ProtectToolkit 7 software installation
This section describes the supported ProtectToolkit 7 platforms and operating modes.
The latest versions of the client software and HSM firmware can be found on the Thales Technical Support Customer Portal. See Support contacts for more information.
Operating modes
ProtectServer 3 HSMs can be deployed and operated with ProtectToolkit 7 in one of the three following operating modes:
PCI Mode
PCI mode in conjunction with a locally-installed ProtectServer 3 PCIe.
Network Mode
Network mode over a TCP/IP network, in conjunction with a compatible product such as the ProtectServer 3 External.
A machine with a ProtectServer 3 PCIe installed can also be used as a server in network mode.
Software Emulator Mode
Software Emulator mode, on a local machine without access to a hardware security module.
Within the client/server runtime environment, the server performs cryptographic processing at the request of the client. The server itself will only operate in one of the hardware runtime modes.
The software emulator version is typically used as a development and testing environment for applications that will eventually use the hardware variant of ProtectToolkit-C.
The supported platforms for each version of ProtectToolkit 7 are listed below.
C=ProtectToolkit-C, PKCS#11 v2.10/2.20
M=ProtectToolkit-M, MS CSP 2.0 with CNG
J=ProtectToolkit-J, Java 7.x/8.x/9.x/10.x/11.x/17.x/21.x.
Note
Java 17.x and 21.x are only supported when using ProtectToolkit 7.2.3 or newer.
Note
The ProtectServer 3 HSM transitioned from FIPS 140-2 Level 3 to FIPS 140-3 Level 3 compliance and validation with the release of ProtectServer 3 HSM Firmware 7.03.01 (validation pending). The information in this section is grouped by the FIPS compliance and validation requirements that are relevant to your ProtectServer 3 HSM deployment.
Supported ProtectToolkit 7 platforms for FIPS 140-2 Level 3 deployments
This section lists the platforms supported by the following ProtectToolkit 7 versions, which are intended for FIPS 140-2 Level 3 deployments:
ProtectToolkit 7.2.3
ProtectToolkit 7.2.3 supports the platforms shown below.
| Windows version | OS type | 64-bit PTK component | 32-bit PTK component | PTK supported hardware |
|---|---|---|---|---|
| 11 | 64-bit | C/M/J | N/A | PCIe3, PSE3, PSE3+ |
| 10 | 64-bit | C/M/J | C/J | PCIe31, PSE3, PSE3+ |
| Server 2022 | 64-bit | C/M/J | N/A | PCIe3, PSE3, PSE3+ |
| Server 2019 | 64-bit | C/M/J | N/A | PCIe3, PSE3, PSE3+ |
| Server 2016 | 64-bit | C/M/J | N/A | PCIe3, PSE3, PSE3+ |
| Server 2012 R2 | 64-bit | C/M/J | N/A | PCIe3, PSE3, PSE3+ |
1 To deploy a ProtectServer 3 HSM with the 32-bit version of ProtectToolkit in PCI mode while using a 64-bit Windows 10 PC as the HSM and application host, you must follow the instructions described in Package installation sequence for 32-bit ProtectToolkit in PCI mode.
For Windows installation procedures, refer to Installing ProtectToolkit 7 on Windows.
| Linux version | OS type | 64-bit PTK component | 32-bit PTK component | PTK supported hardware |
|---|---|---|---|---|
| RHEL 9.1, 9.2 | 64-bit | C/J | N/A | PCIe3, PSE3, PSE3+ |
| RHEL 8.4, 8.6, 8.7 | 64-bit | C/J | N/A | PCIe3, PSE3, PSE3+ |
| RHEL 7.7, 7.9 | 64-bit | C/J | N/A | PCIe3, PSE3, PSE3+ |
| SLES 12 SP5 | 64-bit | C/J | N/A | PSE3, PSE3+ |
| Ubuntu 20.04 LTS | 64-bit | C/J | N/A | PCIe3, PSE3, PSE3+ |
For Linux installation procedures, refer to the following pages:
Note
If you are installing a patch version of ProtectToolkit on an AIX system, first install the initial release of the matching minor version of ProtectToolkit.
| AIX version | OS type | 64-bit PTK component | 32-bit PTK component | PTK supported hardware |
|---|---|---|---|---|
| 7.3 | 64-bit | C | C | PSE3, PSE3+ |
| 7.2 | 64-bit | C | C | PSE3, PSE3+ |
| 7.1 | 64-bit | C | C | PSE3, PSE3+ |
For AIX installation procedures, refer to
ProtectToolkit 7.2.1
ProtectToolkit 7.2.1 supports the platforms shown below.
| Windows version | OS type | 64-bit PTK component | 32-bit PTK component | PTK supported hardware |
|---|---|---|---|---|
| 11 | 64-bit | C/M/J | N/A | PCIe3, PSE3, PSE3+ |
| 10 | 64-bit | C/M/J | C/J | PCIe31, PSE3, PSE3+ |
| Server 2022 | 64-bit | C/M/J | N/A | PCIe3, PSE3, PSE3+ |
| Server 2019 | 64-bit | C/M/J | N/A | PCIe3, PSE3, PSE3+ |
| Server 2016 | 64-bit | C/M/J | N/A | PCIe3, PSE3, PSE3+ |
| Server 2012 R2 | 64-bit | C/M/J | N/A | PCIe3, PSE3, PSE3+ |
1 To deploy a ProtectServer 3 HSM with the 32-bit version of ProtectToolkit in PCI mode while using a 64-bit Windows 10 PC as the HSM and application host, you must follow the instructions described in Package installation sequence for 32-bit ProtectToolkit in PCI mode.
For Windows installation procedures, refer to Installing ProtectToolkit 7 on Windows.
| Linux version | OS type | 64-bit PTK component | 32-bit PTK component | PTK supported hardware |
|---|---|---|---|---|
| RHEL 9.1 | 64-bit | C/J | N/A | PCIe3, PSE3, PSE3+ |
| RHEL 8.4, 8.6, 8.7 | 64-bit | C/J | N/A | PCIe3, PSE3, PSE3+ |
| RHEL 7.7 | 64-bit | C/J | N/A | PCIe3, PSE3, PSE3+ |
| SLES 12 SP5 | 64-bit | C/J | N/A | PSE3, PSE3+ |
| Ubuntu 20.04 LTS | 64-bit | C/J | N/A | PCIe3, PSE3, PSE3+ |
For Linux installation procedures, refer to the following pages:
Note
If you are installing a patch version of ProtectToolkit on an AIX system, first install the initial release of the matching minor version of ProtectToolkit.
| AIX version | OS type | 64-bit PTK component | 32-bit PTK component | PTK supported hardware |
|---|---|---|---|---|
| 7.3 | 64-bit | C | C | PSE3, PSE3+ |
| 7.2 | 64-bit | C | C | PSE3, PSE3+ |
| 7.1 | 64-bit | C | C | PSE3, PSE3+ |
For AIX installation procedures, refer to
ProtectToolkit 7.2.0
ProtectToolkit 7.2.0 supports the platforms shown below.
| Windows version | OS type | 64-bit PTK component | 32-bit PTK component | PTK supported hardware |
|---|---|---|---|---|
| 11 | 64-bit | C/M/J | N/A | PCIe3, PSE3, PSE3+ |
| 10 | 64-bit | C/M/J | C/J | PCIe31, PSE3, PSE3+ |
| Server 2019 | 64-bit | C/M/J | N/A | PCIe3, PSE3, PSE3+ |
| Server 2016 | 64-bit | C/M/J | N/A | PCIe3, PSE3, PSE3+ |
| Server 2012 R2 | 64-bit | C/M/J | N/A | PCIe3, PSE3, PSE3+ |
1 To deploy a ProtectServer 3 HSM with the 32-bit version of ProtectToolkit in PCI mode while using a 64-bit Windows 10 PC as the HSM and application host, you must follow the instructions described in Package installation sequence for 32-bit ProtectToolkit in PCI mode.
For Windows installation procedures, refer to Installing ProtectToolkit 7 on Windows.
| Linux version | OS type | 64-bit PTK component | 32-bit PTK component | PTK supported hardware |
|---|---|---|---|---|
| RHEL 8.4 | 64-bit | C/J | N/A | PCIe3, PSE3, PSE3+ |
| RHEL 7.7 | 64-bit | C/J | N/A | PCIe3, PSE3, PSE3+ |
| Ubuntu 20.04 LTS | 64-bit | C/J | N/A | PCIe3, PSE3, PSE3+ |
For Linux installation procedures, refer to the following pages:
| AIX version | OS type | 64-bit PTK component | 32-bit PTK component | PTK supported hardware |
|---|---|---|---|---|
| 7.3 | 64-bit | C | C | PSE3, PSE3+ |
| 7.2 | 64-bit | C | C | PSE3, PSE3+ |
| 7.1 | 64-bit | C | C | PSE3, PSE3+ |
For AIX installation procedures, refer to
ProtectToolkit 7.1.0
ProtectToolkit 7.1.0 supports the platforms shown below.
| Windows version | OS type | PTK component | PTK supported hardware |
|---|---|---|---|
| 10 | 64-bit | C/M/J | PCIe3, PSE3, PSE3+ |
| Server 2019 | 64-bit | C/M/J | PCIe3, PSE3, PSE3+ |
| Server 2016 | 64-bit | C/M/J | PCIe3, PSE3, PSE3+ |
| Server 2012 R2 | 64-bit | C/M/J | PCIe3, PSE3, PSE3+ |
For Windows installation procedures, refer to Installing ProtectToolkit 7 on Windows.
| Linux version | OS type | PTK component | PTK supported hardware |
|---|---|---|---|
| RHEL 8.4 | 64-bit | C/J | PCIe3, PSE3, PSE3+ |
| RHEL 7.7 | 64-bit | C/J | PCIe3, PSE3, PSE3+ |
| Ubuntu 20.04 LTS | 64-bit | C/J | PCIe3, PSE3, PSE3+ |
For Linux installation procedures, refer to the following pages:
ProtectToolkit 7.0.0
ProtectToolkit 7.0.0 supports the platforms shown below.
| Windows version | OS type | PTK component | PTK supported hardware |
|---|---|---|---|
| 10 | 64-bit | C/M/J | PCIe3, PSE3, PSE3+ |
| Server 2019 | 64-bit | C/M/J | PCIe3, PSE3, PSE3+ |
| Server 2016 | 64-bit | C/M/J | PCIe3, PSE3, PSE3+ |
| Server 2012 R2 | 64-bit | C/M/J | PCIe3, PSE3, PSE3+ |
For Windows installation procedures, refer to Installing ProtectToolkit 7 on Windows.
| Linux version | OS type | PTK component | PTK supported hardware |
|---|---|---|---|
| RHEL 7.7 | 64-bit | C/J | PCIe3, PSE3, PSE3+ |
For Linux installation procedures, refer to the following pages:
Supported ProtectToolkit 7 platforms for FIPS 140-3 Level 3 deployments
This section lists the platforms supported by the following ProtectToolkit 7 versions, which are intended for FIPS 140-3 Level 3 deployments:
Note
If you are reconfiguring a ProtectServer 3 HSM deployment for FIPS 140-3 Level 3-compliance, read Firmware 7.03.01 advisory notes to take note of the operational changes that this firmware version introduces and reconfigure applications where necessary, before reconfiguring the deployment for 140-3 Level 3-compliance.
ProtectToolkit 7.3.1
ProtectToolkit 7.3.1 supports the platforms shown below.
| Windows version | OS type | 64-bit PTK component | 32-bit PTK component | PTK supported hardware |
|---|---|---|---|---|
| 11 | 64-bit | C/M/J | N/A | PCIe3, PSE3, PSE3+ |
| 10 | 64-bit | C/M/J | C/J | PCIe31, PSE3, PSE3+ |
| Server 2022 | 64-bit | C/M/J | N/A | PCIe3, PSE3, PSE3+ |
| Server 2019 | 64-bit | C/M/J | N/A | PCIe3, PSE3, PSE3+ |
| Server 2016 | 64-bit | C/M/J | N/A | PCIe3, PSE3, PSE3+ |
| Server 2012 R2 | 64-bit | C/M/J | N/A | PCIe3, PSE3, PSE3+ |
1 To deploy a ProtectServer 3 HSM with the 32-bit version of ProtectToolkit in PCI mode while using a 64-bit Windows 10 PC as the HSM and application host, you must follow the instructions described in Package installation sequence for 32-bit ProtectToolkit in PCI mode.
For Windows installation procedures, refer to Installing ProtectToolkit 7 on Windows.
| Linux version | OS type | 64-bit PTK component | 32-bit PTK component | PTK supported hardware |
|---|---|---|---|---|
| RHEL 9.1, 9.2, 9.3 | 64-bit | C/J | N/A | PCIe3, PSE3, PSE3+ |
| RHEL 8.4, 8.6, 8.7, 8.9, 8.10 | 64-bit | C/J | N/A | PCIe3, PSE3, PSE3+ |
| RHEL 7.7, 7.9 | 64-bit | C/J | N/A | PCIe3, PSE3, PSE3+ |
| SLES 15 SP4 | 64-bit | C/J | N/A | PSE3, PSE3+ |
| SLES 12 SP5 | 64-bit | C/J | N/A | PSE3, PSE3+ |
| Ubuntu 20.04, 22.04.4 LTS | 64-bit | C/J | N/A | PCIe3, PSE3, PSE3+ |
For Linux installation procedures, refer to the following pages:
| AIX version | OS type | 64-bit PTK component | 32-bit PTK component | PTK supported hardware |
|---|---|---|---|---|
| 7.3 | 64-bit | C | C | PSE3, PSE3+ |
| 7.2 | 64-bit | C | C | PSE3, PSE3+ |
| 7.1 | 64-bit | C | C | PSE3, PSE3+ |
For AIX installation procedures, refer to
Note
If you are reconfiguring a ProtectServer 3 HSM deployment for FIPS 140-3 Level 3-compliance, read Firmware 7.03.00 advisory notes to take note of the operational changes that this firmware version introduces and reconfigure applications where necessary, before reconfiguring the deployment for 140-3 Level 3-compliance.
ProtectToolkit 7.3.0
ProtectToolkit 7.3.0 supports the platforms shown below.
| Windows version | OS type | 64-bit PTK component | 32-bit PTK component | PTK supported hardware |
|---|---|---|---|---|
| 11 | 64-bit | C/M/J | N/A | PCIe3, PSE3, PSE3+ |
| 10 | 64-bit | C/M/J | C/J | PCIe31, PSE3, PSE3+ |
| Server 2022 | 64-bit | C/M/J | N/A | PCIe3, PSE3, PSE3+ |
| Server 2019 | 64-bit | C/M/J | N/A | PCIe3, PSE3, PSE3+ |
| Server 2016 | 64-bit | C/M/J | N/A | PCIe3, PSE3, PSE3+ |
| Server 2012 R2 | 64-bit | C/M/J | N/A | PCIe3, PSE3, PSE3+ |
1 To deploy a ProtectServer 3 HSM with the 32-bit version of ProtectToolkit in PCI mode while using a 64-bit Windows 10 PC as the HSM and application host, you must follow the instructions described in Package installation sequence for 32-bit ProtectToolkit in PCI mode.
For Windows installation procedures, refer to Installing ProtectToolkit 7 on Windows.
| Linux version | OS type | 64-bit PTK component | 32-bit PTK component | PTK supported hardware |
|---|---|---|---|---|
| RHEL 9.1 | 64-bit | C/J | N/A | PCIe3, PSE3, PSE3+ |
| RHEL 8.4, 8.6, 8.7 | 64-bit | C/J | N/A | PCIe3, PSE3, PSE3+ |
| RHEL 7.7 | 64-bit | C/J | N/A | PCIe3, PSE3, PSE3+ |
| SLES 15 SP4 | 64-bit | C/J | N/A | PSE3, PSE3+ |
| SLES 12 SP5 | 64-bit | C/J | N/A | PSE3, PSE3+ |
| Ubuntu 20.04 LTS | 64-bit | C/J | N/A | PCIe3, PSE3, PSE3+ |
For Linux installation procedures, refer to the following pages:
| AIX version | OS type | 64-bit PTK component | 32-bit PTK component | PTK supported hardware |
|---|---|---|---|---|
| 7.3 | 64-bit | C | C | PSE3, PSE3+ |
| 7.2 | 64-bit | C | C | PSE3, PSE3+ |
| 7.1 | 64-bit | C | C | PSE3, PSE3+ |
For AIX installation procedures, refer to
