Integrate the Entrust nShield HSM with the Idira ISP

Update dbparm.ini per the HSM

  1. Sign in to the Vault Server using an account with administrator privileges.

  2. Stop the Vault Server by selecting the Stop Server icon in the Server Central Administration window.

  3. In the Shutdown Server pop-up window, select Normal shutdown.

  4. Open C:\Program Files (x86)\PrivateArk\Server\Conf\dbparm.ini in a text editor.

  5. Add the following directive pair for each HSM to the end of the [MAIN] section.
    This tells the Vault Server to create firewall rules for this IP/port combination.

    AllowNonStandardFWAddresses=[HSM_IP_ADDRESS],Yes,9004:outbound/tcp
AllowNonStandardFWAddresses=[HSM_IP_ADDRESS],Yes,9005:outbound/tcp

    For example:

    ...
TerminateOnDBErrorCodes=2003
MinSupportedClientVersion=11.5.0.0
MaxConcurrentUsersByClientID=6000(APPProv),10(Synchrnzr),1(CCP),1(DAP)
AllowNonStandardFWAddresses=[xxx.xxx.xxx.xxx],Yes,9004:outbound/tcp
AllowNonStandardFWAddresses=[xxx.xxx.xxx.xxx],Yes,9005:outbound/tcp
AllowNonStandardFWAddresses=[xxx.xxx.xxx.xxx],Yes,9004:outbound/tcp
AllowNonStandardFWAddresses=[xxx.xxx.xxx.xxx],Yes,9005:outbound/tcp
[BACKUP]
BackupKey=C:\keys\Backup.key
[CRYPTO]
...

  6. Append the path of the PKCS #11 provider library for the Entrust nShield HSM.

    [HSM]
PKCS11ProviderPath="C:\Program Files\nCipher\nfast\toolkits\pkcs11\cknfast.dll"

  7. Save and close the file.

Configure the Vault Server for OCS key protection

If you are using module-protected keys, skip this section and proceed to Generate the Vault Server key on the HSM.

  1. Open a command prompt with administrator privileges and navigate to the following directory:

    cd "C:\Program Files (x86)\PrivateArk\Server"

  2. Run CAVaultManager as follows, providing the OCS passphrase.

    .\CAVaultManager SecureSecretFiles /SecretType HSM /Secret "<OCS passphrase>"

    For example:

    C:\Program Files (x86)\PrivateArk\Server>.\CAVaultManager SecureSecretFiles /SecretType HSM /Secret "xxxxxxxx"
ITADB518W MaxConcurrentUsersByClientID activated in dbparm.ini.
ITADB399I Using encryption algorithms: Advanced Encryption Standard (AES), 256 bit, RSA (2048 bit), SHA2-512 (Protocol Integrity), SHA2-512 (Files Integrity).
CAVLT146I HSM secret was secured successfully.

    This command does not validate the passphrase against the OCS card. It only encrypts the passphrase and stores it in dbparm.ini.

    To validate the passphrase against the OCS card, run the nShield utility cardpp -m1 --check and enter the passphrase when prompted.

  3. Use the type command to display the C:\Program Files (x86)\PrivateArk\Server\Conf\dbparm.ini file contents. Verify that the line HSMPinCode=<encrypted OCS passphrase> appears towards the end.

    For example:

    >type "C:\Program Files (x86)\PrivateArk\Server\Conf\dbparm.ini"
...
[HSM]
PKCS11ProviderPath="C:\Program Files\nCipher\nfast\toolkits\pkcs11\cknfast.dll"
HSMPinCode=0F0C6B6D5CC378F95A3256068F690451DF279C3924F3BFC20AD6CCA7CF7FC30498DC3EA7D72E31AD02463E492DCA8655

Generate the Vault Server key on the HSM

If you are using a FIPS 140 Level 3 Security World, ensure that an OCS card is inserted into an available HSM slot to provide FIPS authorization before executing the following commands. An ACS cannot be used for FIPS authorization with this application.

If you are using module protection for the Vault Server key in a FIPS 140 Level 3 Security World, you must still create and use an OCS for FIPS authorization, even though it will not be used for key protection.

If load sharing is enabled across multiple HSMs while using module protection, insert an OCS card into each HSM participating in the Security World. The OCS quorum must be configured as 1/N.

  1. Open a command prompt with administrator privileges and navigate to the following directory:

    cd "C:\Program Files (x86)\PrivateArk\Server"

  2. Depending on your needs, follow the steps in the relevant section:

An Entrust nShield HSM configured with a FIPS 140 Level 3 Security World does not permit the import of existing keys. For enhanced security, Entrust recommends generating and protecting keys within the nShield HSM. Using an Entrust nShield HSM provides assurance that keys generated by the HSM remain protected from disclosure.

Generate a new Vault Server key on the HSM

  • To generate a new key using module protection or an OCS with a 1-of-N quorum (K=1), run the CAVaultManager command:

    C:\Program Files (x86)\PrivateArk\Server> .\CAVaultManager GenerateKeyonHSM /ServerKey
ITADB518W MaxConcurrentUsersByClientID activated in dbparm.ini.
ITADB399I Using encryption algorithms: Advanced Encryption Standard (AES), 256 bit, RSA (2048 bit), SHA2-512 (Protocol Integrity), SHA2-512 (Files Integrity).
ITAFW052I Firewall is open for non standard address.
ITAFW052I Firewall is open for non standard address.
...
ITAFW052I Firewall is open for non standard address.
ITAFW052I Firewall is open for non standard address.
ITADM114I Successfully connected to Database, Database id 0.
CAVLT187I Server Key was successfully generated on HSM device (KeyID=HSM#1).

  • To generate a new key using an OCS with a K-of-N quorum where K > 1, start the preload utility before running the CAVaultManager command:

    > preload -m <module number> -f "<preload FilePath>" --cardset-name=<OCS Cardset-Name> CAVaultManager GenerateKeyonHSM /ServerKey

    Example:

    > preload -m 1 -f "C:\ProgramData\nCipher\nfast-nfkm-tokensfile" --cardset-name=testOCS CAVaultManager GenerateKeyonHSM /ServerKey

2025-09-12 09:50:54: [4292]: INFO: Preload running with: -m 1 -f C:\ProgramData\nCipher\nfast-nfkm-tokensfile --cardset-name=testOCS2 CAVaultManager GenerateKeyonHSM /ServerKey
2025-09-12 09:50:55: [4292]: INFO: Created a (new) connection to Hardserver
2025-09-12 09:50:55: [4292]: INFO: Modules newly usable: [1].
2025-09-12 09:50:55: [4292]: INFO: Found a change in the system: an update pass is needed.
2025-09-12 09:50:55: [4292]: INFO: Loading cardset: testOCS2 in modules: [1]

Loading `testOCS2':
 Module 1 slot 2: `testOCS2' #1
 Module 1 slot 0: empty
 Module 1 slot 3: empty
 Module 1 slot 4: empty
 Module 1 slot 5: empty
 Module 1 slot 2:- passphrase supplied - reading card
 Module 1 slot 2: `testOCS2' #1: already read
 Module 1 slot 2: empty
 Module 1 slot 2: `testOCS2' #2
 Module 1 slot 2:- passphrase supplied - reading card
Card reading complete.

2025-09-12 09:51:32: [4292]: INFO: Stored Admin key: kfips (003e...) in module #1
2025-09-12 09:51:32: [4292]: INFO: Loading cardset: Cardset: testOCS2 (f0b9...) in module: 1
2025-09-12 09:51:32: [4292]: INFO: Stored Cardset: testOCS2 (f0b9...) in module #1
2025-09-12 09:51:32: [4292]: INFO: Maintaining the cardset testOCS2 protected key(s)=[].
2025-09-12 09:51:32: [4292]: INFO: Loading complete. Executing subprocess CAVaultManager GenerateKeyonHSM /ServerKey
ITADB518W MaxConcurrentUsersByClientID activated in dbparm.ini.
ITADB399I Using encryption algorithms: Advanced Encryption Standard (AES), 256 bit, RSA (2048 bit), SHA2-512 (Protocol Integrity), SHA2-512 (Files Integrity).
ITADM114I Successfully connected to Database, Database id 0.
CAVLT187I Server Key was successfully generated on HSM device (KeyID=HSM#1).
Note the Key ID, KeyID=HSM#1, at the end of the command output.

After you have generated a new key, verify it according to the procedure in Verify the Vault Server key.

Load an existing Vault Server key to the HSM

If you must use an existing Vault Server key:

  1. Open C:\Program Files\nCipher\nfast\cknfastrc in a text editor and append the following line, then save and close the file.

    CKNFAST_OVERRIDE_SECURITY_ASSURANCES=wrapping_crypt

  2. Load the software key:

    • To load an existing software key using module protection or an OCS with a 1-of-N quorum (K=1), run the CAVaultManager command:

      > .\CAVaultManager LoadServerKeyToHSM /WrapKey

      Example:

      C:\Program Files (x86)\PrivateArk\Server> .\CAVaultManager LoadServerKeyToHSM /WrapKey

ITADB518W MaxConcurrentUsersByClientID activated in dbparm.ini.
ITADB399I Using encryption algorithms: Advanced Encryption Standard (AES), 256 bit, RSA (2048 bit), SHA2-512 (Protocol Integrity), SHA2-512 (Files Integrity).
ITADM114I Successfully connected to Database, Database id 0.
CAVLT143I Server Key was successfully uploaded to HSM device

    • To load an existing software key using an OCS with a K-of-N quorum where K > 1, start the preload utility before running the CAVaultManager command:

      > preload -m <module number> -f "<preload FilePath>" --cardset-name=<OCS Cardset-Name> CAVaultManager LoadServerKeyToHSM /WrapKey

  3. Open C:\Program Files (x86)\PrivateArk\Server\Conf\dbparm.ini in a text editor and update ServerKey to reference the new uploaded key, then save and close the file.

    From:

    ServerKey=C:\keys\Server.key

    To:

    ServerKey=HSM

Verify the Vault Server key

Verify the newly generated or loaded key by running one of the following utilities. Note that the key is a PKCS #11 key named CyberArk Server Key.

  • To verify the key using the rocs utility:

    C:\Program Files (x86)\PrivateArk\Server>rocs
`rocs' key recovery tool
Useful commands: `help', `help intro', `quit'.
rocs> list keys
  No. Name                     App        Protected by
    1 Cyber-Ark Server Key     pkcs11     testOCS
rocs> exit

  • To verify the key using the nfkminfo utility:

    C:\Program Files (x86)\PrivateArk\Server>nfkminfo -l

Keys protected by cardsets:
 key_pkcs11_ucedb3d45a28e5a6b22b033684ce589d9e198272c2-92c66522d74cce447056ca72f3a048927e31c778 `Cyber-Ark Server Key'

    • When using OCS protection, the key is listed under Keys protected by cardsets:.

    • When using module protection, the key is listed under Keys with module protection:.

Update dbparm.ini to reference the recovery private key

Idira IPS recommends storing the recovery private key on removable media. The path to the removable media is defined by the RecoveryPrvKey parameter in the [MAIN] section of C:\Program Files (x86)\PrivateArk\Server\Conf\dbparm.ini.

For the purposes of this integration, the recovery private key is stored locally in the default installation directory C:\keys\.

Open C:\Program Files (x86)\PrivateArk\Server\Conf\dbparm.ini in a text editor and update RecoveryPrvKey as follows. Then save and close the file.

From:

RecoveryPrvKey=D:\RecPrv.key

To:

RecoveryPrvKey=C:\keys\RecPrv.key

Wrap the Vault Server keys with the HSM key

  1. Back up the Vault Server keys.
    The default location, C:\keys, is used in this example. If you back up the keys to a different location, use that path instead in the commands in this procedure.

  2. Open a command prompt with administrator privileges and navigate to the following directory:

    cd "C:\Program Files (x86)\PrivateArk\Server"

  3. If using OCS protected keys, present the OCS card to the HSM and enter the OCS passphrase when prompted.

  4. Run one of the following commands as required.
    The HSM key is HSM#1, as generated in the examples in Generate a new Vault Server key on the HSM.

    • For a module-protected key, or for OCS protected keys with K=1:

      > .\ChangeServerKeys C:\keys C:\keys\VaultEmergency.pass HSM#1

      Example:

      C:\Program Files (x86)\PrivateArk\Server>.\ChangeServerKeys C:\keys C:\keys\VaultEmergency.pass HSM#1
17/09/2026 15:31:48 CHSRVK041I ChangeServerKeys process started.
ITADB518W MaxConcurrentUsersByClientID activated in dbparm.ini.
ITADB399I Using encryption algorithms: Advanced Encryption Standard (AES), 256 bit, RSA (2048 bit), SHA2-512 (Protocol Integrity), SHA2-512 (Files Integrity).
ITAFW051W Error open firewall for non standard address. Code: 4, -1.
ITADM114I Successfully connected to Database, Database id 0.
ITAQS031I Object cache is loaded.
HSM generation 1 was chosen, are you sure you want to change server keys to HSM (y/n)?
y
Verify that the current master key is at C:\keys\RecPrv.key, and press any key.
Verify new server's master key is at C:\keys, and press any key.

17/09/2026 15:32:44 CHSRVK043I Signing entropy file C:\PrivateArk\Safes\entropy.rnd with new keys.
17/09/2026 15:32:44 CHSRVK034I Encrypting server private key.
...
17/09/2026 15:32:51 CHSRVK020I Keys of Safe AccountsFeedDiscoveryLogs changed successfully.
17/09/2026 15:32:51 CHSRVK054I ChangeServerKeys process was successful. DBParm.ini must be updated to point to new keys for Vault Server to start.

Do you want to update DBParm.ini with the new  keys location? Enter "NO" to quit or "YES" for update:
YES
17/09/2026 15:33:00 CHSRVK087I DBParm.ini file was successfully updated.
17/09/2026 15:33:00 CHSRVK042I ChangeServerKeys process ended.

    • For OCS protected keys with K>1, start the preload utility first:

      > preload -m <module number> -f "<preload FilePath>" --cardset-name=<OCS Cardset-Name> ChangeServerKeys C:\keys C:\keys\VaultEmergency.pass HSM#1

  5. Verify that the following files in C:\keys\ were updated during this process:

    • Backup.key

    • ReplicationUser.pass

    • Server.pvk

    • VaultEmergency.pass

    • VaultUser.pass

Update dbparm.ini to use the new HSM key

After the Vault Server keys have been wrapped with the HSM key HSM#1, update C:\Program Files (x86)\PrivateArk\Server\Conf\dbparm.ini to reference the new key:

  1. Open C:\Program Files (x86)\PrivateArk\Server\Conf\dbparm.ini in a text editor.

  2. Update ServerKey to reference the new HSM#1 key, then save and close the file.

    ServerKey=HSM#1
    If an existing Vault Server key was loaded into the HSM as described in Load an existing Vault Server key to the HSM, rather than generating a new HSM key as described in Generate a new Vault Server key on the HSM, set ServerKey=HSM instead of HSM#1.

Start the Vault Server

  1. If using OCS protection, present the OCS card to an available HSM slot. For OCS protected keys with K>1, start the preload utility.

    > preload -m <module number> -f "<preload FilePath>" --cardset-name=<OCS Cardset-Name> pause

  2. Open the PrivateArk Server application and start the server.

  3. Verify the server starts successfully with no reported errors.

  4. Open Windows Event Viewer and verify that a client connection to the HSM was established to access the key.

    For example, under applications:

    2026-09-17 16:50:28 t7524: Hardserver [FP]: Notice: CreateClient (v1) pid: 7952, process name: C:\Program Files (x86)\PrivateArk\Server\dbmain.exe

  5. On the Components Server, open a web browser and navigate to the Password Vault Web Access (PVWA) URL and verify that you can successfully sign in.