{"type":"doc","content":[{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"This article includes updates for Certificate Manager 8.11.","type":"text"}]}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":664,"widthType":"pixel"},"content":[{"type":"media","attrs":{"width":1148,"id":"5b1ca609-cef1-49b7-9107-84250fe0f6b9","collection":"contentId-65350135","type":"file","height":395}}]},{"type":"paragraph","content":[{"text":"The shaded objects show the foundation of the Certificate Manager PKI environment, which is created in the bootstrap procedure. ","type":"text"}]},{"type":"paragraph","content":[{"text":"This article describes how to bootstrap ","type":"text"},{"text":"Smart ID Certificate Manager","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65346056"}}]},{"text":". ","type":"text"}]},{"type":"paragraph","content":[{"text":"The purpose of the bootstrap procedure is to build the foundation for a PKI environment, including certificate authorities (CAs) and officers, and revoke the bootstrap CA. A bootstrapping must be performed after a new system installation, before the system can be used for production of certificates. ","type":"text"}]},{"type":"paragraph","content":[{"text":"When performing the bootstrap procedure you will be using the two Certificate Manager clients ","type":"text"},{"text":"Administrator's workbench (AWB)","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65354371"}}]},{"text":" and ","type":"text"},{"text":"Registration Authority (RA) in Certificate Manager","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65354916"}}]},{"text":", as well as other utility programs described below.","type":"text"}]},{"type":"paragraph","content":[{"text":"In addition to using software tokens for TLS and PIN encryption it is possible to store the tokens in hardware security modules (HSMs). It is also possible to combine one software token with one stored in HSM. The bootstrap procedure will differ depending on the use of HSM. ","type":"text"}]},{"type":"panel","attrs":{"panelType":"note"},"content":[{"type":"paragraph","content":[{"text":"Use the two bootstrap officers soft tokens in the boot kit until you have created two officers, and after that use the smart cards that you have then personalized. For the bootstrap officers, two step signing is disabled.","type":"text"}]}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Create Officer and System CA","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"To create an Officer and System CA key","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Generate a new CA key for the ","type":"text"},{"text":"Officer and System CA","type":"text","marks":[{"type":"strong"}]},{"text":", according to ","type":"text"},{"text":"Create CA key in Certificate Manager","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65358197"}}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":". In ","type":"text"},{"text":"Key name","type":"text","marks":[{"type":"strong"}]},{"text":", enter ","type":"text"},{"text":"Officer and system CA key. ","type":"text","marks":[{"type":"code"}]},{"text":"In ","type":"text"},{"text":"Device","type":"text","marks":[{"type":"strong"}]},{"text":", select an ","type":"text"},{"text":"RSA","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":" type.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Create Officer and System CA","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Use the key ","type":"text"},{"text":"Officer and system CA key","type":"text","marks":[{"type":"code"}]},{"text":" created in the previous step, to create an ","type":"text"},{"text":"Officer and System CA","type":"text","marks":[{"type":"strong"}]},{"text":", according to ","type":"text"},{"text":"Create CA in Certificate Manager","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65357462"}}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In ","type":"text"},{"text":"Authority name","type":"text","marks":[{"type":"strong"}]},{"text":", enter ","type":"text"},{"text":"Officer and system CA","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Do the following selections in the ","type":"text"},{"text":"Authority Request","type":"text","marks":[{"type":"strong"}]},{"text":" dialog box:","type":"text"}]}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Issuing CA","type":"text","marks":[{"type":"strong"}]},{"text":" - select ","type":"text"},{"text":"Self-signed","type":"text","marks":[{"type":"strong"},{"type":"em"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Usage","type":"text","marks":[{"type":"strong"}]},{"text":" - ","type":"text"},{"text":"Certificate signing","type":"text","marks":[{"type":"strong"},{"type":"em"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Format","type":"text","marks":[{"type":"strong"}]},{"text":" - self-signed ca-cert","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Country","type":"text","marks":[{"type":"strong"}]},{"text":" - current country","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Common name","type":"text","marks":[{"type":"strong"}]},{"text":" - ","type":"text"},{"text":"Officer and system CA","type":"text","marks":[{"type":"strong"},{"type":"em"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Organization","type":"text","marks":[{"type":"strong"}]},{"text":" - current organization","type":"text"}]}]}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"No distribution rule is required but can be added later if necessary.","type":"text"}]}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Create bootstrap officers","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Create certificate procedure for officer certificates","type":"text"}]},{"type":"paragraph","content":[{"text":"To create a certificate procedure:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create a certificate procedure to be used when issuing smart cards based on the ","type":"text"},{"text":"Officer and System CA key","type":"text","marks":[{"type":"code"}]},{"text":". See ","type":"text"},{"text":"Create certificate procedure in Certificate Manager","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65357601"}}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Do the following selections in the ","type":"text"},{"text":"Certificate Procedure Request","type":"text","marks":[{"type":"strong"}]},{"text":" dialog box:","type":"text"}]}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Procedure name","type":"text","marks":[{"type":"strong"}]},{"text":" - ","type":"text"},{"text":"Officer certificates","type":"text","marks":[{"type":"strong"},{"type":"em"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Key usage","type":"text","marks":[{"type":"strong"}]},{"text":" - do not select any key usage","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Issuing CA","type":"text","marks":[{"type":"strong"}]},{"text":" - ","type":"text"},{"text":"Officer and System CA","type":"text","marks":[{"type":"strong"},{"type":"em"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"CA chain","type":"text","marks":[{"type":"strong"}]},{"text":" - none","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Certificate format","type":"text","marks":[{"type":"strong"}]},{"text":" - ","type":"text"},{"text":"rfc5280","type":"text","marks":[{"type":"strong"},{"type":"em"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set the ","type":"text"},{"text":"Validity","type":"text","marks":[{"type":"strong"}]},{"text":" and ","type":"text"},{"text":"Signature algorithm","type":"text","marks":[{"type":"strong"}]},{"text":" parameters as required.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Create token procedure for officer smart cards","type":"text"}]},{"type":"paragraph","content":[{"text":"To create a token procedure for smart cards:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create a token procedure to be used when issuing smart cards based on the certificate procedure you created in the previous step. See ","type":"text"},{"text":"Create token procedure in Certificate Manager","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65357444"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Do the following selections in the ","type":"text"},{"text":"Token Procedure Request","type":"text","marks":[{"type":"strong"}]},{"text":" dialog box:","type":"text"}]}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Procedure name","type":"text","marks":[{"type":"strong"}]},{"text":" - ","type":"text"},{"text":"Officer cards","type":"text","marks":[{"type":"strong"},{"type":"em"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Storage profile","type":"text","marks":[{"type":"strong"}]},{"text":" - ","type":"text"},{"text":"Smart Card","type":"text","marks":[{"type":"strong"},{"type":"em"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Card serial number","type":"text","marks":[{"type":"strong"}]},{"text":" - ","type":"text"},{"text":"Yes","type":"text","marks":[{"type":"strong"},{"type":"em"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Serial number range","type":"text","marks":[{"type":"strong"}]},{"text":" - Mandatory","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"PIN procedure","type":"text","marks":[{"type":"strong"}]},{"text":" - ","type":"text"},{"text":"Show PINs in client","type":"text","marks":[{"type":"strong"},{"type":"em"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Issuer certificates","type":"text","marks":[{"type":"strong"}]},{"text":" - do not store any","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Certificate procedure","type":"text","marks":[{"type":"strong"}]},{"text":" - ","type":"text"},{"text":"Officer certificates","type":"text","marks":[{"type":"strong"},{"type":"em"}]}]}]}]},{"type":"panel","attrs":{"panelType":"note"},"content":[{"type":"paragraph","content":[{"text":"Smart cards are recommended. If, for some reason, it is not possible to use smart cards, PKCS#12 tokens can also be used as storage profiles.","type":"text"}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Personalize two officer smart cards","type":"text"}]},{"type":"paragraph","content":[{"text":"To personalize two smart cards:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Produce two pre-personalized smart cards in your Key Generation System (KGS). See ","type":"text"},{"text":"Produce smart cards in Certificate Manager","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65353118"}}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Register the two smart cards with information concerning two subjects who should become officers 1 and 2 of your system. See ","type":"text"},{"text":"Issue smart card certificate in Certificate Manager","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65352743"}}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the ","type":"text"},{"text":"Smart Card","type":"text","marks":[{"type":"strong"}]},{"text":" tab of the ","type":"text"},{"text":"Registration Authority","type":"text","marks":[{"type":"strong"}]},{"text":" application window, do the following steps for each of the two cards:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Select action ","type":"text"},{"text":"Add","type":"text","marks":[{"type":"strong"}]},{"text":" for each displayed key.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Select the procedure you created in the previous step.","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Make a note of the PIN codes assigned for the cards.","type":"text"}]}]}]},{"type":"panel","attrs":{"panelType":"note"},"content":[{"type":"paragraph","content":[{"text":"If PKCS#12 has been chosen as storage profile in the token procedure, use the ","type":"text"},{"text":"Soft Token ","type":"text","marks":[{"type":"strong"}]},{"text":"tab in Registration Authority (RA) to issue certificates for your officers. If you use PKCS#12 officer tokens it is recommended to store the associated keys in an HSM.","type":"text"}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Create two officers","type":"text"}]},{"type":"paragraph","content":[{"text":"To create two officers:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create two officers based on the smart cards from the previous step. See ","type":"text"},{"text":"Create officer profile in Certificate Manager","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65358730"}}]},{"text":" and ","type":"text"},{"text":"Create officer in Certificate Manager","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65357906"}}]},{"text":".","type":"text"}]},{"type":"paragraph","content":[{"text":"Any certificate on the smart card may be selected in the ","type":"text"},{"text":"Officer Request","type":"text","marks":[{"type":"strong"}]},{"text":" dialog box.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Create certificate procedure for TLS, KAR and PIN encryption","type":"text"}]},{"type":"paragraph","content":[{"text":"To create a certificate procedure for TLS, KAR and PIN encryption:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create a certificate procedure according to ","type":"text"},{"text":"Create certificate procedure in Certificate Manager","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65357601"}}]},{"text":".","type":"text"}]},{"type":"paragraph","content":[{"text":"Use the following parameters:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Key usage","type":"text","marks":[{"type":"strong"}]},{"text":" - do not select any key usage","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Issuing CA","type":"text","marks":[{"type":"strong"}]},{"text":" - ","type":"text"},{"text":"Officer and System CA","type":"text","marks":[{"type":"strong"},{"type":"em"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Certificate format","type":"text","marks":[{"type":"strong"}]},{"text":" - ","type":"text"},{"text":"server certificate","type":"text","marks":[{"type":"strong"},{"type":"em"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set the ","type":"text"},{"text":"Validity","type":"text","marks":[{"type":"strong"}]},{"text":" and ","type":"text"},{"text":"Signature algorithm","type":"text","marks":[{"type":"strong"}]},{"text":" parameters as required.","type":"text"}]}]}]}]}]},{"type":"panel","attrs":{"panelType":"note"},"content":[{"type":"paragraph","content":[{"text":"It is normally not necessary to select distribution rules for these certificates.","type":"text"}]}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Set up tokens for secure system communication","type":"text"}]},{"type":"paragraph","content":[{"text":"You can create hardware tokens or software tokens for TLS and PIN encryption.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Create hardware tokens for TLS and PIN encryption","type":"text"}]},{"type":"paragraph","content":[{"text":"These tasks are related to administrative system hardware tokens only, when a hardware security module (HSM) is used. Hardware tokens are an alternative to software tokens.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Create a token procedure with storage profile PKCS#10","type":"text"}]},{"type":"paragraph","content":[{"text":"To create a token procedure with storage profile PKCS#10:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create a token procedure, according to ","type":"text"},{"text":"Create token procedure in Certificate Manager","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65357444"}}]},{"text":".","type":"text"}]},{"type":"paragraph","content":[{"text":"Use the following parameters:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Storage profile","type":"text","marks":[{"type":"strong"}]},{"text":" - ","type":"text"},{"text":"PKCS#10","type":"text","marks":[{"type":"strong"},{"type":"em"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Issuer certificates","type":"text","marks":[{"type":"strong"}]},{"text":" - do not store any","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Certificate procedures","type":"text","marks":[{"type":"strong"}]},{"text":" - the certificate procedure created for TLS, KAR and PIN encryption.","type":"text"}]}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Prepare hardware security module for TLS token","type":"text"}]},{"type":"paragraph","content":[{"text":"To prepare the hardware security module (HSM) for TLS tokens:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Run ","type":"text"},{"text":"hwsetup","type":"text","marks":[{"type":"strong"}]},{"text":" to generate a key pair with sign property, according to ","type":"text"},{"text":"Generate DSA/EC/RSA key pair","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65357263"}}]},{"text":".","type":"text"}]},{"type":"paragraph","content":[{"text":"Example: ","type":"text"},{"text":"hwsetup -libname crypto -slot 0 -pin abcd -id tls -genrsa 2048 -sign","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Run ","type":"text"},{"text":"hwsetup","type":"text","marks":[{"type":"strong"}]},{"text":" to create a PKCS #10 request based on the generated key pair, according to ","type":"text"},{"text":"Generate PKCS #10 certificate request","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65357078"}}]},{"text":". Include the key usage extension.","type":"text"}]},{"type":"paragraph","content":[{"text":"Example, (on one line): ","type":"text"},{"text":"hwsetup -libname crypto -slot 0 -pin abcd -id tls -keyusage -genreq \"cn=localhost,o=Nexus\"","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Use RA to issue a certificate to a file, ","type":"text"},{"text":"tls.crt","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":", based on the PKCS #10 request.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Run ","type":"text"},{"text":"hwsetup","type":"text","marks":[{"type":"strong"}]},{"text":" to store the certificate in HSM, according to ","type":"text"},{"text":"Install certificate","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65357363"}}]},{"text":".","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Prepare hardware security module for PIN encryption token","type":"text"}]},{"type":"paragraph","content":[{"text":"To prepare the hardware security module (HSM) for PIN encryption tokens:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Run ","type":"text"},{"text":"hwsetup","type":"text","marks":[{"type":"strong"}]},{"text":" to generate an RSA key pair, according to ","type":"text"},{"text":"Generate DSA/EC/RSA key pair","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65357263"}}]},{"text":". The private key needs the sign property to sign the PKCS #10 request.","type":"text"}]},{"type":"paragraph","content":[{"text":"Example: ","type":"text"},{"text":"hwsetup -libname crypto -slot 0 -pin abcd -id pin -genrsa 2048","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Run ","type":"text"},{"text":"hwsetup","type":"text","marks":[{"type":"strong"}]},{"text":" to create a PKCS #10 request based on the generated key pair, according to ","type":"text"},{"text":"Generate PKCS #10 certificate request","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65357078"}}]},{"text":". Include key usage extension with ","type":"text"},{"text":"dataEncipherment","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]},{"type":"paragraph","content":[{"text":"Example: ","type":"text"},{"text":"hwsetup -libname crypto -slot 0 -pin abcd -id pin -keyusage dataEncipherment -genreq \"cn=PIN encryption,o=Nexus\"","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Use RA to issue a certificate to a file, ","type":"text"},{"text":"pin.crt","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":", based on the PKCS #10 request.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Run ","type":"text"},{"text":"hwsetup","type":"text","marks":[{"type":"strong"}]},{"text":" to store the certificate in the HSM, according to ","type":"text"},{"text":"Install certificate","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65357363"}}]},{"text":".","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Prepare hardware security module for KAR token","type":"text"}]},{"type":"paragraph","content":[{"text":"This step is only performed if the key archiving and recovery (KAR) option has been licensed and enabled during installation.","type":"text"}]},{"type":"paragraph","content":[{"text":"The purpose of this step is to create a key encryption key (KEK). The KEK is used by the KARFactory in order to encrypt and decrypt archived keys. The KEK can be either a symmetric AES or DES3 key or an asymmetric RSA key pair.","type":"text"}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"AES or DES3 key","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Run ","type":"text"},{"text":"hwsetup","type":"text","marks":[{"type":"strong"}]},{"text":" to generate a symmetric AES or DES3 key, see ","type":"text"},{"text":"Generate AES or 3DES key","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65357181"}}]},{"text":".","type":"text"},{"type":"hardBreak"},{"text":"Example: ","type":"text"},{"text":"hwsetup -libname crypto -slot 0 -pin abcd -id kekaes256 -label kekaes256 -genkey AES-256","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"RSA keypair","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Run ","type":"text"},{"text":"hwsetup","type":"text","marks":[{"type":"strong"}]},{"text":" to generate an asymmetric RSA key pair, see ","type":"text"},{"text":"Generate DSA/EC/RSA key pair","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65357263"}}]},{"text":". The private key needs the sign property to sign the PKCS #10 request.","type":"text"},{"type":"hardBreak"},{"text":"Example: ","type":"text"},{"text":"hwsetup -libname crypto -slot 0 -pin abcd -id kekrsa -label kekrsa -genrsa 2048","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Run ","type":"text"},{"text":"hwsetup","type":"text","marks":[{"type":"strong"}]},{"text":" to create a PKCS #10 request based on the generated key pair (see ","type":"text"},{"text":"Generate PKCS #10 certificate request","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65357078"}}]},{"text":"). Include key usage extension with ","type":"text"},{"text":"keyEncipherment","type":"text","marks":[{"type":"code"}]},{"text":" and ","type":"text"},{"text":"dataEncipherment","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"},{"type":"hardBreak"},{"text":"Example: ","type":"text"},{"text":"hwsetup -libname crypto -slot 0 -pin abcd -id kekrsa -keyusage \"keyEncipherment,dataEncipherment\" -genreq \"cn=KEK,o=Nexus\"","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Use RA to issue a certificate to a file, ","type":"text"},{"text":"kek.crt","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":", based on the PKCS #10 request.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Run ","type":"text"},{"text":"hwsetup","type":"text","marks":[{"type":"strong"}]},{"text":" to store the certificate in HSM, according to ","type":"text"},{"text":"Install certificate","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65357363"}}]},{"text":".","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Create software tokens for TLS and PIN encryption","type":"text"}]},{"type":"paragraph","content":[{"text":"These tasks are related to administrative system software tokens only. Software tokens are an alternative to hardware tokens.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Create token procedure for TLS and PIN encryption","type":"text"}]},{"type":"paragraph","content":[{"text":"To create a token procedure for TLS and PIN encryption:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create a token procedure, according to ","type":"text"},{"text":"Create token procedure in Certificate Manager","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65357444"}}]},{"text":".","type":"text"}]},{"type":"paragraph","content":[{"text":"Use the following parameters:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Storage profile","type":"text","marks":[{"type":"strong"}]},{"text":" - ","type":"text"},{"text":"PKCS#12","type":"text","marks":[{"type":"strong"},{"type":"em"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Pin procedure","type":"text","marks":[{"type":"strong"}]},{"text":" - ","type":"text"},{"text":"Show PINs in client","type":"text","marks":[{"type":"strong"},{"type":"em"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Issuer certificates","type":"text","marks":[{"type":"strong"}]},{"text":" - do not store any","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Certificate procedures","type":"text","marks":[{"type":"strong"}]},{"text":" - the certificate procedure created for TLS, KAR and PIN encryption.","type":"text"}]}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Issue software token for TLS","type":"text"}]},{"type":"paragraph","content":[{"text":"To issue a software token for TLS:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Issue a software token based on the token procedure for TLS and PIN encryption, according to ","type":"text"},{"text":"Issue software token in Certificate Manager","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65354891"}}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Name the file ","type":"text"},{"text":"tls.p12","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Make a note of the assigned PIN code.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Save the file to a removable media for use in later tasks.","type":"text"}]}]}]},{"type":"panel","attrs":{"panelType":"note"},"content":[{"type":"paragraph","content":[{"text":"Elliptic Curve keys using Brainpool curves are not supported for TLS. ","type":"text"}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Issue software token for PIN encryption","type":"text"}]},{"type":"paragraph","content":[{"text":"To issue a software token for PIN encryption:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Issue a software token based on the token procedure for TLS and PIN encryption, according to ","type":"text"},{"text":"Issue software token in Certificate Manager","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65354891"}}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Name the file ","type":"text"},{"text":"pin.p12","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Save the PIN encryption certificate to the file ","type":"text"},{"text":"pin.crt","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Make a note of the assigned PIN code.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Save the files to a removable media for use in later tasks.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Prepare data for CIS","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Change key for signing logs in Certificate Issuing System (CIS)","type":"text"}]},{"type":"paragraph","content":[{"text":"Do these preparations for the Certificate Issuing System (CIS):","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In AWB, go to ","type":"text"},{"text":"Key Registry > In Use > Officer and System CA key","type":"text","marks":[{"type":"strong"}]},{"text":", and note the value of ","type":"text"},{"text":"Identifier","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Open ","type":"text"},{"text":"/config/cis.conf","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":" for editing.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Find the parameter ","type":"text"},{"text":"logsignkey","type":"text","marks":[{"type":"code"}]},{"text":" and set it to the value of ","type":"text"},{"text":"Identifier","type":"text","marks":[{"type":"strong"}]},{"text":" found in the AWB (see step 1).","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Place the certificate file in CIS trust store: ","type":"text"},{"text":"/config/cistrust/system_ca.cer","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Remove the Boot CA file from CIS trust store: ","type":"text"},{"text":"/config/cistrust/bootca.cer","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":".","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Stop the system","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Stop the Nexus Certificate Issuing System (CIS) service (if external CIS service is installed).","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Stop the Nexus Certificate Factory (CF) service.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Stop the clients.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"If you have installed and started the Nexus SNMP service, you may stop it, but it is not mandatory.","type":"text"}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Use tokens for secure system communication","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"For software token: Change the TLS token","type":"text"}]},{"type":"paragraph","content":[{"text":"If you have issued a TLS software token, it must be installed and configured in CF (or in all computers running CF and CIS in case of a distributed configuration).","type":"text"}]},{"type":"paragraph","content":[{"text":"To install and configure the TLS software token:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Make a backup copy of the current file ","type":"text"},{"text":"tls.p12","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":" in the CF.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Copy the token from the removable media to replace the old file ","type":"text"},{"text":"/certs/tls.p12","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set parameter ","type":"text"},{"text":"SSL.file","type":"text","marks":[{"type":"code"}]},{"text":" and ","type":"text"},{"text":"cis.ssl.file","type":"text","marks":[{"type":"code"}]},{"text":" in ","type":"text"},{"text":"cm.conf","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":" and ","type":"text"},{"text":"SSL.file","type":"text","marks":[{"type":"code"}]},{"text":" in ","type":"text"},{"text":"cis.conf","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":" to the file path of the TLS soft token file.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set parameter ","type":"text"},{"text":"SSL.pin","type":"text","marks":[{"type":"code"}]},{"text":" and ","type":"text"},{"text":"cis.ssl.pin","type":"text","marks":[{"type":"code"}]},{"text":" in ","type":"text"},{"text":"cm.conf","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":" and ","type":"text"},{"text":"SSL.pin","type":"text","marks":[{"type":"code"}]},{"text":" in ","type":"text"},{"text":"cis.conf","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":" to avoid manual intervention during start of CM servers (also called Optional PIN).","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"After you have tested that the new TLS server certificate works properly, delete the file ","type":"text"},{"text":"tls.p12","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":" ","type":"text","marks":[{"type":"em"}]},{"text":"from the removable media.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"For hardware token: Change the TLS token","type":"text"}]},{"type":"paragraph","content":[{"text":"If you have prepared a TLS hardware token, it must be installed and configured in CF (or in all computers running CF and CIS in case of a distributed configuration).","type":"text"}]},{"type":"paragraph","content":[{"text":"To configure the TLS hardware token:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set parameter ","type":"text"},{"text":"SSL.cert","type":"text","marks":[{"type":"code"}]},{"text":" and ","type":"text"},{"text":"cis.ssl.cert","type":"text","marks":[{"type":"code"}]},{"text":" in ","type":"text"},{"text":"cm.conf","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":" and ","type":"text"},{"text":"SSL.cert","type":"text","marks":[{"type":"code"}]},{"text":" in ","type":"text"},{"text":"cis.conf","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":" to a case sensitive string value taken from the Distinguished Name in the TLS server certificate. (Open the file containing the certificate created in \"Prepare hardware security module for TLS token\" above.)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set parameter ","type":"text"},{"text":"SSL.tokenlabel","type":"text","marks":[{"type":"code"}]},{"text":" and ","type":"text"},{"text":"cis.ssl.tokenlabel","type":"text","marks":[{"type":"code"}]},{"text":" in ","type":"text"},{"text":"cm.conf","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":" and ","type":"text"},{"text":"SSL.tokenlabel","type":"text","marks":[{"type":"code"}]},{"text":" in ","type":"text"},{"text":"cis.conf","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":" to a case sensitive string value taken from the device token label where the certificate/key resides. This task is optional, but it is recommended.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set parameter ","type":"text"},{"text":"pkcs11.","type":"text","marks":[{"type":"code"}]},{"text":", (where ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" is a sequence number for each library starting with 1) in ","type":"text"},{"text":"cm.conf","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":" and ","type":"text"},{"text":"cis.conf","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":" to specify the PKCS #11 libraries that should be available for use in TLS authentication and that should be searched for the specified certificate.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set parameter ","type":"text"},{"text":"SSL.pin","type":"text","marks":[{"type":"code"}]},{"text":" and ","type":"text"},{"text":"cis.ssl.pin","type":"text","marks":[{"type":"code"}]},{"text":" in ","type":"text"},{"text":"cm.conf","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":" and ","type":"text"},{"text":"SSL.pin","type":"text","marks":[{"type":"code"}]},{"text":" in ","type":"text"},{"text":"cis.conf","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":" to avoid manual intervention during start of CM servers (also called Optional PIN).","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set parameter ","type":"text"},{"text":"SSL.nopin","type":"text","marks":[{"type":"code"}]},{"text":"=true in ","type":"text"},{"text":"cm.conf","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":" and ","type":"text"},{"text":"cis.conf","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":" to avoid showing unnecessary dialogs when the HSM has a PIN pad or if it does not require a PIN code.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"For software token: Change the PIN encryption token","type":"text"}]},{"type":"paragraph","content":[{"text":"If you have issued PIN encryption software tokens, they must be installed and configured in the CF.","type":"text"}]},{"type":"paragraph","content":[{"text":"To install and configure the PIN encryption software tokens:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Make a backup copy of the current ","type":"text"},{"text":"pin.p12","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":" file in the CF.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Copy the tokens from the removable media to replace the old file ","type":"text"},{"text":"/certs/pin.p12","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set parameter ","type":"text"},{"text":"pin.file","type":"text","marks":[{"type":"code"}]},{"text":" in ","type":"text"},{"text":"cm.conf","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":" to the file path of the PIN soft token file.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set parameter ","type":"text"},{"text":"pin.pin","type":"text","marks":[{"type":"code"}]},{"text":" in ","type":"text"},{"text":"cm.conf","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":" to avoid manual intervention during start of CM servers (also called Optional PIN).","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"For hardware token: Change the PIN encryption token","type":"text"}]},{"type":"paragraph","content":[{"text":"If you have prepared a PIN encryption hardware token, it must be configured in CF.","type":"text"}]},{"type":"paragraph","content":[{"text":"To configure the PIN encryption hardware token:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set parameter ","type":"text"},{"text":"pin.cert","type":"text","marks":[{"type":"code"}]},{"text":" in ","type":"text"},{"text":"cm.conf","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":" to a case sensitive string value taken from the Distinguished Name in the PIN encryption certificate. (Open the file containing the certificate created in \"Prepare hardware security module for PIN encryption token\" above.)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set parameter ","type":"text"},{"text":"pin.tokenlabel","type":"text","marks":[{"type":"code"}]},{"text":" in ","type":"text"},{"text":"cm.conf","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":" to a case sensitive string value taken from the device token label where the certificate/key resides. This task is optional, but it is recommended.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set parameter ","type":"text"},{"text":"pkcs11.","type":"text","marks":[{"type":"code"}]},{"text":", (where ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" is a sequence number for each library starting with 1) in ","type":"text"},{"text":"cm.conf","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":" to specify the PKCS #11 libraries that should be available for use in PIN encryption and that should be searched for the specified certificate.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set parameter ","type":"text"},{"text":"pin.pin","type":"text","marks":[{"type":"code"}]},{"text":" in ","type":"text"},{"text":"cm.conf","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":" to avoid manual intervention during start of CM servers (also called Optional PIN).","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set parameter ","type":"text"},{"text":"pin.nopin","type":"text","marks":[{"type":"code"}]},{"text":"=true to avoid showing unnecessary dialogs when the HSM has a PIN pad or if it does not require a PIN code.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Optional: Change the KAR token","type":"text"}]},{"type":"paragraph","content":[{"text":"This step should only be performed if KAR is enabled. The KEK token prepared in \"Prepare hardware security module for KAR token\" above must be configured in the CF.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In ","type":"text"},{"text":"kar.conf","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":", add the crypto library to the list of crypto libraries (in the parameter ","type":"text"},{"text":"kar.common.cryptolib..name","type":"text","marks":[{"type":"code"}]},{"text":").","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In ","type":"text"},{"text":"kar.conf","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":", add the new KEK to the list of tokens instead of the temporary KEK, that is, change the value of ","type":"text"},{"text":"kar.common.token.0.tokenlabel","type":"text","marks":[{"type":"code"}]},{"text":" and ","type":"text"},{"text":"kar.common.token.0.pin","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In ","type":"text"},{"text":"kar.conf","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":", set the new KEK as the key to use for key archiving, that is, change the value of ","type":"text"},{"text":"kar.archive.kek.0.tokenlabel","type":"text","marks":[{"type":"code"}]},{"text":" and ","type":"text"},{"text":"kar.archive.kek.0.keylabel","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]}]}]},{"type":"panel","attrs":{"panelType":"note"},"content":[{"type":"paragraph","content":[{"text":"The value of ","type":"text"},{"text":"kar.archive.kek.0.keylabel","type":"text","marks":[{"type":"code"}]},{"text":" must be the label of the key. In case of an RSA key pair, it should be the label of the public key. You can look up the key label using the command ","type":"text"},{"text":"hwsetup -list","type":"text","marks":[{"type":"strong"}]},{"text":". For more information on ","type":"text"},{"text":"hwsetup","type":"text","marks":[{"type":"strong"}]},{"text":", see ","type":"text"},{"text":"Initializing Hardware Security Module","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65355189"}}]},{"text":".","type":"text"}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Start the system","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Start the Nexus CIS service (if external CIS service is installed.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Start the Nexus CF service.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Remove Nexus boot components","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Revoke the Boot CA","type":"text"}]},{"type":"paragraph","content":[{"text":"When everything works as expected, you can revoke the Boot CA. The bootstrap officers are prevented from logging in to Certificate Manager when revoking the Boot CA.","type":"text"}]},{"type":"paragraph","content":[{"text":"To revoke the Boot CA:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Test all connections to verify that everything works as expected, for example:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Sign in to AWB with one of the new bootstrap officers.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Do an update and sign it, to test that both bootstrap officers function as expected.","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Use the ","type":"text"},{"text":"Revoke Authority","type":"text","marks":[{"type":"strong"}]},{"text":" command in the ","type":"text"},{"text":"Tools","type":"text","marks":[{"type":"strong"}]},{"text":" menu to revoke the Boot CA with revocation reason ","type":"text"},{"text":"Cessation of Operation","type":"text","marks":[{"type":"em"}]},{"text":".","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Remove the Boot CA key","type":"text"}]},{"type":"paragraph","content":[{"text":"From the AWB, remove the Boot CA key, (which can be found in the “Retired keys” subgroup in the Key Registry), as described in ","type":"text"},{"text":"Modify CA key in Certificate Manager","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65357012"}}]},{"text":".","type":"text"}]},{"type":"panel","attrs":{"panelType":"note"},"content":[{"type":"paragraph","content":[{"text":"After removing this CA key, any procedures created with the Boot CA key can no longer be used and CIS log entries signed with this key can no longer be verified.","type":"text"}]}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Additional information","type":"text"}]},{"type":"expand","attrs":{"title":"Useful links"},"content":[{"type":"paragraph","content":[{"text":"The following tasks are done during the bootstrapping procedure. ","type":"text"}]},{"type":"paragraph","content":[{"text":"In ","type":"text"},{"text":"Administrator's workbench (AWB)","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65354371"}}]},{"text":":","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create CA key in Certificate Manager","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65358197"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create CA in Certificate Manager","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65357462"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create certificate procedure in Certificate Manager","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65357601"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create token procedure in Certificate Manager","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65357444"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create officer profile in Certificate Manager","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65358730"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create officer in Certificate Manager","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65357906"}}]}]}]}]},{"type":"paragraph","content":[{"text":"Using hwsetup: ","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Initialize Hardware Security Module for use in Certificate Manager","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65355189"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Generate AES or 3DES key","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65357181"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Generate DSA/EC/RSA key pair","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65357263"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Generate PKCS #10 certificate request","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65357078"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Install certificate","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65357363"}}]}]}]}]},{"type":"paragraph","content":[{"text":"In Key Generation System:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Produce smart cards in Certificate Manager","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65353118"}}]}]}]}]},{"type":"paragraph","content":[{"text":"In ","type":"text"},{"text":"Registration Authority (RA) in Certificate Manager","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65354916"}}]},{"text":": ","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Issue smart card certificate in Certificate Manager","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65352743"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Issue software token in Certificate Manager","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65354891"}}]}]}]}]}]},{"type":"paragraph"}],"version":1}