Use the two

bootstrap officers soft tokens in the boot kit until you have created two officers, and after that use the smart cards that you have then personalized. For the bootstrap officers, two step signing is disabled.

To create an Officer and System CA key:

1. Generate a new CA key for the Officer and System CA, according to Create CA key.

2. . In Key name, enter Officer and system CA key. In Device, select an RSA type.

To create an Officer and System CA:

1. Use the key Officer and system CA key created in the previous step, to create an Officer and System CA, according to Create CA.

2. In CA name, enter Officer and system CA.

3. Do the following selections in the CA Request dialog box:

• • Issuing CA - select Self-signed

  • Usage - Certificate signing

  • Format - self-signed ca-cert

  • Country - current country

  • Common name - Officer and system CA

  • Organization - current organization

To create a certificate procedure:

1. Create a certificate procedure to be used when issuing smart cards based on the Officer and System CA key. See Create certificate procedure.

2. Do the following selections in the Certificate Procedure Request dialog box:

• • Procedure name - Officer certificates

  • Key usage - do not select any key usage

  • Issuing CA - Officer and System CA

  • CA chain - none

  • Certificate format - rfc5280

  • Set the Validity and Signature algorithm parameters as required.

To create a token procedure for smart cards:

1. Create a token procedure to be used when issuing smart cards based on the certificate procedure you created in the previous step. See Create token procedure

2. Do the following selections in the Token Procedure Request dialog box:

• • Procedure name - Officer cards

  • Storage profile - Smart Card

  • Card serial number - Yes

  • Serial number range - Mandatory

  • PIN procedure - Show PINs in client

  • Issuer certificates - do not store any

  • Certificate procedure - Officer certificates

To personalize two smart cards:

1. Produce two pre-personalized smart cards in your Key Generation System (KGS). See CM8 - Produce smart cards.

2. Register the two smart cards with information concerning two subjects who should become officers 1 and 2 of your system.

   See

   See Issue smart card

   certificates

   certificate.

3. In the Smart Card tab of the Registration Authority application window, do the following steps for each of the two cards:

   1. Select action Add for each displayed key.

   2. Select the procedure you created in the previous step.

4. Make a note of the PIN codes assigned for the cards.

To create two officers:

1. Create two officers based on the smart cards from the previous step. See Create officer profile and Create officer.

   Any certificate on the smart card may be selected in the Officer Request dialog box.

To create a token procedure for SSL TLS and PIN encryption:

1. Create a token procedure, according to Create token procedure.

   Use the following parameters:

   • Storage profile - PKCS#12

   • Pin procedure - Show PINs in client

   • Issuer certificates - do not store any

   • Certificate procedures - the certificate procedure created for

     SSL

     TLS, KAR and PIN encryption.

To issue a software token for SSLTLS:

1. Issue a software token based on the token procedure for

   SSL

   TLS and PIN encryption, according to CM8 - Issue software tokens in Certificate Manager.

2. Name the file

   ssl

   tls.p12.

3. Make a note of the assigned PIN code.

4. Save the file to a removable media for use in later tasks.

To issue a software token for PIN encryption:

1. Issue a software token based on the token procedure for

   SSL

   TLS and PIN encryption, according to CM8 - Issue software tokens in Certificate Manager.

2. Name the file pin.p12.

3. Save the PIN encryption certificate to the file pin.crt.

4. Make a note of the assigned PIN code.

5. Save the files to a removable media for use in later tasks.

To change the key for signing logs in Do these preparations for the Certificate Issuing System (CIS):

1. In AWB, go to Key Registry > In Use > Officer and System CA key, and note the value of Identifier.

2. Open

   <install

   <configuration_root>/config/cis.conf

   for

    for editing.

3. Find the parameter cis.audit.logsignkey and set it to the value of Identifier found in the AWB (see step 1).

To stop the system:

1. Stop the Nexus Certificate Issuing System (CIS) service (if external CIS service is installed).

2. Stop the Nexus Certificate Factory (CF) service (CCM).

3. Stop the clients.

If you have installed and started the Nexus SNMP service, you may stop it, but it is not mandatory.

If you have issued an SSL a TLS software token, it must be installed and configured in the CCM (or in the computers running Certificate Factory (CF) and CRLF CIS in case of a distributed configuration).

To install and configure the SSL TLS software token:

1. Make a backup copy of the current file

   ssl

   tls.p12 in the CCM.

2. Copy the token from the removable media to replace the old file

   <install

   <configuration_root>/certs/

   ssl

   tls.p12.

3. Set parameter parameter SSL.file and cis.ssl.file in cm.conf and SSL.file in cis.conf to the file path of the SSL TLS soft token file.
4. Set parameter SSL.pin and cis.ssl.pin in cm.conf and SSL.pin in cis.conf to avoid manual intervention during start of Certificate Manager CM servers (also called Optional PIN).

5. After you have tested that

   the new SSL server certificate works properly, delete the file ssl.p12 from the removable media.

If you have prepared an SSL a TLS hardware token, it must be configured in the CCM (or in the computers running CF and CRLF CIS in case of a distributed configuration).

To configure the SSL TLS hardware token:

1. Set parameter parameter SSL.cert and cis.ssl.cert in cm.conf and SSL.cert in cis.conf to a case sensitive string value taken from the Common Distinguished Name in the SSL TLS server certificate. (Open the file containing the certificate created in task 12"Prepare hardware security module for TLS token" above.)
2. Set parameter pkcs11.<n>, (where <n> is a sequence number for each library starting with 1) in cm.conf and cis.conf to specify the PKCS #11 libraries that should be available for use in SSL TLS authentication and that should be searched for the specified certificate.
3. Set parameter SSL.pin and cis.ssl.pin in cm.conf and SSL.pin in cis.conf to avoid manual intervention during start of Certificate Manager CM servers (also called Optional PIN).
4. Set parameter ssl SSL.nopin=true true in cm.conf and cis.conf to avoid showing unnecessary dialogs when the HSM has a PIN pad or if it does not require a PIN code.

If you have issued prepared a PIN encryption software tokenshardware token, they it must be installed and configured in the CCM (or in the computers running CF and CRLF CIS in case of a distributed configuration).

To install and configure the PIN encryption software tokenshardware token:

1. Make a backup copy of the current file Set parameter pin.p12 file cert in the CCM.
2. Copy the tokens from the removable media to replace the old file <install_root>/certs/pin.p12.
3. Set parameter pin.file cm.conf to a case sensitive string value taken from the Distinguished Name in the PIN encryption certificate. (Open the file containing the certificate created in "Prepare hardware security module for PIN encryption token" above.)
4. Set parameter pkcs11.<n>, (where <n> is a sequence number for each library starting with 1) in cm.conf to the file path of the PIN soft token filespecify the PKCS #11 libraries that should be available for use in PIN encryption and that should be searched for the specified certificate.

5. Set parameter pin.pin in cm.conf to avoid manual intervention during start of

   Certificate Manager

   CM servers (also called Optional PIN).

6. Set parameter pin.nopin=true to avoid showing unnecessary dialogs when the HSM has a PIN pad or if it does not require a PIN code.

To start the system:

1. Start the Nexus CIS service (if external CIS service is installed.
2. Start the system.
   In case of a distributed configuration, restart the computers running CF and CRLFNexus CF service (CCM).

When everything works as expected, you can revoke the Boot CA. The boot bootstrap officers are prevented from logging in to Certificate Manager when revoking the Boot CA.

To revoke the Boot CA:

1. Test all connections to verify that everything works as expected, for example:

   1. Sign in to AWB with one of the new security bootstrap officers.

   2. Do an update and sign it, to test that both security bootstrap officers function as expected.

2. Use the Revoke CA command in the Tools menu to revoke the Boot CA with revocation reason Cessation of Operation.

From the AWB, remove the Boot CA key, (which can be found in the “Retired keys” subgroup in the Key Registry), as described in “Removing a CA Key” in the Certificate Manager CA Administrator's Guidein Modify CA key.