Integration with IIS
One of the uses for the Microsoft Cryptographic API is for Secure Socket Layer (SSL) processing. This section explains the steps necessary to configure and use ProtectToolkit-M in conjunction with IIS.
Prior to performing any of the following, please ensure that ProtectToolkit-M is correctly installed and configured. For details, please refer to ProtectToolkit 7 software installation and Setup and configuration.
Note
ProtectServer 3 integrations with ADCS/IIS is only supported in FIPS mode with the following versions:
| PTK Version | Security Flags |
|---|---|
| 7.3.1 | Default Security Flags* |
| 7.3.0 | FIPS 140-3 |
| 7.2.4 | FIPS 140-3 |
- The following outlines the workaround scenarios for version 7.3.1:
Customers with existing ADCS/IIS (older FW, with FIPS mode enabled) integrations wishing to upgrade to FW 7.03.01 and above.
Due to the setting of the security mode flag “Tamper Before Upgrade”, direct upgrade to FW 7.03.01 is not permitted. The following steps will workaround that issue.
- Backup the existing keys.
- Tamper the HSM.
- Re-initialize the HSM without FIPS mode set.
- Upgrade to FW 7.03.01 or above.
- Restore the key backup.
- Enable FIPS mode.
New customers or new integrations with FW 7.03.01 and above (no FIPS mode).
- Initialize the HSM without FIPS mode set.
- Upgrade to FW 7.03.01 or above.
- Perform the integration of ADCS or IIS.
- Enable FIPS mode.
This section contains the following instructive subsections for integration with IIS:
