|
Home > |
|---|
Update PKI Token Capability, using a capability update package available on the Luna appliance (that is, a package that you have acquired from SafeNet, and transferred via scp, to the Luna appliance). Before you can use this command, you must:
a) acquire the secure package update file from SafeNet and send the file to the Luna SA (using scp or pscp)
b) open the file on the Luna SA with the lunash command "package update <filename> -authcode <authcode>"
An external Luna HSM can be USB-connected to a Luna SA appliance for:
•local backup/restore operations (Luna Backup HSM)
•PKI bundle operations (Luna G5 HSM)
Luna SA does not pass PED operations and data through to an externally connected Luna HSM from a Luna PED that is connected locally to the Luna SA.
If the external HSM is PED-authenticated, then the options for Luna PED connection are:
•local PED connection, directly to the affected HSM, when needed, or
•Remote PED connection, passed through the Luna SA
Note: Support for PKI Bundles with Remote PED begins at firmware version 6.10.1 in the external HSM.
Note: Support for locally connected Backup HSM with Remote PED,
begins at firmware version 6.10.1 in the external HSM.
Note: Use of Remote PED with an external device is made possible when you set up with the commands
hsm ped vector init -serial <serial#_of_external_HSM>
and
hsm ped connect -serial <serial#_of_external_HSM>
before using token pki or token backup commands.
A capability update or a firmware update is meant to be applied just one time to an HSM. If you attempt to re-apply a capability update to an HSM that already has the capability installed, the system throws an error like " C0000002 : RC_GENERAL_ERROR ". A similar result occurs if you attempt to install a particular firmware update more than once on one HSM. This is expected behavior.
token pki update capability -serial <serialnum> -capability <capabilityname> [-force]
| Parameter | Shortcut | Description |
|---|---|---|
| -capability | -c | Specifies the capability name. |
| -force | -f |
Force the action without prompting. |
| -serial | -l | Specifies the token serial number. |
lunash:> token pki update capability -serial 777199-capability newcapability -f
Success
Capability newcapability added.
Command result : 0 (Success)