### Configure and Install with Helm Source: https://nshielddocs.entrust.com/ks5-docs/v1.0/helm-chart-install.html Example command to install the backend chart with specific database, AMQP, and logging configurations. ```bash $ helm install my-release \ --create-namespace --namespace nshieldkeysafe5 \ --set database.type=mongo \ --set database.mongo.hosts="mongo-chart-mongodb-0.mongo-chart-mongodb-headless.mongons.svc.cluster.local:27017,mongo-chart-mongodb-1.mongo-chart-mongodb-headless.mongons.svc.cluster.local:27017" \ --set database.mongo.replicaSet=rs0 \ --set database.mongo.auth.type=pwd \ --set database.mongo.auth.existingSecret=my-mongo-credentials-secret \ --set database.mongo.tls.enabled=true \ --set database.mongo.tls.existingSecret=my-mongo-tls-secret \ --set amqp.URL="rabbit-chart-rabbitmq-0.rabbit-chart-rabbitmq-headless.rabbitns.svc.cluster.local:5671" \ --set amqp.auth.type=pwd \ --set amqp.auth.existingSecret=my-amqp-credentials-secret \ --set amqp.tls.enabled=true \ --set amqp.tls.existingSecret=my-amqp-tls-secret \ --set logging.level=info \ --set logging.format=json \ helm-keysafe5-backend/ ``` -------------------------------- ### View PKI Installation Summary Source: https://nshielddocs.entrust.com/interops-docs/red-hat-cs/procedures.html Example output showing the installation summary after a successful CA deployment. ```text ... ... ========================================================================== INSTALLATION SUMMARY ========================================================================== Administrator's username: caadmin Administrator's PKCS #12 file: /root/.dogtag/ca-1/ca_admin_cert.p12 This CA subsystem of the 'ca-1' instance has FIPS mode enabled on this operating system. REMINDER: Don't forget to update the appropriate FIPS algorithms in server.xml in the 'ca-1' instance. To check the status of the subsystem: systemctl status pki-tomcatd@ca-1.service To restart the subsystem: systemctl restart pki-tomcatd@ca-1.service The URL for the subsystem is: https://pki.interop.local:8443/ca PKI instances will be enabled upon system boot ========================================================================== ``` -------------------------------- ### SEE Configuration Output Source: https://nshielddocs.entrust.com/interops-docs/pqcop/procedures.html Example output after running the SEE configuration setup. ```text Module #1 new SEE configuration saved, new configuration follows: Module #1: Machine file: /opt/nfast/kmdata/custom-seemachines/pqsdk-1.4.1.sar Encryption key: Signing key hash: Userdata file: /opt/nfast/kmdata/custom-seemachines/userdata.sar WorldID published object: pqsdk Postload helper: Postload args: Reload new configuration now? (yes/no): yes Clear modules before reloading new configuration? (yes/no): yes Modules cleared for new configuration. Check the hardserver log to ensure the SEE machine was loaded correctly after clearing. ``` -------------------------------- ### PyKMIP installation output Source: https://nshielddocs.entrust.com/interops-docs/edb-postgres-kc/procedures.html Example output confirming the successful installation of PyKMIP and its dependencies. ```text running install . . . Using /usr/lib/python3.9/site-packages Searching for cffi==1.17.1 Best match: cffi 1.17.1 Adding cffi 1.17.1 to easy-install.pth file Using /usr/local/lib64/python3.9/site-packages Searching for pycparser==2.22 Best match: pycparser 2.22 Adding pycparser 2.22 to easy-install.pth file Using /usr/local/lib/python3.9/site-packages Finished processing dependencies for PyKMIP==0.11.0.dev1 ``` -------------------------------- ### Build host examples on Linux Source: https://nshielddocs.entrust.com/security-world-docs/codesafe/example-see-machines.html Compile the configured examples. ```bash cmake --build ``` ```bash cmake --build . ``` -------------------------------- ### Setup NVRAM and userdata files Source: https://nshielddocs.entrust.com/security-world-docs/codesafe/example-see-machines.html Run the setup utility to initialize NVRAM and userdata files. ```bash ./setup nvramfile 100 nvramuserdata ``` ```bash setup.exe nvramfile 100 nvramuserdata ``` -------------------------------- ### Execute ImportKeypair example Source: https://nshielddocs.entrust.com/pqcop-docs/examples.html Command to execute the pre-built ImportKeypair example on an n5 installation. ```shell cd /opt/nfast/pqsdk/examples/n5 java -cp /opt/nfast/pqsdk/bin/java/pqsdk-examples.jar com.entrust.pqsdk.examples.ImportKeypair fe80::216:3eff:fe6c:1bb%nshield0 8888 ``` -------------------------------- ### Verify Docker Installation Source: https://nshielddocs.entrust.com/interops-docs/kubernetes-kcv-secrets/procedures.html Checks the installed Docker version to confirm successful setup. ```bash % sudo docker --version ``` -------------------------------- ### Create Data Directories and Finalize Source: https://nshielddocs.entrust.com/interops-docs/hashicorp-vault-enterprise/install-vault.html Set up directory structure and verify the installation. ```bash # sudo mkdir --parents /opt/vault/data # sudo mkdir --parents /opt/vault/data/hsm # sudo mkdir --parents /opt/vault/logs # sudo chmod --recursive 750 /opt/vault # sudo chown --recursive vault:vault /opt/vault ``` ```bash # reboot ``` ```bash # vault version Vault v1.21.1+ent.hsm (beaba1062fcb683171ab2690841fbb29d8733512), built 2025-11-18T13:05:11Z (cgo) ``` -------------------------------- ### Setup Host-Side Application Source: https://nshielddocs.entrust.com/security-world-docs/v13.6.14/codesafe/example-see-machines.html Navigate to the host application directory and initialize NVRAM files. ```bash cd ~/buildhost/csee/nvram/hostside ``` ```cmd cd C:\Users\\Documents\hostside\csee\nvram\host ``` ```bash ./setup nvramfile 100 nvramuserdata ``` ```cmd setup.exe nvramfile 100 nvramuserdata ``` ```text Please insert the next administrator card and press enter. Please enter card passphrase: allocated NVRAM file `nvramfile'. ``` -------------------------------- ### Compile and execute SignVerify example Source: https://nshielddocs.entrust.com/pqcop-docs/examples.html Commands to compile and run the SignVerify example on a Solo XC installation when pre-built examples are missing. ```shell cd /opt/nfast/pqsdk/examples/xc javac -d . -cp /opt/nfast/java/classes/nCipherKM.jar:/opt/nfast/pqsdk/bin/java/pqsdk.jar SignVerify.java jar -cf examples.jar com/entrust/pqsdk/examples/SignVerify.class java -cp examples:/opt/nfast/pqsdk/bin/java/pqsdk.jar com.entrust.pqsdk.examples.SignVerify ``` -------------------------------- ### Installation Test Output Example Source: https://nshielddocs.entrust.com/security-world-docs/v12.80/connect-ug-nix/application-interfaces.html Expected output when the nCipherKM provider is correctly installed and registered. ```text Installed providers: 1: nCipherKM 2: SUN 3: SunRsaSign 4: SunJSSE 5: SunJCE 6: SunJGSS 7: SunSASL Unlimited strength jurisdiction files are installed. The nCipher provider is correctly installed. nCipher JCE services: Alg.Alias.Cipher.1.2.840.113549.1.1.1 Alg.Alias.Cipher.1.2.840.113549.3.4 Alg.Alias.Cipher.AES Alg.Alias.Cipher.DES3 ``` -------------------------------- ### Configure Solo SEE module examples Source: https://nshielddocs.entrust.com/security-world-docs/v12.80/codesafe-linux/example-see-machines.html Commands to configure the build environment for module-side examples. ```bash cmake -DCMAKE_TOOLCHAIN_FILE= ``` ```bash cmake -DCMAKE_TOOLCHAIN_FILE=/opt/nfast/c/csd/cmake/codesafe-linux-solo-csee.cmake /opt/nfast/c/csd/examples/ ``` -------------------------------- ### Install helm-keysafe5-istio Source: https://nshielddocs.entrust.com/ks5-docs/install-upgrade/k8s-deployment/helm-chart-install.html Example command to install the Istio Helm chart with authentication and HTTPS enabled. ```bash helm install keysafe5-istio \ --create-namespace --namespace=nshieldkeysafe5 \ --set requireAuthn=true \ --set httpsEnabled=true \ --set portNumber=443 \ --set issuer[0].authIssuer="https://foobar.auth0.com" \ --set issuer[0].authJWKsURI="https://www.googleapis.com/oauth2/v1/certs" \ --set issuer[0].authAudiences[0]="https://keysafe5.location" \ --wait --timeout 1m \ helm-charts/nshield-keysafe5-istio-1.7.0.tgz ``` -------------------------------- ### Initialize Configuration File Source: https://nshielddocs.entrust.com/interops-docs/oracle-tde-wsop/wsopclient.html Copy the example configuration file to the active configuration location. ```bash % cd /opt/nfast/webservices/pkcs11/conf % cp example_pkcs11webservices.cfg pkcs11webservices.cfg ``` -------------------------------- ### Run Java Examples Source: https://nshielddocs.entrust.com/pqcop-docs/install.html Command to execute Java examples for the nShield 5 client installation. ```bash java -cp .:/opt/nfast/pqsdk/bin/java/pqsdk.jar com.entrust.pqsdk.examples. ``` -------------------------------- ### Launch Entrust PostgreSQL Setup Source: https://nshielddocs.entrust.com/interops-docs/entrust-asm-win/install-certificate-authority.html Command to initiate the database setup script from the installation directory. ```powershell C:\Program Files\Entrust\easm_postgres15\dbserver\bin\ent_setup.bat ``` -------------------------------- ### Run the nShield installation script Source: https://nshielddocs.entrust.com/ks5-docs/v1.0/agent-install.html Execute the installation script to finalize setup and restart the hardserver. ```bash sudo /opt/nfast/sbin/install ``` -------------------------------- ### Build host examples on Windows Source: https://nshielddocs.entrust.com/security-world-docs/codesafe/example-see-machines.html Compile the configured examples using Ninja. ```cmd ninja ``` -------------------------------- ### Create and navigate to module build directory Source: https://nshielddocs.entrust.com/security-world-docs/codesafe5/example-see-machines-linux.html Prepare a dedicated directory for building module-side examples. ```bash mkdir ~/buildmodule/ ``` ```bash cd ~/buildmodule/ ``` -------------------------------- ### Installation Script Output Source: https://nshielddocs.entrust.com/interops-docs/keysafe5-reconnect/setup.html Example output generated during the KeySafe 5 server installation process on Linux. ```text -- Running install fragment keysafe5-server Creating keysafe5serviced group. Checking for user 'keysafe5serviced' Creating keysafe5serviced user. useradd: warning: the home directory /opt/nfast already exists. useradd: Not copying any file from skel directory into it. Checking user 'keysafe5serviced' is in correct group 'keysafe5serviced' users created correctly Checking user keysafe5serviced is in group nfast Initialising... Detecting all available interface IP addresses that KeySafe 5 agent's may use to connect to the server. This list may be manually provided by specifying a comma-separated list of addresses to 'keysafe5-server-admin init' The KeySafe 5 internal communication server TLS certificate contains the following addresses that KeySafe 5 Agents may use to securely connect to the server: - 127.0.0.1 (loopback/localhost address) - 10.194.148.22 - ::1 (loopback/localhost address) - fe80::6e61:6d3a:a0c4:2661 - keysafe5 Generated CA certificate is valid for 30 days Generated TLS certificates are valid for 30 days Initialisation complete. You may now add KeySafe 5 Agents using the 'sign' function Installing startup scripts for 'keysafe5-server'. Enabling the systemd service unit Adding and enabling a systemd unit Created symlink /etc/systemd/system/multi-user.target.wants/nc_keysafe5-server.service → /etc/systemd/system/nc_keysafe5-server.service. Starting KeySafe 5 Server Starting nCipher 'keysafe5-server' server process. KeySafe 5 Server started ---- Installation complete ---- ``` -------------------------------- ### Create NVRAM and userdata files Source: https://nshielddocs.entrust.com/security-world-docs/v12.80/codesafe-linux/example-see-machines.html Navigate to the host application directory and run the setup utility with root privileges. ```bash $ cd ~/buildhost/csee/nvram/host ``` ```bash $ ./setup nvramfile 100 nvramuserdata Please insert the next administrator card and press enter. Please enter card pass phrase: allocated NVRAM file `nvramfile'. ``` -------------------------------- ### Install nShield Key Attestation Verifier on Windows Source: https://nshielddocs.entrust.com/key-attestation-docs/installation.html Executes the setup script for a standalone installation on Windows. ```batch nShieldKeyAttestSetup.bat -s ```