Entrust nShield

https://nshielddocs.entrust.com/
Admin
Entrust nShield provides product documentation for nShield Hardware Security Modules (HSMs), API...
Tokens:4,253,340
Snippets:62,815
Trust Score:9.7
Update:3 months ago
Show doc for...
Tokens:
Raw
### Configure and Install with Helm

Source: https://nshielddocs.entrust.com/ks5-docs/v1.0/helm-chart-install.html

Example command to install the backend chart with specific database, AMQP, and logging configurations.

```bash
$ helm install my-release \
  --create-namespace --namespace nshieldkeysafe5 \
  --set database.type=mongo \
  --set database.mongo.hosts="mongo-chart-mongodb-0.mongo-chart-mongodb-headless.mongons.svc.cluster.local:27017,mongo-chart-mongodb-1.mongo-chart-mongodb-headless.mongons.svc.cluster.local:27017" \
  --set database.mongo.replicaSet=rs0 \
  --set database.mongo.auth.type=pwd \
  --set database.mongo.auth.existingSecret=my-mongo-credentials-secret \
  --set database.mongo.tls.enabled=true \
  --set database.mongo.tls.existingSecret=my-mongo-tls-secret \
  --set amqp.URL="rabbit-chart-rabbitmq-0.rabbit-chart-rabbitmq-headless.rabbitns.svc.cluster.local:5671" \
  --set amqp.auth.type=pwd \
  --set amqp.auth.existingSecret=my-amqp-credentials-secret \
  --set amqp.tls.enabled=true \
  --set amqp.tls.existingSecret=my-amqp-tls-secret \
  --set logging.level=info \
  --set logging.format=json \
 helm-keysafe5-backend/
```

--------------------------------

### View PKI Installation Summary

Source: https://nshielddocs.entrust.com/interops-docs/red-hat-cs/procedures.html

Example output showing the installation summary after a successful CA deployment.

```text
...
...
    ==========================================================================
                                INSTALLATION SUMMARY
    ==========================================================================

      Administrator's username:             caadmin
      Administrator's PKCS #12 file:
            /root/.dogtag/ca-1/ca_admin_cert.p12

      This CA subsystem of the 'ca-1' instance
      has FIPS mode enabled on this operating system.

      REMINDER:  Don't forget to update the appropriate FIPS
                 algorithms in server.xml in the 'ca-1' instance.

      To check the status of the subsystem:
            systemctl status pki-tomcatd@ca-1.service

      To restart the subsystem:
            systemctl restart pki-tomcatd@ca-1.service

      The URL for the subsystem is:
            https://pki.interop.local:8443/ca

      PKI instances will be enabled upon system boot

    ==========================================================================
```

--------------------------------

### SEE Configuration Output

Source: https://nshielddocs.entrust.com/interops-docs/pqcop/procedures.html

Example output after running the SEE configuration setup.

```text
Module #1 new SEE configuration saved, new configuration follows:

Module #1:
  Machine file:             /opt/nfast/kmdata/custom-seemachines/pqsdk-1.4.1.sar
  Encryption key:
  Signing key hash:
  Userdata file:            /opt/nfast/kmdata/custom-seemachines/userdata.sar
  WorldID published object: pqsdk
  Postload helper:
  Postload args:

Reload new configuration now? (yes/no): yes
Clear modules before reloading new configuration? (yes/no): yes
Modules cleared for new configuration.
Check the hardserver log to ensure the SEE machine was loaded correctly after clearing.
```

--------------------------------

### PyKMIP installation output

Source: https://nshielddocs.entrust.com/interops-docs/edb-postgres-kc/procedures.html

Example output confirming the successful installation of PyKMIP and its dependencies.

```text
running install
.
.
.
Using /usr/lib/python3.9/site-packages
Searching for cffi==1.17.1
Best match: cffi 1.17.1
Adding cffi 1.17.1 to easy-install.pth file

Using /usr/local/lib64/python3.9/site-packages
Searching for pycparser==2.22
Best match: pycparser 2.22
Adding pycparser 2.22 to easy-install.pth file

Using /usr/local/lib/python3.9/site-packages
Finished processing dependencies for PyKMIP==0.11.0.dev1
```

--------------------------------

### Build host examples on Linux

Source: https://nshielddocs.entrust.com/security-world-docs/codesafe/example-see-machines.html

Compile the configured examples.

```bash
cmake --build <build output location>
```

```bash
cmake --build .
```

--------------------------------

### Setup NVRAM and userdata files

Source: https://nshielddocs.entrust.com/security-world-docs/codesafe/example-see-machines.html

Run the setup utility to initialize NVRAM and userdata files.

```bash
./setup nvramfile 100 nvramuserdata
```

```bash
setup.exe nvramfile 100 nvramuserdata
```

--------------------------------

### Execute ImportKeypair example

Source: https://nshielddocs.entrust.com/pqcop-docs/examples.html

Command to execute the pre-built ImportKeypair example on an n5 installation.

```shell
cd /opt/nfast/pqsdk/examples/n5
java -cp /opt/nfast/pqsdk/bin/java/pqsdk-examples.jar com.entrust.pqsdk.examples.ImportKeypair fe80::216:3eff:fe6c:1bb%nshield0 8888
```

--------------------------------

### Verify Docker Installation

Source: https://nshielddocs.entrust.com/interops-docs/kubernetes-kcv-secrets/procedures.html

Checks the installed Docker version to confirm successful setup.

```bash
% sudo docker --version
```

--------------------------------

### Create Data Directories and Finalize

Source: https://nshielddocs.entrust.com/interops-docs/hashicorp-vault-enterprise/install-vault.html

Set up directory structure and verify the installation.

```bash
# sudo mkdir --parents /opt/vault/data
# sudo mkdir --parents /opt/vault/data/hsm
# sudo mkdir --parents /opt/vault/logs
# sudo chmod --recursive 750 /opt/vault
# sudo chown --recursive vault:vault /opt/vault
```

```bash
# reboot
```

```bash
# vault version
Vault v1.21.1+ent.hsm (beaba1062fcb683171ab2690841fbb29d8733512), built 2025-11-18T13:05:11Z (cgo)
```

--------------------------------

### Setup Host-Side Application

Source: https://nshielddocs.entrust.com/security-world-docs/v13.6.14/codesafe/example-see-machines.html

Navigate to the host application directory and initialize NVRAM files.

```bash
cd ~/buildhost/csee/nvram/hostside
```

```cmd
cd C:\Users\<USER-NAME>\Documents\hostside\csee\nvram\host
```

```bash
./setup nvramfile 100 nvramuserdata
```

```cmd
setup.exe nvramfile 100 nvramuserdata
```

```text
Please insert the next administrator card and press enter.
Please enter card passphrase:
allocated NVRAM file `nvramfile'.
```

--------------------------------

### Compile and execute SignVerify example

Source: https://nshielddocs.entrust.com/pqcop-docs/examples.html

Commands to compile and run the SignVerify example on a Solo XC installation when pre-built examples are missing.

```shell
cd /opt/nfast/pqsdk/examples/xc
javac -d . -cp /opt/nfast/java/classes/nCipherKM.jar:/opt/nfast/pqsdk/bin/java/pqsdk.jar SignVerify.java
jar -cf examples.jar com/entrust/pqsdk/examples/SignVerify.class
java -cp examples:/opt/nfast/pqsdk/bin/java/pqsdk.jar com.entrust.pqsdk.examples.SignVerify
```

--------------------------------

### Installation Test Output Example

Source: https://nshielddocs.entrust.com/security-world-docs/v12.80/connect-ug-nix/application-interfaces.html

Expected output when the nCipherKM provider is correctly installed and registered.

```text
Installed providers:
1: nCipherKM
2: SUN
3: SunRsaSign
4: SunJSSE
5: SunJCE
6: SunJGSS
7: SunSASL
Unlimited strength jurisdiction files are installed.
The nCipher provider is correctly installed.
nCipher JCE services:
Alg.Alias.Cipher.1.2.840.113549.1.1.1
Alg.Alias.Cipher.1.2.840.113549.3.4
Alg.Alias.Cipher.AES
Alg.Alias.Cipher.DES3
```

--------------------------------

### Configure Solo SEE module examples

Source: https://nshielddocs.entrust.com/security-world-docs/v12.80/codesafe-linux/example-see-machines.html

Commands to configure the build environment for module-side examples.

```bash
cmake -DCMAKE_TOOLCHAIN_FILE=<path to Solo + module tool chain> <path to CSEE examples>
```

```bash
cmake -DCMAKE_TOOLCHAIN_FILE=/opt/nfast/c/csd/cmake/codesafe-linux-solo-csee.cmake /opt/nfast/c/csd/examples/
```

--------------------------------

### Install helm-keysafe5-istio

Source: https://nshielddocs.entrust.com/ks5-docs/install-upgrade/k8s-deployment/helm-chart-install.html

Example command to install the Istio Helm chart with authentication and HTTPS enabled.

```bash
helm install keysafe5-istio \
  --create-namespace --namespace=nshieldkeysafe5 \
  --set requireAuthn=true \
  --set httpsEnabled=true \
  --set portNumber=443 \
  --set issuer[0].authIssuer="https://foobar.auth0.com" \
  --set issuer[0].authJWKsURI="https://www.googleapis.com/oauth2/v1/certs" \
  --set issuer[0].authAudiences[0]="https://keysafe5.location" \
  --wait --timeout 1m \
  helm-charts/nshield-keysafe5-istio-1.7.0.tgz
```

--------------------------------

### Initialize Configuration File

Source: https://nshielddocs.entrust.com/interops-docs/oracle-tde-wsop/wsopclient.html

Copy the example configuration file to the active configuration location.

```bash
% cd /opt/nfast/webservices/pkcs11/conf
% cp example_pkcs11webservices.cfg pkcs11webservices.cfg
```

--------------------------------

### Run Java Examples

Source: https://nshielddocs.entrust.com/pqcop-docs/install.html

Command to execute Java examples for the nShield 5 client installation.

```bash
java -cp .:/opt/nfast/pqsdk/bin/java/pqsdk.jar com.entrust.pqsdk.examples.<example> <IP_ADDRESS> <PORT>
```

--------------------------------

### Launch Entrust PostgreSQL Setup

Source: https://nshielddocs.entrust.com/interops-docs/entrust-asm-win/install-certificate-authority.html

Command to initiate the database setup script from the installation directory.

```powershell
C:\Program Files\Entrust\easm_postgres15\dbserver\bin\ent_setup.bat
```

--------------------------------

### Run the nShield installation script

Source: https://nshielddocs.entrust.com/ks5-docs/v1.0/agent-install.html

Execute the installation script to finalize setup and restart the hardserver.

```bash
sudo /opt/nfast/sbin/install
```

--------------------------------

### Build host examples on Windows

Source: https://nshielddocs.entrust.com/security-world-docs/codesafe/example-see-machines.html

Compile the configured examples using Ninja.

```cmd
ninja
```

--------------------------------

### Create and navigate to module build directory

Source: https://nshielddocs.entrust.com/security-world-docs/codesafe5/example-see-machines-linux.html

Prepare a dedicated directory for building module-side examples.

```bash
mkdir ~/buildmodule/
```

```bash
cd ~/buildmodule/
```

--------------------------------

### Installation Script Output

Source: https://nshielddocs.entrust.com/interops-docs/keysafe5-reconnect/setup.html

Example output generated during the KeySafe 5 server installation process on Linux.

```text
-- Running install fragment keysafe5-server
Creating keysafe5serviced group.
Checking for user 'keysafe5serviced'
Creating keysafe5serviced user.
useradd: warning: the home directory /opt/nfast already exists.
useradd: Not copying any file from skel directory into it.
Checking user 'keysafe5serviced' is in correct group 'keysafe5serviced'
users created correctly
Checking user keysafe5serviced is in group nfast
Initialising...
Detecting all available interface IP addresses that KeySafe 5 agent's may use to connect to the server.
This list may be manually provided by specifying a comma-separated list of addresses to 'keysafe5-server-admin init'
The KeySafe 5 internal communication server TLS certificate contains the following addresses that KeySafe 5 Agents may use to securely connect to the server:
- 127.0.0.1 (loopback/localhost address)
- 10.194.148.22
- ::1 (loopback/localhost address)
- fe80::6e61:6d3a:a0c4:2661
- keysafe5
Generated CA certificate is valid for 30 days
Generated TLS certificates are valid for 30 days
Initialisation complete. You may now add KeySafe 5 Agents using the 'sign' function
Installing startup scripts for 'keysafe5-server'.
Enabling the systemd service unit
Adding and enabling a systemd unit
Created symlink /etc/systemd/system/multi-user.target.wants/nc_keysafe5-server.service → /etc/systemd/system/nc_keysafe5-server.service.
Starting KeySafe 5 Server
Starting nCipher 'keysafe5-server' server process.
KeySafe 5 Server started
---- Installation complete ----
```

--------------------------------

### Create NVRAM and userdata files

Source: https://nshielddocs.entrust.com/security-world-docs/v12.80/codesafe-linux/example-see-machines.html

Navigate to the host application directory and run the setup utility with root privileges.

```bash
$ cd ~/buildhost/csee/nvram/host
```

```bash
$ ./setup nvramfile 100 nvramuserdata
Please insert the next administrator card and press enter.
Please enter card pass phrase:
allocated NVRAM file `nvramfile'.
```

--------------------------------

### Install nShield Key Attestation Verifier on Windows

Source: https://nshielddocs.entrust.com/key-attestation-docs/installation.html

Executes the setup script for a standalone installation on Windows.

```batch
nShieldKeyAttestSetup.bat -s
```
Tokens:
Raw