Introduction

The Entrust Cryptographic Security Platform PKI Hub is a versatile virtual appliance that streamlines deployment of the following Entrust solutions across a range of environments: Certificate Authority, CA Gateway, Certificate Enrollment Gateway, Certificate Hub, Timestamping Authority, and Validation Authority. The Entrust nShield Hardware Security Module (HSM) securely stores and manages encryption keys. This document describes how to integrate the HSM with PKI Hub to add security to your PKI.

The HSM is available as an appliance or as nShield as a Service (nSaaS). Throughout this guide, the term HSM refers to nShield Solo, nShield Connect, and nShield Edge products.

Product configuration

Entrust tested the integration with the following versions:

Product Version

Entrust Cryptographic Security Platform

v1.5

Entrust Cryptographic Security Platform PKI Hub

v1.6.0

Security World (Embedded in the product)

v13.9.0

Security World Client

v13.6.18 (LTS8) / v13.9.6 (STS6)

PostgreSQL

15.17 (Deployed on a Red Hat 9 Linux server)

VMWare vSphere

9.0

Supported nShield hardware and software versions

Entrust tested the integration with the following nShield hardware and software versions. The integration was tested using OCS protection. Module-protected keys are not supported in Entrust Certificate Authority v10.0 and later versions.

When using a FIPS 140 Level 3 Security World, you must present the OCS card in the front slot of the HSM.
Product Firmware Netimage FIPS 140 Level 3

Connect XC

13.8.5

13.9.6

No

Connect XC

12.72.4 (FIPS 140-2 certified)

13.6.18

Yes

nShield 5c

13.8.6

13.9.6

No

nShield 5c

13.4.5 (FIPS 140-3 certified)

13.6.18

Yes

Requirements

To integrate the HSM and PKI Hub, you require:

  • A dedicated virtual appliance for the installation.

  • A dedicated server for hosting a PostgreSQL database and the Entrust nShield key management data.

  • Access to the Entrust TrustedCare Portal.

Familiarize yourself with:

  • The Entrust Cryptographic Security Platform PKI Hub documentation.

  • The nShield documentation.

  • Your organizational Certificate Policy, Certificate Practice Statement, and a Security Policy or Procedure in place covering administration of the PKI and HSM:

    • The number and quorum of administrator cards in the Administrator Card Set (ACS) and the policy for managing these cards.

    • The number and quorum of operator cards in the Operator Card Set (OCS) and the policy for managing these cards.

    • The key protection method: Module, Softcard, or OCS. (Only OCS is supported).

    • The level of compliance for the Security World, FIPS 140 Level 3.

      When using a FIPS 140 Level 3 Security World, you must present the OCS card in the front slot of the HSM.

    • Key attributes such as key size and time-out are required for auditing key usage.