THIS IS A WORK IN PROGRESS!

Smart ID Identity Manager offers support for HSM (Hardware Security Model) for several use cases:

...

• The library is provided with your Identity Manager package or on request.

• The library exists as 32bit 32 bit and 64bit 64 bit version. The Use the 64 bit version must correspond to the JRE used with the Identity Manager server.

To be accessed, the library needs to be available in the PATH environment variable.

Create a new folder for it and add the folder to the PATH

OR

Copy it to your C:\Windows\System32 folder.

For Docker deployment, libjpkcs11.so needs to be mounted into a suitable folder

...

within the container (location depends on the HSM software).

Configure engineSignEncryptConfig.xml / signencrypt.xml

...

1. To avoid this, you have these options:

   1. Deploy each Identity Manager webapp on its own dedicated Tomcat instance (Docker deployments always work like this).

      OR

   2. Remove all CMSDK JARs and all BouncyCastle JARs from all webapps' tomcat\<webapp>\WEB-INF\lib folders and place them in tomcat\libs instead (this ensures those JARs are served from the Tomcat common classloader for all webapps).

      1. CMSDK JARs:

         • cmcommon*.jar

         • cmsdk-*.jar

         • common-*.jar

      2. BouncyCastle JARs:

         • bcmail-*.jar

         • bcpgp-*.jar

         • bcpkix-*.jar

         • bcprov-*.jar (including bcprov-ext-*.jar)

Additional information