Hardware Security Module
The
ctcert
tool provided with SafeNet software is used to apply the required configuration to the HSM for Secure
Auditing. See the
ProtectToolkit C Administration Guide
supplied with the HSM for more details and further
options for
ctcert
.
To enable Secure Auditing on the HSM, the Master Audit keypair must be created. Use
ctcert
to create the Master
Audit Keypair and then export the public certificate from the device. A Master Audit Keypair requires an attributes
file. This file contains details of the issuer, subject, and key usage for this certificate. The minimum key usage
required is
keyusage { digitalSignature, nonRepudiation }
The following is an example of the contents of an attributes file.
label { MasterAuditCertificate }
serialnumber { 1234 }
issuer {
CN=MasterAudit,
OU=Identikey,
O=VASCO,
C=US
}
subject {
CN=MasterAudit,
OU=Identikey,
O=VASCO,
C=US
}
keyusage {
digitalSignature,
nonRepudiation,
keyCertSign
}
13.1.6.1 Create the Master Audit Keypair certificate
After configuring an attributes file, perform the following steps in order to create a Master Audit keypair certificate
for the HSM:
1.
Generate the self signed certificate using the
ctcert
tool. A sample of the
ctcert
command is :
IDENTIKEY Appliance Installation and Maintenance
106
