Configuring the SafeNet KSP
Install the KSP for generating the CA certificate keys on the Luna Cloud HSM Service. See To register the SafeNet Key Storage Provider for more information about configuring the SafeNet KSP. The tool KspConfig.exe is included in the Luna Client installation directory or is available in the Luna Cloud HSM Service Client.
Register the SafeNet key storage provider
-
Your system requires access to the SafeNet Key Storage Provider (KSP). Copy the SafeNetKSP.dll file from your downloaded Luna Cloud HSM Service Client to
C:\Windows\System32. Failure to copy the SafeNetKSP.dll file will result in no access to the SafeNet Key Storage Provider's during the integration. For example, if configuring Microsoft Active Directory Certificate services, the SafeNet Key Storage Providers will not be available options when setting up the Cryptography for CA. -
Navigate to the KSP installation directory. Run KspConfig.exe.
Note
The KSP client is available in the Luna Cloud HSM Service Client in the /KSP folder.
-
Double-click Register or View Security Library.
-
Click Browse. Select the cryptoki.dll file from the Luna Cloud HSM Service Client. Click Register.
-
On successful registration, a Success! message displays. Click OK.
-
Double-click Register HSM Slots.
-
Register the HSM for the Administrator user.
a. Open the Register For User drop-down menu and select Administrator.
b. Open the Domain drop-down menu and select your domain.
c. Open the Available Slots drop-down menu and select the service label.
d. Enter the Slot Password.
e. Click Register Slot.
f. On successful registration, a Success! message displays. Click OK.
-
Register the HSM for the System user.
a. Open the Register For User drop-down menu and select SYSTEM.
b. Open the Domain drop-down menu and select NT AUTHORITY.
c. Open the Available Slots drop-down menu and select the service label.
d. Enter the Slot Password.
e. Click Register Slot.
f. On successful registration, a Success! message displays. Click OK.
Note
The Luna Cloud HSM Service has been registered for both users, despite only one entry appearing for the \<slot_label> in the Registered Slots section of the KSP interface.
