apps hsm-group

Note:  Starting in release 6.14.00, Entrust/nCipher HSM integration is deprecated. Gen2 DSSL HSMs (nCipher v1.0) and Gen3 HSMs using nCipher 12.6 (`nshield_12_60`) are no longer supported, and upgrades are blocked if any nCipher HSM configuration is present.

Use the apps hsm-group command to configure an HSM group.

The apps hsm-group command has the following syntax:

apps hsm-group <alias <alias>>

type luna-hsm

comm <comment>

hsm-alias

add <HSM alias>

delete <HSM alias>

The following table describes the arguments for the apps hsm-group command:

Argument

Description

alias <alias>

Specifies an alias of the HSM group.

For example:

(config) # apps hsm-group alias hsm-set

 

Note: Only one HSM group can be configured.

type luna-hsm

Specifies the vendor type Thales-Luna HSM.

comment <comment>

Add a comment to an HSM group. Comments can be up to 128 characters. Comments longer than one word must be enclosed in double quotation marks.

For example:

(config) # apps hsm-group alias hsm-set comment "HSM group1"

hsm-alias   add <HSM alias>   delete <HSM alias>

Specifies the HSM alias to add or delete as follows:

● add—Adds an HSM to an HSM group. Multiple HSMs can be added to a group. Multiple HSMs might be needed for load balancing, failover, or redundancy.
● delete—Deletes an HSM from an HSM group.

Examples:

(config) # apps hsm-group alias hsm-set hsm-alias add hsm1

(config) # apps hsm-group alias hsm-set hsm-alias add hsm2

(config) # apps hsm-group alias hsm-set hsm-alias delete hsm1

hsm-set fetch keymap <URL>

Fetches the text file with the key mappings from the specified URL.

You must create a text file with the key mappings and upload it to a server. Enter a valid directory path including the text file name. It is recommended to use a secure protocol, such as SCP or HTTPS to access the URL.

Example of the Keymap text file format:

server-ip    key-name/key-token

20.1.1.1             rsa2048-server1-cert

20.1.1.2             key_pkcs11_uad6963c0f0c30037c707e22ed6ccf8e12014a237d

20.1.1.3             433 rsa2048-server1-cert

20.1.1.4             433 key_pkcs11_uad6963c0f0c30037c707e22ed6ccf8e12014a237d

Example:

(config) # apps hsm-group alias hsm-set fetch keymap scp://user@10.10.10.10/keymap.txt

Related Commands

The following table summarizes other commands related to the apps hsm-group command:

Task

Command

Displays Security World information.

# show apps hsm-group world

Displays SSL session statistics that are handled by HSM servers.

# show apps hsm-group session-stats

Displays HSM buffer statistics.

# show apps hsm-group buffer-stats

Displays all statistics along with their operation state.

# show apps hsm-group all

Displays operational status along with their operation state. The operational states are as follows:

● RegisterInProgress-This state indicates that the registration process of HSM-LUNA client on HSM-LUNA server is in progress.
● RegisterPending -The register-pending state indicates that the Luna client registration on HSM-LUNA server is pending.

Note: To register your clinet in Luna server, refer to Client Register - Luna Command Reference for more details.

● VerifyInProgress - This states indicates That the verification has begun after LUNA client registration.
● HAConfig- This state denotes that the prerequisite configurations are completed for HA verification and HA verifications has started/in-progress.YES means hsm configuration is correct and up.
● YES - This state denotes that the HA verification is completed successfully and the HSM configuration is functional.
● NO - The HSM configuration is not functional.
● INIT - This state denotes that the HSM Server configuration has been initialized in GigaSMART node. This also checks the communication between GigaSMART node and HSM server.
● Unknown- The HSM Group was configured prior to the Inline SSL or Passive SSL Application was configured.

# show apps hsm-group status

Displays the list of key labels available in Thales- Luna HSM group.

#show apps hsm-group keylabels

Deletes a specified HSM group.

(config) # no apps hsm-group alias hsm-set

Deletes all HSM groups.

(config) # no apps hsm-group all

Verifies if the Luna Network HSM slots/partitions are visible to the Client.

#show apps hsm-group verify

Verifies if the Luna HSM appliances are pingable.

# show apps hsm-group ping-result

Verifies the Luna HSM appliances HA statistics.

# show apps hsm-group ha

Displays HSM server information

# show apps hsm-group server