Red Hat CERTIFICATE SYSTEM 7.3 - ADMINISTRATION, Administration Manual

Page: 41 / 554

PKCS #11
19
cryptographic token interfaces. Red Hat uses NSS to support these features in a wide range
of products, including Certificate System. NSS documentation is available on-line at
http://
www.mozilla.org/projects/security/pki/nss/overview.html
.
1.4.6. PKCS #11
Public-Key Cryptography Standard (PKCS) #11 specifies an API used to communicate with devices
that hold cryptographic information and perform cryptographic operations. Because it supports PKCS
#11, Certificate System is compatible with a wide range of hardware and software devices.
At least one PKCS #11 module must be available to any Certificate System subsystem instance.
As shown in
Figure 1.4, “Certificate System Architecture”
, a PKCS #11 module (also called a
cryptographic module or cryptographic service provider) manages cryptographic services such as
encryption and decryption. PKCS #11 modules are analogous to drivers for cryptographic devices that
can be implemented in either hardware or software. Red Hat provides a built-in PKCS #11 module with
the Certificate System.
A PKCS #11 module always has one or more slots which can be implemented as physical hardware
slots in a physical reader such as smart cards or as conceptual slots in software. Each slot for a
PKCS #11 module can in turn contain a token, which is the hardware or software device that actually
provides cryptographic services and optionally stores certificates and keys.
Two cryptographics modules are included in the Certificate System:
• The default internal PKCS #11 module, which comes with two tokens:
• The internal crypto services token, which performs all cryptographic operations such as
encryption, decryption, and hashing.
• The internal key storage token ("Certificate DB token" in
Figure 1.4, “Certificate System
Architecture”
), which handles all communication with the certificate and key database files that
store certificates and keys.
• The FIPS 140-1 module. This module complies with the FIPS 140-1 government standard for
cryptographic module implementations. The FIPS 140-1 module includes a single, built-in FIPS
140-1 certificate database token (as shown in
Figure 1.4, “Certificate System Architecture”
), which
handles both cryptographic operations and communication with the certificate and key database
files.
Any PKCS #11 module can be used with the Certificate System. The server uses a file called
secmod.db
to track modules that are available. This file can be modified using the
modutil
tool. This file needs to be modified when there are changes to the system like installing hardware
accelerators to use for signing operations. For more information on
modutil
, see
http://
www.mozilla.org/projects/security/pki/nss/tools/
.
1.4.7. Management Tools
The following command-line tools are provided with the Certificate System to help manage the system:
• Audit log signature verification tool (
AuditVerify
)
• Enrollment PIN generation tool (
setpin
)
• Mass revocation tool (
revoker
)
• (Signed) Certificate System request tool