Entrust nShield and Thales-Luna Network HSM for TLS/SSL Decryption for Out-of-Band Tools(Passive)

To configure an HSM group ,add at least one HSM appliance by specifying an alias, a static IP address, and port number. Obtain the ESN and KNETI from your HSM administrator.

To access GigaSMART within GigaVUE‑FM, access a device that has been added to GigaVUE‑FM from the GigaVUE‑FM interface. GigaSMART appears in the navigation pane of the device view on supported devices. Refer to the Access GigaSMART from GigaVUE‑FM for details.

To add an HSM appliance, do the following:

1. From the device view, go to GigaSMART> Passive SSL > HSM Groups.
2. Click New.

1

Adding a New HSM Appliance

3. Enter the details in the HSM Group Alias and Description fields under the New HSM Group section.
4. Select the required vendor type from the options (Entrust-nShield or Thales-Luna) to create the respective HSM Group. By default, Entrust-nShield will be selected as the vendor type.
   
5. Under the HSM Appliances section, in the Alias field, enter a name for the HSM appliance.
6. Enter a valid IP address and Port Number.

Note:  For Thales-Luna HSM Group , the port group by default is 1792.

7. Configure the following fields for the vendor type Entrust-nShield:

a.

Enter the ESN (Electronic Serial Number) and KNETI that you obtained from the HSM administrator.

b.

Choose one of the following methods to select the required key handler file:

•

Install from URL—Enter a valid directory path including the file name and enter the password to access the server.

Note:  SCP, SFTP, HTTP, FTP, and TFTP are the supported protocols from where you can select the key handler file.

•

Install from Local Directory—Browse and select the key handler file from your local directory.

8. Configure the following fields for the vendor type Thales-Luna:

a.

Enter the valid username and password in the Server Username and Server Password fields.

b.

Enter the valid details in the Partition Label and Partition Password fields.

Click Apply.

Note:  You cannot configure multiple HSM Groups for Passive SSL with HSM solution.

1.

From the device view, go to GigaSMART > Passive SSL > HSM Groups.

2.

Select the HSM appliance you just created.

3.

Click Configure from the Actions drop down.

4.

Choose one of the following methods to install the key handler file:

o

Install from URL—Enter a valid directory path including the file name and enter the password to access the server.

Note:  SCP, SFTP, HTTP, FTP, and TFTP are the supported protocols from where you can select the key handler file.

o

Install from Local Directory—Browse and select the key handler file from your local directory.

Note:  Ensure that the file name is "world"

2

HSM-Configure Key Handler

5.

Click OK.

Note:  Configuring Key Handler is not applicable for a Thales-Luna HSM group.

Each GigaSMART card requires IP address configuration for network access. To configure IP address details:

1.

From the device view, go to GigaSMART > Passive SSL > Network Access.

2.

Select the GigaSMART appliance.

3.

Click Edit.

4.

Select IP Address from the Network Access configuration options.

Note:  For the Thales Luna HSM group, it is preferable to use a static IP address to prevent the Thales Luna registration from expiring.

Note:  If the IP address of the GigaSMART engine is changed, the GigaSMART engine needs a reboot to complete the HSM registration with the new IP address.

5.

Enter IP Address, Netmask, Gateway, DNS, MTU and VLAN parameters.

6.

Select the required management interface.

7.

Under the Ping Test section, select the GigaSMART port and enter the IP Address / Host Name and the Ping Test parameters.

3

Passive TLS/SSL Network Access - IP Configuration

8.

Click Apply.

Use Remote File System (RFS), a component in HSM to store and manage encrypted keys. The RFS helps to automate the key distribution process. You can enable RFS on the GigaVUE‑OS device using GigaVUE‑FM so that the device can access the encrypted keys stored in RFS. You can synchronize RFS with GigaVUE‑OS device to perform a bulk download of the encrypted keys.

Note:  Remote File System is not applicable for Thales-Luna HSM.

Refer to the following sections:

■

Add RFS to GigaVUE‑OS Device

■

Map Encrypted Keys with Servers

Add RFS to GigaVUE‑OS Device

To add and synchronize RFS to the GigaVUE‑OS device:

1.

From the device view, go to GigaSMART > Passive SSL > RFS-Sync .

2.

Select your HSM Group.

3.

From the RFS section, select the RFS got to Actions>Sync to automatically synchronize the RFS with the GigaVUE‑OS device.

4.

In the Sync Period field, enter the time interval for synchronization in hours.

5.

Click OK

6.

The details of the RFS, such as the IP address, sync period, last sync time, next sync time, and the total number of keys stored and managed in the RFS appears in the RFS section. Click the Show Details link next to the Total Keys column to view the key token and key name mapping for the encrypted keys stored in RFS.

You can choose to modify the fields for the RFS you have added. Select the RFS click on Actions > Edit .

Click Sync to manually synchronize the RFS and the GigaVUE‑OS device to fetch the latest encrypted keys from RFS at any point in time.

Map Encrypted Keys with Servers

A key name or a key token must be mapped to a server IP address. A total of up to 1000 key mappings is allowed per RFS. You can either manually map the keys with the servers or do a bulk key mapping using a text file. If a key mapping already exists, the new key mapping will be rejected. You must delete the existing key mapping to add the new mapping.

To map a key name or key token to a server IP address:

1.

From the device view, go to GigaSMART > Passive SSL > Key Mapping.

2.

In the Key Mapping section, click Add. The Add Key Mapping page appears.

3.

Choose one of the following types to map the keys with the server IP address:

o

Manual—Manually map the key name or key token to the server IP address. You must keep adding the key mapping one at a time.

o

From URL—Create a text file with the key mappings and upload it to a server. Enter a valid directory path including the text file name and enter the password to access the server. It is recommended to use a secure protocol, such as SCP or HTTPS to access the URL.

o

From Local Directory—Create a text file with the key mappings and save the text file in your local directory. Browse and select the text file from your local directory.

4.

Click Submit.

Refer to the section GigaSMART Group for more details on GigaSMART Group.

To configure a GigaSMART group for passive TLS/SSL:

1.

From the device view, go to GigaSMART > GigaSMART Groups.

2.

Click New.

3.

In the Alias field, enter a name for the GigaSMART group that you are creating for Passive TLS/SSL.

4.

From the Port List drop-down list, select the required port you want to associate with this group.

5.

Scroll down to the GigaSMART Parameters > Passive SSL> HSM Group section of the page, and then select the required HSM Group from the drop-down list.

4

GigaSMART Group Setup Page

6.

Click OK.

Refer to the section GSOP for more details on GigaSMART Operation.

To create a GigaSMART operation with an TLS/SSL Decryption component:

1.

From the device view, go to GigaSMART > GigaSMART Operations (GSOP) > GigaSMART Operation.

2.

Click New.

3.

In the Alias field, enter a name for the GigaSMART operation.

4.

From the GigaSMART Group drop-down list, select the GigaSMART group that you have created for passive TLS/SSL.

5.

From the GigaSMART Operations (GSOP) drop-down list, select SSL Decryption.

5

GigaSMART Operations - Setup Page

6.

Click Apply.

Before uploading keys or configuring TLS/SSL, you must create an TLS/SSL keychain password. The password is used to encrypt the private keys that you upload to the node.

Note:  When uploading TLS/SSL keys, make sure that you are not creating a duplicate key (adding same key with different key alias). Adding a duplicate key can cause errors.

To create an TLS/SSL keychain password:

1.

From the device view, go to GigaSMART > Passive SSL > Key Store.

2.

Click Keychain Password from the Actions drop down list.

6

SSL Keychain Password Setup Page

3.

In the Password field, enter a valid password. Ensure that the password meets the following specifications:

o

Password must be at least eight (8) characters in length.

o

Password must contain at least one:

o

uppercase character

o

lowercase character

o

numerical character

o

special character

4.

Click on the Auto Login check box to allow GigaVUE-OS and GigaVUE‑FM to unlock the keystore when the node reboots.

5.

Click Save.

To upload an TLS/SSL private key:

1.

From the device view, go to GigaSMART >Passive SSL > Key Store to open the Key Store page.

2.

Click Add. The SSL Key page appears.

3.

In the Alias field, enter a name for the SSL key.

4.

Select the Key Upload Type from the options PEM, PKCS12, Entrust nShield, Luna-HSM.

a.

Passphrase- SSH passphrases allows you to protect your private key from being used without the passphrase. Enter the passphrase created with the private key.

b.

Private key- Enter the Private Key using any of the following options:

•

Copy and Paste

•

Install from URL

•

Install from Local Directory

c.

Certificate- Enter the Certificate using any of the following options:

•

Copy and Paste

•

Install from URL

•

Install from Local Directory

d.

Key Label - The Key label that is imported from the HSM server. This field is applicable when you configure Thales-Luna HSM.

Note:  Ensure that Luna key labels match the correct certificate and decryption keys when using the default service in Passive SSL.

e.

Path and Password- Configure the file path and password if you select 'Install form URL', or else choose the file if you select 'Install form Local directory'. The supported protocols are HTTP, HTTPS, FTP, TFTP, SCP, and SFTP.

5.

Click Save.

After you have uploaded a private key, you can add a service. A service maps to a physical server, such as an HTTP server. One server can run multiple services. A service is a combination of an IP address and a server port number. Also, the key and the service must be tied together.

To create an TLS/SSL service:

1.

From the device view, go to GigaSMART > Passive SSL > SSL Services.

2.

Click New. The SSL Service page appears.

7

SSL Service

3.

In the Alias field, enter a name for the SSL service.

4.

Map the TLS/SSL service to a server IP address and a server port using one of the following methods:

o

Select the Enabled check box next to the Default Service field to dynamically map the server IP address and server port.

Note:  If you select the Enabled check box, the Server IP Address and Server Port fields are disabled.

o

In the Server IP Address and Server Port fields, enter an IP address and port to which you want to map the TLS/SSL service.

5.

From the SSL Key Alias drop-down list, select the name of the SSL Key previously uploaded.

6.

From the GS Group drop-down list, select the GigaSMART group with TLS/SSL decryption enabled to associate with this TLS/SSL service.

7.

Click Apply.