Prerequisites

Please ensure the following requirements are met

• FortiGate with
  • FortiOS v7.2.8 Special Build 8993 (incorporates the Securosys PKCS#11 Provider v2.2.2) or
  • FortiOS v7.2.8 Special Build 9127 and newer (incorporates the Securosys PKCS#11 Provider v2.2.4)
• Securosys Hardware Security Module, with PKCS#11 API enabled:
  • CloudHSM partition (HSM as a Service) or
  • Primus HSM, firmware v2.8.21 or newer. Contact sales

HSM Setup and Configuration

Cloud

Securosys CloudHSM allows almost instant HSM operation by selecting and contracting the different services and options for your FortiGate.

• Getting started with CloudHSM.
• Contact sales.

The HSM must be initialized, and a specific user (partition) must be set up.

Verify that

• the PKCS#11 API is licensed and enabled, and the PKCS#11 password is defined
• a fresh valid user setup password is retrieved for client onboarding
• the Security Policy is restricted (disable Import/Export/Extract)

On-premises

For general on-premises Primus HSM hardware, High-Availibility Cluster setup and operation in FIPS or Common Criteria certified modes, refer to the corresponding Primus HSM User Guide for details.

Enable PKCS#11 API

The API must be enabled on device and user level.

Device user interface

• Setup Configuration Security Device Security Crypto Policy PKCS#11: enabled
• Setup Configuration Security User Security (user name) PKCS#11: enabled

Console interface

• hsm_sec_set_config pkcs11=true
• hsm_user_set_config pkcs11=true

XML configuration File

  ...
  <pkcs_process>
    <active>enabled</active>
    ...
  </pkcs_process>
  ...
  <crypto_process>
    ...
     <crypto_user state="enabled">                   <!-- enabled=user config, disabled=device config -->
        <user_name>PART001</user_name>               <!-- partition name -->
        <pkcs_allowed>enabled</pkcs_allowed>         <!-- enable PKCS#11, interface on partition -->
     </crypto_user>
    ... 

Set PKCS#11 Password

Assuming that user level configuration is used.

Device user interface

• Setup Configuration Security User Security (user name) PKCS#11 password

Console interface

• hsm_user_set_config pkcs11_pwd

XML configuration File

  ...
  <crypto_process>
    ...
     <crypto_user state="enabled">                   <!-- enabled=user config, disabled=device config -->
        <user_name>PART001</user_name>               <!-- partition name -->
        <pkcs_password>PRIMUSDEV</pkcs_password>     <!-- set partition pwd for PKCS#11 -->
        ...
     </crypto_user>
    ...

Retrieve a New Setup Password

To generate a new setup password for the specific partition

Device user interface

• Roles User New Setup Pw

Console interface

• hsm_user_new_setup_pass

Disable Wrapped Key Export, Key Extract, and Key Import

Device user interface

• Setup Configuration Security User Security (user name) Key export: disabled
• Setup Configuration Security User Security (user name) Key extract: disabled
• Setup Configuration Security User Security (user name) Key import: disabled

Console interface

• hsm_user_set_config key_export=false
• hsm_user_set_config key_extract=false
• hsm_user_set_config key_import=false

XML configuration File

  ...
  </pkcs_process>
  
     <crypto_user state="enabled">                   <!-- enabled=user config, disabled=device config -->
        <user_name>PART001</user_name>               <!-- partition name -->
        ...
        <import_keys>disabled</import_keys>          <!-- disable key import on user -->
        <export_keys>disabled</export_keys>          <!-- disable key export on user -->
        <extract_keys>disabled</extract_keys>        <!-- disable wrapped key export on user -->
        ...
     </crypto_user>
     ...