This document shows you how to configure the Futurex KMES Series 3 with Red Hat Certificate System (RHCS) using Futurex PKCS #11 libraries. For additional questions about your HSM, see the relevant user guide. 

From the Red Hat knowledge base website: Red Hat Certificate System provides a powerful security framework to manage user identities and ensure communication privacy. Handling the major functions of the identity life cycle, Red Hat Certificate System simplifies enterprise-wide deployment and adoption of a public key infrastructure (PKI).

Although each RHCS subsystem (CA, KRA, OCSP, TKS, TPS) provides a different service, all share a common architecture. For more information, refer to the following Red Hat knowledge base article: 

https://access.redhat.com/documentation/en-us/red_hat_certificate_system/9/html/planning_installation_ and_deployment_guide/sect-certificate-system-architecture-overview

This guide shows you how to perform the following tasks:

The following sections show you how to perform these tasks.

When you complete all four tasks, fully configuring the RHCS integration with the Futurex KMES Series 3., all CA subsystem keys are secured within the internal HSM of the KMES and are available to RHCS when required.

Appendix: Migrate an existing CA key from software storage to the KMES

Red Hat Certificate System (RHCS)

CHTools

Permission to call a specific international command.

International_cmd

International_cmd_license

fpe_license

PIN Processing restricts PIN processing commands when clear PIN commands are enabled.

FX_RESTRICT_PIN_PROC_license

master_key_distribution_license

BYOK

Host_card_emulation

cvv_management

Allows the HSM to use Multibanco commands.

Multibanco

Multibanco_license

Enables PIN and key printing functionality.

PIN_Key_printing

PIN_Key_printing_license

Period

Perm_check_license

Checks specific perm inside each function in combination with other restrictions based on tags

Perm_check

pin_printing

FX_Restrict_Print

FX_Restrict_Print_license

CHDirect

CHAppliance

Enables legacy POS device key injection for use in a Key Injection Facility.

Clear_Keyload

clear_keyload_license

Variable_Length_PVV

variable_length_pvv_license

host_card_emulation_license

emv_issuing_license

post_quantum_cryptography_license

clear_shared_secret_license

p2pe_and_tokenization_license

hsm_key_distribution_license

financial_processing_license

excrypt_ui_license

australian_command_set_license

general_purpose_license

clear_pin_license

format-preserving_encryption_license

emv_acquiring_license

ecc_license

key_strength_bypass_license

rsa_license

Enables Format-preserving Encryption (FPE) functionality.

Format-preserving_encryption

colon

permission_utility

comma

ampersand

exclamation_mark

binary_val

diebold

tr-34_rkl

mac_hash

Enabled by default on all Vectera Series HSMs and available as an add-on license for Excrypt Series

general_purpose

data_encrypt

mobile_payment

Supports domestic and int'l message formats for PIN translation, verification, and key management

Excrypt_ui

p2pe

Equal_sign

Enabled on all Futurex HSMs, regardless of their license or mode.

Core_license

Number_sign

utility

card_verification

authentication

key_management

RKMS3

SKI3

Ambiguous_PIN

Enables protecting a stronger key with a weaker key.

Key_Strength_Bypass

Enables payments-related commands per the AS2805 messaging standard, as defined by AusPayNet.

Australian_Command_Set

Enables the Europay Mastercard Visa (EMV) issuance command set.

EMV_Issuing

Enables Format Preserving Encryption (FPE) FF1 functionality.

FPEFF1

Enables Point-to-Point Encryption (P2PE) functionality. 

P2PE

Enabled by default on all Excrypt Series HSMs and as an add-on license for Vectera Series HSMs.

Financial_Processing

Allows the HSM to use host card emulation commands.

Host_Card_Emulation

Allows the HSM to support commands that will directly output the clear shared secret value.

Clear_Shared_Secret

Enables a host HSM to distribute allowed keys to another HSM.

HSM_key_distribution

Only required if using a Clear PIN rather than a PIN Block.

CPIN

Enables Format Preserving Encryption (FPE) functionality.

Enables Post-Quantum Cryptography (PQC) commands and functionality.

Enables commands requiring Elliptic Curve Cryptography (ECC) functionality.

Enables the Europay Mastercard Visa (EMV) acquiring command set. 

EMV_Acquiring

Enables commands requiring RSA functionality.

key_slot_index

Tilde

Asterisk

Before you start

KMES Integration Guides

KMES integration guides overview

Configure DigiCert

Configure the KMES Series 3

Request and approve certificates through the Registration Authority

DigiCert

Configure offline Root CA functionality

Futurex Offline Root CA

Fundamental components of an Issuing CA

Certificate formats, profiles, and extensions

Certificate Authority (CA) workflow

Registration Authority (RA) functionality on the KMES

Integration with third-party tools

Revocation checking mechanisms

Java Keystore

Protocols for certificate management

Futurex Online Issuing CA

Generate a CSR from a certreq policy file

Configure KMES Series 3

Associate the signed ADCS certificate and key pair

Install and configure the FXCL CNG

Install and configure AD CS

Example of AD CS operations with the KMES Series 3

Microsoft ADCS

Install  Futurex PKCS #11

Edit the Futurex PKCS #11 configuration file

Install RHCS and deploy the subsystem

Configure general KMES Series 3 settings

Configure KMES TLS communication

Configure the Adaptable CA driver

Configure Venafi TPP to use the Futurex Adaptable CA driver

Test a certificate request, approval, and issuance

Appendix: Common errors

Venafi Adaptable CA

Certificate Authority

Install Futurex PKCS #11 (FXPKCS11)

Configure Venafi TPP to integrate with the KMES Series 3

Venafi Control Plane for Machine Identities

Certificate management

Set up communication between AWS Cloud Key Management and the KMES Series 3

Create a customer-managed key in AWS KMS

AWS Cloud Key Management integration and key operations

Job status and log management with the AWS Cloud Key Management integration

Appendix: Futurex certification process

AWS BYOK

Configure Azure credentials for communication with the KMES Series 3

Configure the KMES Series 3 for Integrating with Azure

Azure Key Vault integration and key operations

Job status and log management with the Azure Key Vault BYOK integration

Azure BYOK

Set up Google Cloud External Key Manager (EKM) initially

Set up TLS and authentication on the KMES Series 3

Configure manually managed keys

Configure Google Crypto Space managed keys

Create an externally managed key in Google Cloud

Test encryption and decryption with externally managed key

Appendix: Configure Google VPC and KMS infrastructure

Google Cloud EKM (External Key Manager)

Configure Identity and Access Management

Set up the external key service for Google Workspace CSE

Validate and test the integration

Google Workspace Client-Side Encryption

Cloud key management

Install Futurex PKCS #11

Configuring the JAVA_HOME environment variable

Configure SunPKCS11 to use the Futurex PKCS #11 module

Use the jarsigner command

Java Jarsigner

Download and configure Jenkins and test the FXCL Jenkins plugin

Jenkins Code Signing

Install Futurex CNG (FXCNG)

Edit the Futurex CNG (FXCNG) configuration file

Import certificates into the Windows certificate store

Associate a private key with a certificate

Test Microsoft SignTool commands

Microsoft SignTool

Code signing

Configure the Futurex PKCS #11 library in vSEC:CMS

Create an Operator Service Key Store with HSM

Versasec vSEC:CMS

Credential management

Install and configure the OpenSSL Engine

Configure Apache HTTP Server

Apache HTTP Server

Install and configure the OpenSSL engine

Configure the Nginx Server

Nginx

Data protection