Skip to main content
Skip table of contents

Bootstrap Certificate Manager

This article includes updates for Certificate Manager 8.11.

The shaded objects show the foundation of the Certificate Manager PKI environment, which is created in the bootstrap procedure. 

This article describes how to bootstrap Smart ID Certificate Manager. 

The purpose of the bootstrap procedure is to build the foundation for a PKI environment, including certificate authorities (CAs) and officers, and revoke the bootstrap CA. A bootstrapping must be performed after a new system installation, before the system can be used for production of certificates. 

When performing the bootstrap procedure you will be using the two Certificate Manager clients Administrator's workbench (AWB) and Registration Authority (RA) in Certificate Manager, as well as other utility programs described below.

In addition to using software tokens for TLS and PIN encryption it is possible to store the tokens in hardware security modules (HSMs). It is also possible to combine one software token with one stored in HSM. The bootstrap procedure will differ depending on the use of HSM. 

Use the two bootstrap officers soft tokens in the boot kit until you have created two officers, and after that use the smart cards that you have then personalized. For the bootstrap officers, two step signing is disabled.

Create Officer and System CA

To create an Officer and System CA key

  1. Generate a new CA key for the Officer and System CA, according to Create CA key in Certificate Manager.

  2. . In Key name, enter Officer and system CA key. In Device, select an RSA type.

Create Officer and System CA

  1. Use the key Officer and system CA key created in the previous step, to create an Officer and System CA, according to Create CA in Certificate Manager.

  2. In Authority name, enter Officer and system CA.

  3. Do the following selections in the Authority Request dialog box:

  • Issuing CA - select Self-signed

  • Usage - Certificate signing

  • Format - self-signed ca-cert

  • Country - current country

  • Common name - Officer and system CA

  • Organization - current organization

No distribution rule is required but can be added later if necessary.

Create bootstrap officers

Create certificate procedure for officer certificates

To create a certificate procedure:

  1. Create a certificate procedure to be used when issuing smart cards based on the Officer and System CA key. See Create certificate procedure in Certificate Manager.

  2. Do the following selections in the Certificate Procedure Request dialog box:

  • Procedure name - Officer certificates

  • Key usage - do not select any key usage

  • Issuing CA - Officer and System CA

  • CA chain - none

  • Certificate format - rfc5280

  • Set the Validity and Signature algorithm parameters as required.

Create token procedure for officer smart cards

To create a token procedure for smart cards:

  1. Create a token procedure to be used when issuing smart cards based on the certificate procedure you created in the previous step. See Create token procedure in Certificate Manager

  2. Do the following selections in the Token Procedure Request dialog box:

  • Procedure name - Officer cards

  • Storage profile - Smart Card

  • Card serial number - Yes

  • Serial number range - Mandatory

  • PIN procedure - Show PINs in client

  • Issuer certificates - do not store any

  • Certificate procedure - Officer certificates

Smart cards are recommended. If, for some reason, it is not possible to use smart cards, PKCS#12 tokens can also be used as storage profiles.

Personalize two officer smart cards

To personalize two smart cards:

  1. Produce two pre-personalized smart cards in your Key Generation System (KGS). See Produce smart cards in Certificate Manager.

  2. Register the two smart cards with information concerning two subjects who should become officers 1 and 2 of your system. See Issue smart card certificate in Certificate Manager.

  3. In the Smart Card tab of the Registration Authority application window, do the following steps for each of the two cards:

    1. Select action Add for each displayed key.

    2. Select the procedure you created in the previous step.

  4. Make a note of the PIN codes assigned for the cards.

If PKCS#12 has been chosen as storage profile in the token procedure, use the Soft Token tab in Registration Authority (RA) to issue certificates for your officers. If you use PKCS#12 officer tokens it is recommended to store the associated keys in an HSM.

Create two officers

To create two officers:

Create certificate procedure for TLS, KAR and PIN encryption

To create a certificate procedure for TLS, KAR and PIN encryption:

  • Create a certificate procedure according to Create certificate procedure in Certificate Manager.

    Use the following parameters:

    • Key usage - do not select any key usage

    • Issuing CA - Officer and System CA

    • Certificate format - server certificate

    • Set the Validity and Signature algorithm parameters as required.

It is normally not necessary to select distribution rules for these certificates.

Set up tokens for secure system communication

You can create hardware tokens or software tokens for TLS and PIN encryption.

Create hardware tokens for TLS and PIN encryption

These tasks are related to administrative system hardware tokens only, when a hardware security module (HSM) is used. Hardware tokens are an alternative to software tokens.

Create a token procedure with storage profile PKCS#10

To create a token procedure with storage profile PKCS#10:

  • Create a token procedure, according to Create token procedure in Certificate Manager.

    Use the following parameters:

    • Storage profile - PKCS#10

    • Issuer certificates - do not store any

    • Certificate procedures - the certificate procedure created for TLS, KAR and PIN encryption.

Prepare hardware security module for TLS token

To prepare the hardware security module (HSM) for TLS tokens:

  1. Run hwsetup to generate a key pair with sign property, according to Generate DSA/EC/RSA key pair.

    Example: hwsetup -libname crypto -slot 0 -pin abcd -id tls -genrsa 2048 -sign

  2. Run hwsetup to create a PKCS #10 request based on the generated key pair, according to Generate PKCS #10 certificate request. Include the key usage extension.

    Example, (on one line): hwsetup -libname crypto -slot 0 -pin abcd -id tls -keyusage -genreq "cn=localhost,o=Nexus"

  3. Use RA to issue a certificate to a file, tls.crt, based on the PKCS #10 request.

  4. Run hwsetup to store the certificate in HSM, according to Install certificate.

Prepare hardware security module for PIN encryption token

To prepare the hardware security module (HSM) for PIN encryption tokens:

  1. Run hwsetup to generate an RSA key pair, according to Generate DSA/EC/RSA key pair. The private key needs the sign property to sign the PKCS #10 request.

    Example: hwsetup -libname crypto -slot 0 -pin abcd -id pin -genrsa 2048

  2. Run hwsetup to create a PKCS #10 request based on the generated key pair, according to Generate PKCS #10 certificate request. Include key usage extension with dataEncipherment.

    Example: hwsetup -libname crypto -slot 0 -pin abcd -id pin -keyusage dataEncipherment -genreq "cn=PIN encryption,o=Nexus"

  3. Use RA to issue a certificate to a file, pin.crt, based on the PKCS #10 request.

  4. Run hwsetup to store the certificate in the HSM, according to Install certificate.

Prepare hardware security module for KAR token

This step is only performed if the key archiving and recovery (KAR) option has been licensed and enabled during installation.

The purpose of this step is to create a key encryption key (KEK). The KEK is used by the KARFactory in order to encrypt and decrypt archived keys. The KEK can be either a symmetric AES or DES3 key or an asymmetric RSA key pair.

AES or DES3 key

  1. Run hwsetup to generate a symmetric AES or DES3 key, see Generate AES or 3DES key.
    Example: hwsetup -libname crypto -slot 0 -pin abcd -id kekaes256 -label kekaes256 -genkey AES-256

RSA keypair

  1. Run hwsetup to generate an asymmetric RSA key pair, see Generate DSA/EC/RSA key pair. The private key needs the sign property to sign the PKCS #10 request.
    Example: hwsetup -libname crypto -slot 0 -pin abcd -id kekrsa -label kekrsa -genrsa 2048

  2. Run hwsetup to create a PKCS #10 request based on the generated key pair (see Generate PKCS #10 certificate request). Include key usage extension with keyEncipherment and dataEncipherment.
    Example: hwsetup -libname crypto -slot 0 -pin abcd -id kekrsa -keyusage "keyEncipherment,dataEncipherment" -genreq "cn=KEK,o=Nexus"

  3. Use RA to issue a certificate to a file, kek.crt, based on the PKCS #10 request.

  4. Run hwsetup to store the certificate in HSM, according to Install certificate.

Create software tokens for TLS and PIN encryption

These tasks are related to administrative system software tokens only. Software tokens are an alternative to hardware tokens.

Create token procedure for TLS and PIN encryption

To create a token procedure for TLS and PIN encryption:

  • Create a token procedure, according to Create token procedure in Certificate Manager.

    Use the following parameters:

    • Storage profile - PKCS#12

    • Pin procedure - Show PINs in client

    • Issuer certificates - do not store any

    • Certificate procedures - the certificate procedure created for TLS, KAR and PIN encryption.

Issue software token for TLS

To issue a software token for TLS:

  1. Issue a software token based on the token procedure for TLS and PIN encryption, according to Issue software token in Certificate Manager.

  2. Name the file tls.p12.

  3. Make a note of the assigned PIN code.

  4. Save the file to a removable media for use in later tasks.

Elliptic Curve keys using Brainpool curves are not supported for TLS. 

Issue software token for PIN encryption

To issue a software token for PIN encryption:

  1. Issue a software token based on the token procedure for TLS and PIN encryption, according to Issue software token in Certificate Manager.

  2. Name the file pin.p12.

  3. Save the PIN encryption certificate to the file pin.crt.

  4. Make a note of the assigned PIN code.

  5. Save the files to a removable media for use in later tasks.

Prepare data for CIS

Change key for signing logs in Certificate Issuing System (CIS)

Do these preparations for the Certificate Issuing System (CIS):

  1. In AWB, go to Key Registry > In Use > Officer and System CA key, and note the value of Identifier.

  2. Open <configuration_root>/config/cis.conf for editing.

  3. Find the parameter logsignkey and set it to the value of Identifier found in the AWB (see step 1).

  4. Place the certificate file in CIS trust store: <configuration_root>/config/cistrust/system_ca.cer.

  5. Remove the Boot CA file from CIS trust store: <configuration_root>/config/cistrust/bootca.cer.

Stop the system

  1. Stop the Nexus Certificate Issuing System (CIS) service (if external CIS service is installed).

  2. Stop the Nexus Certificate Factory (CF) service.

  3. Stop the clients.

If you have installed and started the Nexus SNMP service, you may stop it, but it is not mandatory.

Use tokens for secure system communication

For software token: Change the TLS token

If you have issued a TLS software token, it must be installed and configured in CF (or in all computers running CF and CIS in case of a distributed configuration).

To install and configure the TLS software token:

  1. Make a backup copy of the current file tls.p12 in the CF.

  2. Copy the token from the removable media to replace the old file <configuration_root>/certs/tls.p12.

  3. Set parameter SSL.file and cis.ssl.file in cm.conf and SSL.file in cis.conf to the file path of the TLS soft token file.

  4. Set parameter SSL.pin and cis.ssl.pin in cm.conf and SSL.pin in cis.conf to avoid manual intervention during start of CM servers (also called Optional PIN).

  5. After you have tested that the new TLS server certificate works properly, delete the file tls.p12 from the removable media.

For hardware token: Change the TLS token

If you have prepared a TLS hardware token, it must be installed and configured in CF (or in all computers running CF and CIS in case of a distributed configuration).

To configure the TLS hardware token:

  1. Set parameter SSL.cert and cis.ssl.cert in cm.conf and SSL.cert in cis.conf to a case sensitive string value taken from the Distinguished Name in the TLS server certificate. (Open the file containing the certificate created in "Prepare hardware security module for TLS token" above.)

  2. Set parameter SSL.tokenlabel and cis.ssl.tokenlabel in cm.conf and SSL.tokenlabel in cis.conf to a case sensitive string value taken from the device token label where the certificate/key resides. This task is optional, but it is recommended.

  3. Set parameter pkcs11.<n>, (where <n> is a sequence number for each library starting with 1) in cm.conf and cis.conf to specify the PKCS #11 libraries that should be available for use in TLS authentication and that should be searched for the specified certificate.

  4. Set parameter SSL.pin and cis.ssl.pin in cm.conf and SSL.pin in cis.conf to avoid manual intervention during start of CM servers (also called Optional PIN).

  5. Set parameter SSL.nopin=true in cm.conf and cis.conf to avoid showing unnecessary dialogs when the HSM has a PIN pad or if it does not require a PIN code.

For software token: Change the PIN encryption token

If you have issued PIN encryption software tokens, they must be installed and configured in the CF.

To install and configure the PIN encryption software tokens:

  1. Make a backup copy of the current pin.p12 file in the CF.

  2. Copy the tokens from the removable media to replace the old file <configuration_root>/certs/pin.p12.

  3. Set parameter pin.file in cm.conf to the file path of the PIN soft token file.

  4. Set parameter pin.pin in cm.conf to avoid manual intervention during start of CM servers (also called Optional PIN).

For hardware token: Change the PIN encryption token

If you have prepared a PIN encryption hardware token, it must be configured in CF.

To configure the PIN encryption hardware token:

  1. Set parameter pin.cert in cm.conf to a case sensitive string value taken from the Distinguished Name in the PIN encryption certificate. (Open the file containing the certificate created in "Prepare hardware security module for PIN encryption token" above.)

  2. Set parameter pin.tokenlabel in cm.conf to a case sensitive string value taken from the device token label where the certificate/key resides. This task is optional, but it is recommended.

  3. Set parameter pkcs11.<n>, (where <n> is a sequence number for each library starting with 1) in cm.conf to specify the PKCS #11 libraries that should be available for use in PIN encryption and that should be searched for the specified certificate.

  4. Set parameter pin.pin in cm.conf to avoid manual intervention during start of CM servers (also called Optional PIN).

  5. Set parameter pin.nopin=true to avoid showing unnecessary dialogs when the HSM has a PIN pad or if it does not require a PIN code.

Optional: Change the KAR token

This step should only be performed if KAR is enabled. The KEK token prepared in "Prepare hardware security module for KAR token" above must be configured in the CF.

  1. In kar.conf, add the crypto library to the list of crypto libraries (in the parameter kar.common.cryptolib.<N>.name).

  2. In kar.conf, add the new KEK to the list of tokens instead of the temporary KEK, that is, change the value of kar.common.token.0.tokenlabel and kar.common.token.0.pin.

  3. In kar.conf, set the new KEK as the key to use for key archiving, that is, change the value of kar.archive.kek.0.tokenlabel and kar.archive.kek.0.keylabel.

The value of kar.archive.kek.0.keylabel must be the label of the key. In case of an RSA key pair, it should be the label of the public key. You can look up the key label using the command hwsetup -list. For more information on hwsetup, see Initializing Hardware Security Module.

Start the system

  1. Start the Nexus CIS service (if external CIS service is installed.

  2. Start the Nexus CF service.

Remove Nexus boot components

Revoke the Boot CA

When everything works as expected, you can revoke the Boot CA. The bootstrap officers are prevented from logging in to Certificate Manager when revoking the Boot CA.

To revoke the Boot CA:

  1. Test all connections to verify that everything works as expected, for example:

    1. Sign in to AWB with one of the new bootstrap officers.

    2. Do an update and sign it, to test that both bootstrap officers function as expected.

  2. Use the Revoke Authority command in the Tools menu to revoke the Boot CA with revocation reason Cessation of Operation.

Remove the Boot CA key

From the AWB, remove the Boot CA key, (which can be found in the “Retired keys” subgroup in the Key Registry), as described in Modify CA key in Certificate Manager.

After removing this CA key, any procedures created with the Boot CA key can no longer be used and CIS log entries signed with this key can no longer be verified.

Additional information

JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.

Contact Support Close