Entrust nShield HSM for TLS/SSL Decryption for Out-of-Band Tools

Add at least one HSM appliance by specifying an alias, a static IP address, and port number. Obtain the ESN and KNETI from your HSM administrator.

To access GigaSMART within GigaVUE‑FM, access a device that has been added to GigaVUE‑FM from the GigaVUE‑FM interface. GigaSMART appears in the navigation pane of the device view on supported devices. Refer to the Access GigaSMART from GigaVUE‑FM for details.

To add an HSM appliance, do the following:

1. From the device view, go to GigaSMART> Passive SSL > HSM Groups.
2. Click New.

1

Adding a New HSM Appliance

3. Enter the details in the HSM Group Alias and Description fields under the New HSM Group section.
4. By default, nTrust-nCipher will be selected as the vendor type.
   
5. Under the HSM Appliances section, in the Alias field, enter a name for the HSM appliance.
6. Enter a valid IP address and Port Number.
7. Enter the ESN (Electronic Serial Number) and KNETI that you obtained from the HSM administrator.
8. Choose one of the following methods to select the required key handler file:
   • Install from URL—Enter a valid directory path including the file name and enter the password to access the server.

   Note:  SCP, SFTP, HTTP, FTP, and TFTP are the supported protocols from where you can select the key handler file.

   • Install from Local Directory—Browse and select the key handler file from your local directory.
9. Click Apply.

1.

From the device view, go to GigaSMART > Passive SSL > HSM Groups.

2.

Select the HSM appliance you just created.

3.

Click Configure from the Actions drop down.

4.

Choose one of the following methods to install the key handler file:

o

Install from URL—Enter a valid directory path including the file name and enter the password to access the server.

Note:  SCP, SFTP, HTTP, FTP, and TFTP are the supported protocols from where you can select the key handler file.

o

Install from Local Directory—Browse and select the key handler file from your local directory.

Note:  Ensure that the file name is "world"

2

HSM-Configure Key Handler

5.

Click OK.

Each GigaSMART card requires IP address configuration for network access. To configure IP address details:

1.

From the device view, go to GigaSMART > Passive SSL > Network Access.

2.

Select the GigaSMART appliance.

3.

Click Edit.

4.

Select IP Address from the Network Access configuration options.

5.

Enter IP Address, Netmask, Gateway, DNS, MTU and VLAN parameters.

6.

Select the required management interface.

7.

Under the Ping Test section, select the GigaSMART port and enter the Ip Address / Host Name and the Ping Test parameters.

3

Passive TLS/SSL Network Access - IP Configuration

8.

Click Apply.

Use Remote File System (RFS), a component in HSM to store and manage encrypted keys. The RFS helps to automate the key distribution process. You can enable RFS on the GigaVUE‑OS device using GigaVUE‑FM so that the device can access the encrypted keys stored in RFS. You can synchronize RFS with GigaVUE‑OS device to perform a bulk download of the encrypted keys.

Refer to the following sections:

■

Add RFS to GigaVUE‑OS Device

■

Map Encrypted Keys with Servers

Add RFS to GigaVUE‑OS Device

To add and synchronize RFS to the GigaVUE‑OS device:

1.

From the device view, go to GigaSMART > Passive SSL > Key Mapping.

2.

In the RFS section, click New. The Add RFS page appears.

3.

Enter the IP address of the RFS where the encrypted keys are stored.

4.

Select the Enable check box next to the Automatic Sync field to automatically synchronize the RFS with the GigaVUE‑OS device.

5.

In the Sync Period field, enter the time interval for synchronization in hours.

6.

Click OK.

The details of the RFS, such as the IP address, sync period, last sync time, next sync time, and the total number of keys stored and managed in the RFS appears in the RFS section. Click the Show Details link next to the Total Keys column to view the key token and key name mapping for the encrypted keys stored in RFS.

You can choose to modify the Sync Period and Automatic Sync fields for the RFS you have added. Click the server IP address to open the RFS quick view, and then click Edit.

Click Sync to manually synchronize the RFS and the GigaVUE‑OS device to fetch the latest encrypted keys from RFS at any point in time.

Map Encrypted Keys with Servers

A key name or a key token must be mapped to a server IP address. A total of up to 1000 key mappings is allowed per RFS. You can either manually map the keys with the servers or do a bulk key mapping using a text file. If a key mapping already exists, the new key mapping will be rejected. You must delete the existing key mapping to add the new mapping.

To map a key name or key token to a server IP address:

1.

From the device view, go to GigaSMART > Passive SSL > Key Mapping.

2.

In the Key Mapping section, click Add. The Add Key Mapping page appears.

3.

Choose one of the following type to map the keys with the server IP address:

o

Manual—Manually map the key name or key token to the server IP address. You must keep adding the key mapping one at a time.

o

From URL—Create a text file with the key mappings and upload it to a server. Enter a valid directory path including the text file name and enter the password to access the server. It is recommended to use a secure protocol, such as SCP or HTTPS to access the URL.

o

From Local Directory—Create a text file with the key mappings and save the text file in your local directory. Browse and select the text file from your local directory.

4.

Click Submit.

Refer to the section GigaSMART Group for more details on GigaSMART Group.

To configure a GigaSMART group for passive TLS/SSL:

1.

From the device view, go to GigaSMART > GigaSMART Groups.

2.

Click New.

3.

In the Alias field, enter a name for the GigaSMART group that you are creating for Passive TLS/SSL.

4.

From the Port List drop-down list, select the required port you want to associate with this group.

5.

Scroll down to the GigaSMART Parameters > Passive SSL> HSM Group section of the page, and then select the required HSM Group from the drop-down list.

4

GigaSMART Group Setup Page

6.

Click OK.

Refer to the section GSOP for more details on GigaSMART Operation.

To create a GigaSMART operation with an TLS/SSL Decryption component:

1.

From the device view, go to GigaSMART > GigaSMART Operations (GSOP) > GigaSMART Operation.

2.

Click New.

3.

In the Alias field, enter a name for the GigaSMART operation.

4.

From the GigaSMART Group drop-down list, select the GigaSMART group that you have created for passive TLS/SSL.

5.

From the GigaSMART Operations (GSOP) drop-down list, select SSL Decryption.

5

GigaSMART Operations - Setup Page

6.

Click Apply.

Before uploading keys or configuring TLS/SSL, you must create an TLS/SSL keychain password. The password is used to encrypt the private keys that you upload to the node.

Note:  When uploading TLS/SSL keys, make sure that you are not creating a duplicate key (adding same key with different key alias). Adding a duplicate key can cause errors.

To create an TLS/SSL keychain password:

1.

From the device view, go to GigaSMART > Passive SSL > Key Store.

2.

Click Keychain Password from the Actions drop down list.

6

SSL Keychain Password Setup Page

3.

In the Password field, enter a valid password. Ensure that the password meets the following specifications:

o

Password must be at least eight (8) characters in length.

o

Password must contain at least one:

o

uppercase character

o

lowercase character

o

numerical character

o

special character

4.

Click on the Auto Login check box to allow GigaVUE to unlock the keystore when the node reboots.

5.

Click Save.

To upload an TLS/SSL private key:

1.

From the device view, go to GigaSMART >Passive SSL > Key Store to open the Key Store page.

2.

Click Install. The SSL Key page appears.

7

SSL Key Page

3.

In the Alias field, enter a name for the SSL key.

4.

Select the Key Upload Type as Private Key. Ensure that the key token is in PKCS11 format.

5.

Choose the file. The URL can be downloaded using HTTP, HTTPS, FTP, TFTP, SCP, and SFTP. It is recommended to use a secure protocol, such as HTTPS.

6.

Click Save.

After you have uploaded a private key, you can add a service. A service maps to a physical server, such as an HTTP server. One server can run multiple services. A service is a combination of an IP address and a server port number. Also, the key and the service must be tied together.

To create an TLS/SSL service:

1.

From the device view, go to GigaSMART > Passive SSL > SSL Services.

2.

Click New. The SSL Service page appears.

8

SSL Service

3.

In the Alias field, enter a name for the SSL service.

4.

Map the TLS/SSL service to a server IP address and a server port using one of the following methods:

o

Select the Enabled check box next to the Default Service field to dynamically map the server IP address and server port.

Note:  If you select the Enabled check box, the Server IP Address and Server Port fields are disabled.

o

In the Server IP Address and Server Port fields, enter an IP address and port to which you want to map the TLS/SSL service.

5.

From the SSL Key Alias drop-down list, select the name of the SSL Key previously uploaded.

6.

From the GS Group drop-down list, select the GigaSMART group with TLS/SSL decryption enabled to associate with this TLS/SSL service.

7.

Click Apply.