Versions Compared

Version Old Version 43 New Version Current
Changes made by

Ylva Andersson

Ylva Andersson

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: Minor

...

...

...

Remember to update the release version number before publishing externally.

Info

This article includes updates for Smart ID Identity Manager 245.0.R11.

Keys and certificates for the sign and encrypt engine can be stored in a Hardware Security Model (HSM) for several use cases. This is a more secure solution for signing and encryption than PKCS#12 files, which are files in the file system, only protected by a PIN code.

...

For more information, see Configure Tomcat below.

Prerequisites

  • Installed Smart ID 24.R1 IDM 5.0.0 or later

  • Installed and running HSM with PKCS#11 library available on the Identity Manager server

...

Perform the Identity Manager HSM configuration in the file engineSignEncryptConfig.xml in the WEB-INF/classes folder for each of the relevant Identity Manager clients. In case of Docker docker deployment, edit the file docker/compose/identitymanager/config/signencrypt.xml.

...

Configuration attribute

Value

Comments

asymCipher

RSA/ECB/OAEPWithSHA-384AndMGF1Padding

Must be declared so the iD2 provider accepts it:

  • "None" is not supported as cipher mode but , "ECB" is compatible in this scenario and can be used instead

  • In OAEP padding, all SHA-x hashes must be given with a dash in the name

<keys> section:

type name

HSM

Must be "HSM" for keys stored in the HSM.

locationValue

  • Either the absolute path of the HSM's P11 DLL/.so (without extension)
    OR

  • the DLL/.so's filename without extension

pin

The user PIN of the HSM.

The pin.encrypted attribute is also supported to scramble the PIN.

For Docker docker deployments it is required to scramble the PINs before starting the Identity Manager Admin and Identity Manager Operator containers (stop them by invoking docker compose down from within docker/compose/identitymanager/admin and docker/compose/identitymanager/operator, if already running).
This is done by first replacing each pin="thePlainTextPin" with pin.encrypted="thePlainTextPin" and then invoking the following command from within the docker/compose/identitymanager/bootstrap folder: docker compose run --rm scramble_sign_encrypt_config

alias

The alias of the respective key.

In the HSM, the keypair and the certificate must be stored within the same label/alias.

slot

Optional if your keys are stored in HSM slot 0.

The first slot is not guaranteed to be 0. Slot numbering may differ, depending on the HSM.

For more information, see Sign and encrypt engine in Identity Manager for further use cases that can be configured.

...

In addition, you may get a ClassNotFoundException for various BouncyCastle classes in crypto-related use - cases like soft token requests, for example:
Caused by: java.lang.ClassNotFoundException: org.bouncycastle.jce.provider.BouncyCastleProvider

To avoid this, deploy each Identity Manager web app on its own dedicated Tomcat instance (Docker docker deployments always work like this) or remove all CMSDK JARs and all BouncyCastle JARs from all webapps' tomcat\<webapp>\WEB-INF\lib folders and place them in tomcat\libs instead. This ensures that the JARs are served from the Tomcat common classloader for all web apps.

CMSDK JARs:

  • cmcommon*.jar

  • cmsdk-*.jar

  • common-*.jar

BouncyCastle JARs:

  • bcmail-*.jar

  • bcpgp-*.jar

  • bcpkix-*.jar

  • bcprov-*.jar (including bcprov-ext-*.jar)

Additional information

Expand
titleUseful links