Microsoft IIS

Set up Luna HSM

Install Microsoft IIS

Ensure that the HSM is set up, initialized, provisioned, and ready for deployment. For more information, refer to Luna HSM documentation.

Create a partition that will be later on used by Microsoft IIS.

Create and exchange certificate between the Luna Network HSM and client system. Register client and assign partition to create an NTLS connection.

Initialize Crypto Officer and Crypto User roles for the registered partition.

Run the following command to verify that the partition has been successfully registered and configured:

C:\Program Files\SafeNet\LunaClient>lunacm.exe

Upon successful execution, you should observe an output similar to the example provided below:

lunacm.exe (64-bit) v7.3.0-165. Copyright (c) 2018 SafeNet. All rights reserved. 
Available HSMs:
Slot Id ->                           1
Label ->                             part1
Serial Number ->                     1238696044953
Model ->                             LunaSA 7.3.0
Firmware Version ->                  7.3.0
Configuration ->                     Luna User Partition With SO (PW) Key Export With Cloning Mode
Slot Description ->                  Net Token Slot

Refer to Luna HSM documentation for detailed steps on creating NTLS connection, initializing the partitions, and assigning various user roles.

To ensure the correct configuration of a PED-based Luna HSM, make sure that the ProtectedAuthenticationPathFlagStatus is set to 1 within the Misc section of the Chrystoki.conf file.

Open the configuration file for your Luna HSM.

Look for the [Misc] section within the configuration file.

Add or modify the following setting within the [Misc] section:

RSAKeyGenMechRemap=1

This setting instructs the Luna HSM to redirect older key generation mechanisms to the newly approved mechanism when the HSM is operating in FIPS mode.

Transfer the downloaded .zip file to your client workstation using pscp, scp, or other secure means

Extract the .zip file into a directory on your client workstation.

Extract or untar the appropriate client package for your operating system. Do not extract to a new subdirectory; place the files in the client install directory.

cvclient-min.zip

Run the setenv script to generate a new configuration file with the necessary information for the Luna Cloud HSM service. Right-click setenv.cmd and select Run as Administrator.

To add the configuration to an already installed UC client, use the –addcloudhsm option when running the setenv script.

Run the LunaCM utility and verify that the Cloud HSM service is listed.

Open Server Manager.

Click Configure this local server, and then select Add roles and features.

Choose Web Server (IIS).

Select the default or desired components within the wizard and complete the installation.

Install KSP Package.

• For Luna HSM integration, install the KSP package as part of the Luna Client software installation.

• For Luna Cloud HSM integration, locate the KSP package within the /KSP folder of the Luna Cloud HSM service client package.

Configure KSP.

• Navigate to <Luna HSM Client installation Directory>/KSP. For Luna Cloud HSM, use the /KSP folder in the service client package.

• Double-click KspConfig.exe to launch the SafeNet KSP configuration wizard.

Register or View Security Library.

• Double-click on Register or View Security Library on the left side of the pane.

• Click Browse and select a cryptographic library, such as <Luna HSM Client installation Directory>\cryptoki.dll or <cklog.dll>.

• Click Register. A success message will be displayed upon successful registration: "Success registering the security library!"

Register HSM Slots.

• Double-click Register HSM Slots on the left side of the pane.

• Enter the Slot (Partition) password.

• Click Register Slot to register the slot for Domain\User. On success, a message will appear: "The slot was successfully and securely registered!"

Register the same slot for NT_AUTHORITY\SYSTEM.

Both slots are registered, even if only one entry appears for the service in the Registered Slots section of the KSP interface.

Create a certificate request

Install the certificate

Bind the certificate with a secure IIS web server

Create a file named request.inf with the following information:

[Version]
Signature= "$Windows NT$"
[NewRequest]
Subject = "C=IN,CN=IIS.com,O=Safenet,OU=HSM,L=Noida,S=UP"
HashAlgorithm = SHA256
KeyAlgorithm = RSA
KeyLength = 2048
ProviderName = "Safenet Key Storage Provider"
KeyUsage = 0xf0
MachineKeySet = True
[EnhancedKeyUsageExtension]
OID=1.3.6.1.5.5.7.3.1

Specify the subject details of the Domain Controller issuing the certificate.

Specify the key algorithm and key length (RSA, for example) as required.

Specify the Provider name as SafeNet Key Storage Provider.

Save the above content in the file request.inf.

Create the certificate request for the Certification Authority:

certreq.exe –new request.inf request.req

This generates a certificate request file called request.req that can be sent to a Certificate Authority.

Send the Certificate Signing Request (CSR) file to a trusted CA, such as VeriSign or Entrust. Request authentication and receive a signed certificate along with the certificate chain. Save the response in your current working directory.

Make the certificate available for use in Microsoft IIS:

certreq.exe –accept signed.cer

Ensure that signed.cer is the binary signed certificate obtained from the CA.

Open IIS Manager from Start > Administrative Tools > Internet Information Services (IIS) Manager.

Select the desired website under Sites.

Click Bindings on the right side.

Click Add in the Site Bindings window.

Select the https protocol.

Choose the IP address of the machine running IIS from the drop-down list.

Select the certificate from the drop-down list.

Click OK to complete the certificate binding for an SSL connection.

Open a browser and enter https://<machine_name>:443. If necessary, accept the certificate in the browser to complete the SSL connection with the Microsoft IIS web server.