Integrate Delinea Secret Server with an Entrust nShield HSM

Select Windows Start > Entrust nShield Security World > CNG configuration wizard. The nShield CNG Providers Configuration Wizard appears.

Select Next twice.

Select Use the existing security world if one was created in Create a Security World.

Select Next twice.

Select the protection method. If you are using OCS protection, insert your OCS card into the proper slot and then select Next.

Example for OCS protection:

If the Machine Key Access Control window appears, select the option that best meets your security and operational requirements and specify the service account used by the Secret Server, then select Next.

For example:

If the User Key Access Control window appears, select the option that best meets your security and operational requirements and ensure that the Namespace keys to the SID of the creating user remains selected, then select Next.

For example:

Select Next and Finish.

Run certutil -csptest > <filename> on a command window.

C:\Users\Administrator.INTEROP>certutil -csptest > Documents\cryptographic-providers

Search for Provider Name: nCipher in the file created above, and make sure that it shows Pass.

Log in to the Delinea Secret Server via a browser at https://localhost/SecretServer.

From the menu in the left pane, select Settings > All settings > Configuration > General > HSM. The HSM configuration page appears.

Select Enable HSM, then select Next.

In the Enable HSM window, select as follows, then select Next.

Parameter	Value
API type	Select CNG
Persistent provider	Select nCipher Security World Key Storage Provider
Key type	Select the required value
Key size	Select the required value
Padding type	Select the required value

For example:

Check the HSM Provider Test Results, then select Next.

In the Verify HSM configuration page select Save.

In the Notice about HSM configuration change, recycle the application pool and then select Continue.

Refresh the browser. Then from the menu in the left pane, select Settings > All settings > Configuration > General > HSM. Notice the completed HSM configuration.

Log in to the Delinea Secret Server via a browser at https://localhost/SecretServer.

Copy the HSM cryptoki library (dll) for PKCS #11 to the Secret Sever application pool as shown:

C:\Users\Administrator.INTEROP>mkdir C:\inetpub\wwwroot\SecretServer\pkcs11

C:\Users\Administrator.INTEROP>copy "C:\Program Files\nCipher\nfast\toolkits\pkcs11\cknfast.dll" C:\inetpub\wwwroot\SecretServer\pkcs11\.
        1 file(s) copied.

If you are using OCS protection, insert your OCS card into the proper slot.

From the menu in the left pane, select Settings > All settings > Configuration > General > HSM. The HSM configuration page appears.

Select Enable HSM, then select Next.

In the Enable HSM window, complete the fields as follows, then select Next.

Parameter	Value
API type	Select PKCS11
Library name	Select cknfast.dll
Token label	Enter the token name
User pin	Enter the token passphrase
Key type	Select the required value
Key size	Select the required value

Example with OCS protection:

Example with module-only protection:

Check the HSM Provider Test Results, then select Next.

In the Verify HSM configuration page select Save.

In the Notice about HSM configuration change, recycle the application pool and then select Continue.

Refresh the browser. Then from the menu in the left pane, select Settings > All settings > Configuration > General > HSM. Notice the completed HSM configuration.

List the keys protected by the HSM using the nfkminfo and rocs utilities.
For example:

Notice the Key identifier in the completed HSM configuration matches the nfkminfo utility output above.