Integration Guide. Microsoft Internet Information Services (IIS) 7.0 and ncipher Modules. Windows Server 2008 (32-bit and 64-bit)

Transcription

1 Integration Guide Microsoft Internet Information Services (IIS) 7.0 and ncipher Modules Windows Server 2008 (32-bit and 64-bit) These installation instructions are intended to provide step-by-step instructions for installing ncipher software with third-party software. These instructions do not cover all situations and are intended as a supplement to the ncipher documentation provided with ncipher products. Disclaimer: ncipher Corporation Ltd disclaims all liabilities regarding third-party products and only provides warranties and liabilities with its own products as addressed in the Terms and Conditions for Sale. ncipher is a registered trademark of ncipher Corporation Limited. Any other trademarks referenced in this document are the property of the respective trademark owners. Copyright 2008 ncipher Corporation Ltd, Cambridge, United Kingdom. Document version May-2008

2 Table of Contents 1. INTRODUCTION OVERVIEW SUPPORTED NCIPHER FUNCTIONALITY REQUIREMENTS PROCEDURES INSTALLING THE NCIPHER HSM INSTALLING THE NCIPHER SUPPORT SOFTWARE (NCSS) RESULTS OF THIS PROCEDURE TO INSTALL NCSS-WIN-USER CREATING THE NCIPHER SECURITY WORLD CREATING THE ADMINISTRATOR CARD SET CREATING THE OPERATOR CARD SET COMPLETING THE SECURITY WORLD SETUP INSTALLING IIS CREATING A CERTIFICATE REQUEST REQUIREMENTS PRELIMINARY STEPS CREATING THE CERTIFICATE REQUEST INSTALLING A CERTIFICATE MAKING THE CERTIFICATE AVAILABLE FOR USE IN IIS BINDING THE CERTIFICATE WITH A SECURE IIS WEB SERVER FURTHER INFORMATION CONTACT DETAILS... 8 Version 1.3, 02-May-2008 Page 1

3 1. Introduction This guide explains how to integrate an ncipher Hardware Security Module (nshield or nethsm) with Microsoft Internet Information Services (IIS) 7.0. It assumes that you have read the nshield Quick Start Guide and the nethsm Quick Start Guide and are familiar with the IIS7 documentation and setup process. Note: All ncipher documentation is available at: 2. Overview The ncipher module integrates with Microsoft IIS 7.0 to provide full key life-cycle management with FIPS-certified hardware and to reduce the cryptographic load on the host server CPU. There are several benefits to using an ncipher module with IIS 7.0: 1. uses hardware validated to the FIPS standards 2. improves server performance by offloading cryptographic processing 3. enables secure storage of the IIS keys 4. enables management of the full life cycle of the keys 5. provides fail-over support where multiple HSMs are available Integration of the ncipher module with IIS 7.0 has been tested in the following configurations: Operating System ncipher Version Microsoft IIS Version nshield Support nethsm Support Windows Server 2008 Enterprise Yes Yes 3. Supported ncipher functionality Softcards Key management Strict FIPS support* Key recovery Module-only key K of N card set Key generation Key import Fail-over Fall back Load balancing Preload support * Microsoft IIS7 does not support Strict FIPS with ECDSA. 4. Requirements Before running the setup program, you need to know: whether the application keys are protected by the module or an Operator Card Set (OCS). The card set must not have a pass phrase the number of operator cards in the OCS. The quorum must be one. Version 1.3, 02-May-2008 Page 2

4 whether the security world is compliant with FIPS Level 3 For more information on administering an ncipher module, see the nshield User Guide or the nethsm User Guide, as appropriate. 5. Procedures To integrate an ncipher Hardware Security Module (HSM) with IIS 7.0, you: 1. install the ncipher HSM 2. install the ncipher Support Software (ncss-win-user-11.03) 3. create the ncipher security world 4. install IIS create a certificate request 6. install the certificate 6. Installing the ncipher HSM Refer to the ncipher Hardware Installation Guide for full instructions. Note: ncipher recommends installing the hardware before the software 7. Installing the ncipher Support Software (ncss) 7.1. Results of this procedure installation of the ncipher software CNG and CSP wizard shortcuts in Start > Program Files > ncipher verification that the software is correctly installed 7.2. To install ncss-win-user Log in as the Local Administrator or as a user with local Administrator privileges. 2. Insert the CD into the CD-ROM drive. If autorun is disabled, start the installation by clicking setup.exe in the root directory. The default installation folder is %NFAST_HOME%\bin. 3. Progress to the Select Components screen, where you select ncipher components for installation. The recommended minimum set of components to install is: Core Tools Crypto API CSP GUI and console Installers ncipher CAPI-NG Providers and Tools Hardware Support (mandatory) Select the desired components. Version 1.3, 02-May-2008 Page 3

5 4. Click Next and complete the remaining stages of the installation wizard. ncipher recommends that before continuing you verify that the software has been installed successfully. To do this, perform the next step. 5. Open a Command Prompt window and run the ncipher command line utility enquiry (the default install folder location is %NFAST_HOME%\bin). The output should show that both the server and module are in operational mode. It will also show the electronic serial number unique to the module. 6. Record this serial number. You will need it if you ever contact ncipher support. If enquiry.exe returns an error, contact ncipher support now. 8. Creating the ncipher security world The ncipher security world performs key management functions. You can use the CNG configuration wizard to create the security world for straightforward setups with nshields. If you are using a nethsm, or for more advanced security world setups, consult the nshield/nethsm user guides. If you create a security world by another means, run the wizard with the Use the existing security world option to register the CNG Providers. The CNG configuration wizard can: create a new security world add a module to an existing security world create Operator Card Sets, including K of N sets install ncipher s Cryptography API: Next Generation (CNG) Cryptographic Service Providers 8.1. Creating the Administrator card set 1. Login in as Local Administrator or as a user with local Administrator privileges. 2. To start the CNG configuration wizard for x86 and x64, choose Start > Program Files > ncipher > CNG configuration wizard. 3. In the Welcome to ncipher Support Software Configuration wizard, click Next. 4. Select Create a new security world. 5. Click Next. 6. Put the module into pre-initialization mode. (For full instructions on changing the module mode, refer to the nshield User Guide for Windows.) 7. Click Next. A prompt appears requesting Administrator Card Set Properties, namely the quorum and whether the security world should be FIPS compliant. 8. Indicate the appropriate policy decisions in the wizard and click Next. The Module Programming Options page prompts you to decide whether the module should be enabled as a remote share target. 9. Click Next. You may need to wait a few seconds for the next wizard page to appear. 10. You are now prompted to insert each of the n Administrator cards and decide if a pass phrase is required for each card. Once the wizard has written the ACS, it prompts you to set the module to the operational mode. Version 1.3, 02-May-2008 Page 4

6 11. Set the module to the operational mode Creating the Operator card set The Key Protection Setup wizard prompts you for the method of key protection: module key or Operator Card Set (OCS), and associated quorum. Other options to consider are card set persistence; time out; remote usage. Note: if you select OCS protection, the card set must be 1-of-n and must not use a pass phrase if keys to be protected by the OCS will be used with IIS. 1. Select the appropriate settings. 2. Click Next Completing the security world setup 1. In the Software Installation window, click Next. 2. In the next screen, click Finish. You have now set up the security world and the CNG wizard has registered the ncipher CNG providers (ncipher Primitive Provider and ncipher Security World Key Storage Provider). 9. Installing IIS Open Server Manager: Start > Administrative Tools > Server Manager > Add Roles > WebServer. 2. Select the Default (or desired) components and finish the wizard to install IIS Execute the following command to make the web server service depend on the nfast Server service: ncsvcdep.exe a http Note: The ncsvcdep.exe utility is in the %NFAST_HOME%\bin directory. 10. Creating a certificate request Requirements The ncipher hardware must have been installed. The ncipher software must have been installed. An ncipher security world must have been created. If you are using an OCS, to adhere to IIS requirements it must be a 1-of-N with no pass phrase, where N is the number of cards in the set Preliminary steps 1. To make sure the ncipher Primitive Provider and ncipher Security World Key Storage Provider are listed, run the command cnglist.exe -list-providers. Note: IIS Manager does not support the creation of certificates protected by CNG Keys and these need to be created using the Microsoft command line utilities. Version 1.3, 02-May-2008 Page 5

7 Note: Your request.inf file does not have to contain exactly the code given in the following step. These are examples, not definitive models. 2. Generate a certificate request. To generate a request for an SSL certificate linked to a 2K RSA key, create a file called request.inf. with the following information: [Version] Signature= "$Windows NT$" [NewRequest] Subject = "C=GB,CN=myhostname.com" HashAlgorithm = SHA256 KeyAlgorithm = RSA KeyLength = 2048 ProviderName = "ncipher Security World Key Storage Provider" KeyUsage = 0xf0 MachineKeySet = True [EnhancedKeyUsageExtension] OID= Note: To generate a request for an SSL certificate linked to an ECDSA P384 key, create a file called request.inf. with the following information. Note: ECDSA is currently not supported by CA in Strict FIPS mode. [Version] Signature= "$Windows NT$" [NewRequest] Subject = "C=GB,CN=myhostname.com" HashAlgorithm = SHA384 KeyAlgorithm = ECDSA_P384 KeyLength = 384 ProviderName = "ncipher Security World Key Storage Provider" KeyUsage = 0xf0 MachineKeySet = True [EnhancedKeyUsageExtension] OID= Specify the subject details of the Domain Controller which is issuing the certificate. 4. Specify the key algorithm and key length as required (e.g. RSA). 5. Specify the Provider name as ncipher Security World Key Storage Provider. 6. Save the above content in the file request.inf. Version 1.3, 02-May-2008 Page 6

8 10.3. Creating the certificate request To create the certificate request for the Certification Authority, execute the command: certreq.exe new request.inf request.req. This creates a certificate request file request.ref that can be sent to a Certificate Authority. 11. Installing a certificate After creating the certificate request, you obtain the certificate by using the CA web interface or Server Manager to send the request to the Certificate Authority Making the certificate available for use in IIS To make the certificate available for use in IIS, execute the command certreq.exe - accept somecert.cer, where somecert.cer is the binary certificate exported from the CA Binding the certificate with a secure IIS web server To bind the certificate with a secure IIS web server: 1. Open the IIS Manager from Start > Program Files > Administrative Tools > Internet Information Services (IIS) Manager. 2. If necessary, insert an operator card for your certificate. 3. Under Sites on the left hand side of the IIS Manager Window, select the desired Web site. 4. On the right hand side of the IIS Manager, click the Bindings link. 5. In the Site Bindings window, click Add. 6. Select the protocol https. 7. Select the certificate from the drop-down list. 8. To complete the certificate binding for SSL connection, click OK. 9. Open a browser and type If necessary, accept the certificate in the browser to continue with SSL connection to the IIS7 web server. 12. Further information This guide forms one part of the information and support provided by ncipher. Additional documentation produced to support your ncipher product can be found in the document directory of the CD-ROM for that product. All ncipher product documentation is available from the ncipher web site at Version 1.3, 02-May-2008 Page 7

9 12.1. Contact details ncipher Corporation Cambridge, UK Jupiter House Station Road Cambridge CB1 2JD UK Tel: +44 (0) Fax: +44 (0) ncipher Inc. Boston Metro Region, USA 92 Montvale Avenue, Suite 4500 Stoneham MA USA Tel: +1 (781) Fax: +1 (781) Web site: Online documentation: Version 1.3, 02-May-2008 Page 8