key and csr perform the following steps to generate a tls private key and csr for the {{futurex}} pkcs #11 ( fxpkcs11 ) library by using openssl you must run the commands in this section from a terminal application with openssl open a terminal and run the following command to generate a tls private key for the fxpkcs11 library openssl genrsa out fxpkcs11 tls privatekey pem 2048 the command outputs the private key to fxpkcs11 tls privatekey pem in the same directory where you ran the command run the following command to generate a csr for the fxpkcs11 library openssl req new key fxpkcs11 tls privatekey pem out fxpkcs11 tls cert req pem days 365 when prompted to enter certificate information, set the default value for each field by pressing the enter key at every prompt the command outputs the csr to fxpkcs11 tls cert req pem in the same directory from where you ran the command move or copy the csr file, fxpkcs11 tls cert req pem , to the storage medium configured on the {{k}} sign the csr perform the following steps to sign the csr for the fxpkcs11 library go to pki > certificate authorities right click the system tls ca root certificate and select add certificate > from request in the file browser, select the fxpkcs11 csr, tls cert req pem certificate information populates in the create x 509 from csr window on the subject dn tab, select classic in the preset drop down list and set a common name for the certificate, such as fxpkcs11 on the basic info tab, leave fields set to the default values on the v3 extensions tab, select the tls client certificate profile and select \[ ok ] the signed fxpkcs11 certificate now displays under the system tls ca root certificate export the tls certificate perform the following steps to export the signed fxpkcs11 tls certificate go to pki > certificate authorities right click the fxpkcs11 certificate and select export > certificate(s) in the export certificate window, select pem in the encoding drop down list and select \[ browse ] in the file browser, go to the location where you want to save the fxpkcs11 tls certificate, specify a name for the file, and select \[ open ] select \[ ok ] when prompted that the pem file was successfully written to the location that you specified , select \[ ok ] again to exit the window copy the signed fxpkcs11 tls certificate and the system tls ca root certificate to the computer where you plan to run the rhcs instance the next section shows you how to configure them in the fxpkcs11 configuration file and use them for tls communication in the {{k3}}