Introduction
The Entrust Certificate Authority is a Public-Key Infrastructure (PKI) solution. The Entrust nShield Hardware Security Module (HSM) securely stores and manages encryption keys. This document describes how to integrate them to strengthen your PKI’s security.
The Entrust nShield HSM is available as an appliance or nShield as a service (nSaaS).
Where procedures differ for post-quantum (PQ) workflows, this guide calls out the PQ-specific steps at the relevant points.
Product configuration
The integration between the Entrust nShield HSM and Entrust Certificate Authority has been successfully tested in the following configurations:
| Product | Version |
|---|---|
Entrust Certificate Authority |
v11.0.1 |
Operating System |
Windows Server 2025 |
PostgreSQL Database |
15.18.0 |
Supported nShield hardware and software versions
The integration was successfully tested with several nShield hardware and software versions.
OCS and Softcard protection were tested in all configurations. Module-protected keys are not supported in Entrust Security Manager v10.0 and later versions.
Post-quantum testing
| HSM | Security World Software | Firmware | Netimage | FIPS Level 3 |
|---|---|---|---|---|
nShield 5c |
13.9.6 (STS6) |
13.8.6 |
13.9.6 |
No |
Connect XC |
13.9.6 (STS6) |
13.8.5 |
13.9.6 |
No |
Requirements
To integrate the Entrust Certificate Authority and the Entrust nShield HSM, you need:
-
Access to the Entrust TrustedCare Portal.
-
A directory service. See SIC-Entrust Certificate Authority 10.2.pdf located in the Documents tab at Product Support Center for Authority for supported directories.
-
A dedicated server or virtual appliance for the installation.
Familiarize yourself with:
-
The Entrust Certificate Authority documentation in the Documents tab of Product Support Center for Authority.
-
The Entrust nShield Product Documentation.
-
Your organizational Certificate Policy, Certificate Practice Statement, and security policy or procedure for PKI and HSM administration:
-
The number and quorum of administrator cards in the Administrator Card Set (ACS) and the policy for managing these cards.
-
The number and quorum of operator cards in the Operator Card Set (OCS) and the policy for managing these cards.
-
The key protection methods: Module, Softcard, or OCS.
-
The level of compliance for the Security World, FIPS 140 Level 3.
-
Key attributes, such as key size, timeout, and any other attributes needed to audit key usage.
-