Introduction
Microsoft Internet Information Services (IIS) for Windows Server is a web server. Entrust nShield Hardware Security Modules (HSMs) integrate with IIS to provide key protection with FIPS-certified hardware. Integration of the nShield HSM with IIS provides the following benefits:
-
Hardware validated to the FIPS 140-2 and FIPS 140-3 standards.
-
Secure storage for IIS private keys.
Product configuration
Entrust has successfully tested the nShield HSM integration with IIS in the following configuration:
| Product | Version |
|---|---|
Operating System |
Windows 2025 Server |
IIS version |
10.0.26100.32860 |
Supported nShield hardware and software versions
Entrust successfully tested with the following nShield hardware and software versions:
| Product | Security World Software | Firmware | Netimage |
|---|---|---|---|
nShield 5c |
13.6.16 |
13.6.16 |
|
Connect XC |
13.6.16 |
13.6.16 |
Supported nShield features
Entrust has successfully tested nShield HSM integration with the following features:
| Feature | Support |
|---|---|
Module-Only key |
Yes |
OCS cards |
Yes 1 |
Softcards |
No |
nSaaS |
Yes |
1 OCS must be configured without a passphrase and with a 1/N quorum.
Requirements
-
Knowledge of your organization’s certificate practices statement and a security policy or procedure in place covering administration of the HSM.
-
Access to the Entrust TrustedCare Portal.
-
An Entrust nShield HSM.
-
A dedicated Windows server.
-
Network access on ports 9004 and 9005 for communication with the HSM.
-
Familiarize yourself with the nShield documentation, including:
-
The importance of a correct quorum for the Administrator Card Set (ACS).
-
Whether Operator Card Set (OCS) protection or Softcard protection is required.
-
-
If OCS protection is to be used, a 1-of-N quorum must be used.
-
Whether your Security World must comply with FIPS 140 Level 3 or Common Criteria standards. If using FIPS 140 Level 3, it is advisable to create an OCS for FIPS authorization. For more information see FIPS 140 Level 3 compliance.
-
Whether to instantiate the Security World as recoverable or not.