Test the integration
Initialize Entrust Certificate Authority
If you did not initialize the Certificate Authority at the end of the configuration process:
-
Open a Windows command terminal.
-
Initialize Certificate Authority:
% cd C:\Program Files\Entrust\Certificate Authority\bin % entsh.exe -e "source \"C:\Program Files\Entrust\Certificate Authority\bin\FirstTimeInit.tcl\""
Launch the Entrust Certificate Authority Shell
To launch the Entrust Certificate Authority Shell:
-
Open a Windows command terminal.
-
Open an Entrust Shell:
% cd C:/Program Files/Entrust/Certificate Authority/bin % entsh.exe
Further commands during testing are executed inside the Entrust Shell.
Verify the in-memory CA key cache
To verify the in-memory CA key cache:
-
In the Entrust Shell:
entsh$ ca key show-cache Master User Name: Master1 Password: **** In Memory CA cache **** Record Status Legend: C = current key H = key on hold A = non-current key X = revoked or expired non-current key has been obsoleted HWV1 = hardware key PKCS11 V1 *** NOT SUPPORTED *** HWV2 = hardware key PKCS11 V2 SW = software key ---------------------------------------------------- Internal key index: 1 CA certificate issued by: ou=CAentry,dc=entrustsm,dc=local serial number: 00CA3C0FCE0615F924AD191620ED4B67E0 current CA certificate: Y CA certificate issue date: Thu Oct 10 04:14:04 2024 CA certificate expire date: Tue Oct 10 04:44:04 2034 subject key identifier: ADD12C617C66FDFFD54F080FD70CFDF4EC70CCA8 private key active: Y private key expired: N certificate expired: N certificate revoked: N revocation details: N/A key: RSA-2048 global signing policy: RSA-SHA256 (sha256WithRSAEncryption) record status in database: C HWV2 migrated: N hardware load error: N hardware CKA_ID: LOBrpuJUJRraNabR02/MTLcX5kE= hardware status: Loaded >> 'nCipher Corp. Ltd SN : edb3d45a28e5a6b2 SLOT : 761406614'. ---------------------------------------------------- **** End of In Memory CA cache ****
Verify the hardware information
To verify the hardware information:
-
In the Entrust Shell:
ou=CAentry,dc=entrustsm,dc=local.Master1 $ ca key show-cahw -type all EAC is not enabled. There is no associated cryptographic hardware for EAC. **** Hardware Information **** ---------------------------------------------------- Name: nCipher Corp. Ltd SN : b02xxxxxxxxxxxxxxxxx19e SLOT : 761406614 Has current X.509 CA key: Y Load Status: hardware loaded ok Uses Password: Y DB protection HW: N In use for X.509 CA keys: Y In use for EAC keys: N ECDSA style: 4 (use raw digest padded to large digest size) ---------------------------------------------------- Name: nCipher Corp. Ltd SN : EMPTY_SN SLOT : 761406613 Has current X.509 CA key: N Load Status: hardware loaded ok Uses Password: N DB protection HW: N In use for X.509 CA keys: N In use for EAC keys: N ECDSA style: 4 (use raw digest padded to large digest size) ---------------------------------------------------- **** End of Hardware Information ****
Import the CA key pair from software to hardware
To import the CA key pair from software to the HSM (from software to hardware):
ou=CAentry,dc=entrustsm,dc=local.Master1 $ ca key update
This prompts you to select the destination for the new CA key.
Select the nCipher slot as the destination for the new CA key. For example:
ou=CAentry,dc=entrustsm,dc=local.Master1 $ ca key update
Select the destination for the new CA key.
Choose one of:
1. Software
2. nCipher Corp. Ltd SN : EMPTY_SN SLOT : 761406613
3. nCipher Corp. Ltd SN : edb3d45a28e5a6b2 SLOT : 761406614
4. Cancel operation
> 3
If the cluster is running it will be stopped and the CA key updated.
Do you wish to continue (y/n) ? [y] y
Checking cluster status...
Stopping cluster...
100% complete. Estimated time remaining -:-:- \
CA key and certificate successfully updated.
Recovering CA profile...
Starting cluster...
CA profile successfully recovered.
It is recommended that all revocation lists be re-issued. This can be done later with the 'rl issue' command. Re-issue revocation lists
now (y/n) ? [y] y
Issuing CRLs, please wait ...
1 CRL(s) were issued.
1 ARL(s) were issued.
1 combined CRL(s) were issued.
Publishing CRLs, please wait ...
After you have moved the CA key to the HSM and have finished updating it, a message about the CA profile being successfully recovered appears.
Export the CA key pair from hardware to software
To export the Entrust CA key pair from the HSM to software (from hardware to software), use the Entrust Shell:
ou=CAentry,dc=entrustsm,dc=local.Master1 $ ca key update
Select the destination for the new CA key.
Choose one of:
1. Software
2. nCipher Corp. Ltd SN : EMPTY_SN SLOT : 761406613
3. nCipher Corp. Ltd SN : edb3d45a28e5a6b2 SLOT : 761406614
4. Cancel operation
> 1
If the cluster is running it will be stopped and the CA key updated.
Do you wish to continue (y/n) ? [y] y
Checking cluster status...
Stopping cluster...
100% complete. Estimated time remaining -:-:- -
CA key and certificate successfully updated.
Recovering CA profile...
Starting cluster...
CA profile successfully recovered.
It is recommended that all revocation lists be re-issued. This can be done later with the 'rl issue' command. Re-issue revocation lists now (y/n) ? [y] y
Issuing CRLs, please wait ...
1 CRL(s) were issued.
1 ARL(s) were issued.
1 combined CRL(s) were issued.
Publishing CRLs, please wait ...
After you have finished updating the CA key, its export to software is complete.
Back up Security World files
To back up Security World files:
-
Back up the
C:\ProgramData\nCipher\Key Management Data\local
directory.Such a backup of Security World files must be performed after any new key generation or Security World administration activities.
-
Store the backup files according to your organization’s disaster recovery instructions.