Integration Guide Microsoft Internet Information Services (IIS) 7.5 Windows Server 2008 R2

Transcription

1 Integration Guide Microsoft Internet Information Services (IIS) 7.5 Windows Server 2008 R2

2 Version: 1.0 Date: 12 October 2010 Copyright 2010 Thales ncipher Corporation Ltd. All rights reserved. These installation instructions are intended to provide step-by-step instructions for installing Thales ncipher software with third-party software. These instructions do not cover all situations and are intended as a supplement to the Thales ncipher documentation provided with Thales ncipher products. Disclaimer: Thales ncipher Corporation Ltd disclaims all liabilities regarding third-party products and only provides warranties and liabilities with its own products as addressed in the Terms and Conditions for Sale. Thales ncipher is a registered trademark of Thales ncipher Corporation Limited. Any other trademarks referenced in this document are the property of the respective trademark owners. Integration Guide: Microsoft Internet Information Services (IIS) 7.5 2

3 Contents 1. Introduction 4 2. Supported Thales ncipher functionality 5 3. Requirements 5 4. Procedures 5 5. Install the Thales ncipher HSM 6 6. Installing the HSM Support Software and Creating the Security World 6 7. Install IIS Create a certificate request Preliminary steps Creating the certificate request 7 9. Install the Certificate Making the certificate available for use in IIS Binding the certificate with a secure IIS Web Server Key Migration Certificate Migration from IIS 6.0 to IIS Integrating an HSM with an Existing IIS 7.5 Deployment Exporting the software-protected certificate Importing a Microsoft CAPI key into the ncipher Security World Key Storage Provider Importing a certificate into certificate store Addresses 14 Integration Guide: Microsoft Internet Information Services (IIS) 7.5 3

4 1. Introduction This guide explains how to integrate Thales ncipher Hardware Security Module (nshield Solo, nethsm or nshield Connect) with Microsoft Internet Information Services (IIS) 7.5. It assumes that you have read the appropriate Quick Start Guide and are familiar with the IIS7.5 documentation and setup process. The Thales ncipher module integrates with Microsoft IIS 7.5 to provide full key life-cycle management with FIPS-certified hardware and to reduce the cryptographic load on the host server CPU. Integration of an Thales ncipher module with IIS 7.5 provides the following benefits: Uses hardware validated to the FIPS standards. Improves server performance by offloading cryptographic processing. Enables secure storage of the IIS keys. Enables management of the full life cycle of the keys. Provides fail-over support where multiple HSMs are available. The following integrations have been validated: Operating System ncipher Version IIS Version nshield Solo Support nethsm Support nshield Connect Support Windows Server 2008 R2 Enterprise Windows Server 2008 R2 Enterprise Yes Yes Yes Yes Yes Yes Note Throughout this guide, the term HSM refers to nshield Solo PCI modules, nethsm units and nshield Connect units. Integration Guide: Microsoft Internet Information Services (IIS) 7.5 4

5 2. Supported Thales ncipher functionality Soft Cards Key Management Strict FIPS Support Key Recovery Module Only Key K of N Card Set Load Balancing Key Import Fail Over 3. Requirements Before attempting to install the software, we recommend that you consider the following aspects of HSM administration. We also recommend that there be an agreed organizational Certificate Practices Statement and Security Policy/Procedure in place covering administration of the HSM. In particular, these documents should specify the following aspects of HSM administration: The number and quorum of Administrator Cards in the Administrator Card Set (ACS), and the policy for managing these cards. Whether the application keys are protected by the module or an Operator Card Set (OCS). Whether the security world should be compliant with FIPS level 3. Key attributes such as the key size, persistence, and time-out. Whether there is any need for auditing key usage. For more information, refer to the User Guide for the HSM. 4. Procedures To integrate a Thales ncipher HSM with IIS 7.5, you will need to perform the following procedures: 1. Install the Thales ncipher HSM 2. Installing the HSM Support Software and Creating the Security World 3. Install IIS Create a certificate request 5. Install the certificate The integration guide also covers the following scenarios: Key migration Integrating an HSM with an existing IIS 7.5 deployment Integration Guide: Microsoft Internet Information Services (IIS) 7.5 5

6 5. Install the Thales ncipher HSM Install the HSM using the instructions in the Hardware Installation Guide for the HSM. We recommend that you install the HSM before installing Thales ncipher software. 6. Installing the HSM Support Software and Creating the Security World To install the HSM support software and create the security world: 1. Install the latest version of the Thales ncipher support software as described in the User Guide for the HSM. 2. Initialize a security world as described in the User Guide for the HSM using the CNG configuration wizard. Note If you are using an OCS, to adhere to IIS requirements it must be a 1-of-N with no pass phrase, where N is the number of cards in the set. 7. Install IIS 7.5 To install IIS7.5: 1. Open Server Manager: Start > Administrative Tools > Server Manager > Add Roles > WebServer. 2. Select the Default (or desired) components from within the wizard and proceed with installation. 8. Create a certificate request Complete the following steps to create a certificate request Preliminary steps 1. To make sure the ncipher Primitive Provider and ncipher Security World Key Storage Note Note Providers are listed, run the command cnglist.exe -list-providers. IIS Manager does not support the creation of certificates protected by CNG Keys and these need to be created using the Microsoft command line utilities. Your request.inf file does not have to contain exactly the code given in the following step. These are examples, not definitive models. Integration Guide: Microsoft Internet Information Services (IIS) 7.5 6

7 2. Generate a certificate request. To generate a request for an SSL certificate linked to a 2K RSA key, create a file called request.inf with the following information: [Version] Signature= "$Windows NT$" [NewRequest] Subject = "C=GB,CN=myhostname.com" HashAlgorithm = SHA256 KeyAlgorithm = RSA KeyLength = 2048 ProviderName = "ncipher Security World Key Storage Provider" KeyUsage = 0xf0 MachineKeySet = True [EnhancedKeyUsageExtension] OID= Specify the subject details of the Domain Controller which is issuing the certificate. 4. Specify the key algorithm and key length as required (e.g. RSA). 5. Specify the Provider name as ncipher Security World Key Storage Provider. 6. Save the above content in the file request.inf Creating the certificate request To create the certificate request for the Certification Authority, execute the command: certreq.exe new request.inf request.req. This creates a certificate request file request.req that can be sent to a Certificate Authority. 9. Install the Certificate After creating the certificate request, you obtain the certificate by using the CA web interface to send the request to the Certificate Authority. Integration Guide: Microsoft Internet Information Services (IIS) 7.5 7

8 9.1. Making the certificate available for use in IIS To make the certificate available for use in IIS, execute the command certreq.exe accept somecert.cer, where somecert.cer is the binary certificate exported from the CA Binding the certificate with a secure IIS Web Server To bind the certificate with a secure IIS Web Server: 1. Open the IIS Manager from Start > Administrative Tools > Internet Information Services (IIS) Manager. 2. Under Sites on the left hand side of the IIS Manager Window, select the desired Web site. 3. On the right hand side of the IIS Manager, click the Bindings link. 4. In the Site Bindings window, click Add. 5. Select the protocol as https. 6. Select IP address of machine running IIS from the IP Address dropdown list. 7. Select the certificate from the drop-down list. 8. To complete the certificate binding for SSL connection, click OK. 9. Open a browser and type If necessary, accept the certificate in the browser to continue with SSL connection to the IIS7.5 Web Server. 10. Key Migration Following section walks through the procedure to migrate private key and certificate from IIS6.0 to IIS Certificate Migration from IIS 6.0 to IIS 7.5 This section describes the procedure to migrate a server certificate from IIS 6.0 (Windows Server bit) to IIS 7.5 (Windows Server 2008 R2) Exporting a certificate from IIS6.0 (Windows Server 2003) Prerequisites: The Thales ncipher software and hardware must have been installed on both servers. To adhere to IIS requirements, the Operator Card Set must be a 1-of-N with no password. IIS 6.0 server certificate is secured with a Thales ncipher HSM. To export the certificate from IIS6.0: 1. Open the Microsoft Management Console (Start > Select Run > Type MMC > Click OK). 2. At the initial screen, click on File > Add/Remove Snap-in and select Add. Integration Guide: Microsoft Internet Information Services (IIS) 7.5 8

9 3. Select Certificates from Available Standalone Snap-ins and click Add. 4. In the Certificates snap-in window, select Computer account and click Next. 5. In the Select Computer window, select Local computer, click Finish and click OK. 6. Navigate to Certificates directory (Certificates (Local Computer) > Personal > Certificates). 7. Right-click on the certificate file and select All Tasks > Export. 8. The Welcome to the Certificate Export Wizard window appears. Click Next. 9. In the Export Private Key window, select No, do not export the private key.click Next. 10. In the Export File Format window, select Base-64 encoded X.509 (.Cer) and click Next. 11. In the File to Export window, select an absolute path and filename to save the exported certificate. 12. Click Next. The Completing the Certificate Export Wizard window appears. Click Finish Import the Certificate into IIS7.5 (Windows Server 2008 R2) To import the certificate to IIS7.5, complete the following steps: 1. Backup the C:\Documents and Settings\All Users\Application Data\nCipher\Key Management Data\local directory on the IIS6.0 server 2. Backup the exported certificate file. 3. Restore the Key Management Data directory contents to C:\ProgramData\nCipher\Key Management Data\local on the Windows 2008 R2 server 4. Switch the HSM into pre-initialization mode and clear the module. 5. Confirm the HSM is in the correct state by opening a console and running enquiry. 6. Run the CNG configuration wizard, which will detect the presence of the C:\ProgramData\nCipher\Key Management Data\local directory. 7. Ensure that Use the existing security world is selected and click Next. 8. In the Set Module States window, click Next. 9. In the Module Programming Options window, keep the default selection and click Next. 10. Provided the Administrator Card Set when prompted and click Next. 11. Reset the Thales ncipher module to Operational mode, change the external switch to O, and clear the module. 12. In the Set Module States window, click Next. 13. In the Key Protection Set Up window, select Operator Card Set Protection and Click Next. 14. In the ncipher CNG Providers Options window, keep the default selection and click Next. 15. In the Software Installation window, click Next. 16. Click Finish. 17. Secure the Administrator Card Set and C:\ProgramData\nCipher\Key Management Data\local backup. 18. Identify the Security World key names of the keys in the container by running the csputils command as follows: Integration Guide: Microsoft Internet Information Services (IIS) 7.5 9

10 C:\Program Files (x86)\ncipher\nfast\bin>csputils64.exe -d -m Detailed report for container ID #36841e1e14fd7c2d28b0ff908f1deec1a46ac36b Filename: key_mscapi_container e1e14fd7c2d28b0ff908f1deec1a46ac36b Container name: 2c b190-4c73-9ddd f10fb Container is a machine container. CSP DLL name: ncsp.dll No signature key. Filename for key exchange key is key_mscapi_c12af7bc92aa47cf d24c58ab3cc605ac5 Key was generated by the CSP Key hash: c12af7bc92aa47cf d24c58ab3cc605ac5 Key is recoverable. Key is cardset protected. Cardset name: IIS6-IIS7 Sharing parameters: 1 of 2 shares required. Cardset hash: b a96f5c9e1e0fb2dc08300de3a0ece584 Cardset is non-persistent. 1 container and 1 key found. 19. Import an ncipher Security World key into the ncipher Security World Key Storage Provider, run the cngimport utility as shown in the following example: C:\Program Files (x86)\ncipher\nfast\bin>cngimport.exe -i -M -k c12af7bc92aa47cf d24c58ab3cc605ac5 -a mscapi Exchange_Key_Imported_From_nCipher_CAPI Found unnamed key Importing NFKM key.. done 20. Run cnglist64.exe with the --list-keys option to confirm that the key has been successfully imported: C:\Program Files (x86)\ncipher\nfast\bin>cnglist64.exe --list-keys Exchange_Key_Imported_From_nCipher_CAPI: RSA machine Importing a certificate to certificate store: 1. Open the Microsoft Management Console (Start >Select Run > Type MMC> Click OK). 2. At the initial screen, click on File > Add/Remove Snap-in and select Add. 3. From Available Standalone Snap-ins, select Certificates and click Add. 4. In the Certificates snap-in window, select Computer account and click Next. 5. In the Select Computer window, select Local computer, click Finish and click OK. 6. Navigate to Certificates directory (Certificates (Local Computer) > Personal > Certificates) 7. Right-click on the certificate folder and select All Tasks > Import. 8. The Welcome to the Certificate Import Wizard window appears. Click Next. 9. Navigate to the location of the certificate from the Origin Server and click Next. 10. In the Certificate Store window, select Place all certificates in the following store and click Integration Guide: Microsoft Internet Information Services (IIS)

11 Next. The Completing the Certificate Import Wizard window appears. 11. Click Next. 12. Click OK. 13. Run the following command from the windows terminal: C:\Program Files (x86)\ncipher\nfast\bin>certutil -f -csp "ncipher Security World Key Storage Provider" -repairstore my <serial number of certificate> 14. Open the IIS Manager from Start > Program > Administrative Tools > Internet Information Services (IIS) Manager. 15. Under Sites on the left hand side of the IIS Manager Window, select the desired Web site. 16. On the right hand side of the IIS Manager, click the Bindings link. 17. In the Site Bindings window, click Add. 18. Select the protocol https. 19. Select the certificate from the drop-down list. 20. To complete the certificate binding for SSL connection, click OK. 21. Open a browser and type If necessary, accept the certificate in the browser to continue with SSL connection to the IIS7.5 Web Server. 11. Integrating an HSM with an Existing IIS 7.5 Deployment This section describes how to upgrade an existing IIS 7.5 server installation to use a Thales ncipher module to protect the private key. It is assumed that the existing certificate must continue to be used by the server after the Thales ncipher module is installed. Prerequisites: An IIS 7.5 setup with software-protected certificate and private key. Thales ncipher Software installed and a Security World must have been created using CNG configuration wizard Exporting the software-protected certificate Complete the following procedure to export software protected certificate. 1. Open the Microsoft Management Console (Start >Select Run > Type MMC > Click OK). 2. At the initial screen, click on File > Add/Remove Snap-in and select Add. 3. Select Certificates from Available Standalone Snap-ins and click Add. 4. In the Certificates snap-in window, select Computer account and click Next. Integration Guide: Microsoft Internet Information Services (IIS)

12 5. In the Select Computer window, select Local computer, click Finish and click OK. 6. Navigate to Certificates directory (Certificates (Local Computer) >Personal > Certificates). 7. Right-click on the certificate file and select All Tasks > Export. 8. The Welcome to the Certificate Export Wizard window appears. Click Next. 9. In the Export Private Key window, select No, do not export the private key. Click Next. 10. In the Export File Format window, select Base-64 encoded X.509 (.Cer) and click Next. 11. In the File to Export window, select an absolute path and filename to save the exported certificate. Click Next. The Completing the Certificate Export Wizard window appears. 12. Click Finish. 13. After exporting certificate delete the certificate from the certificate store Importing a Microsoft CAPI key into the ncipher Security World Key Storage Provider To import a Microsoft CAPI key into the ncipher Security world Key Storage Provider: 1. Navigate to C:\Program Files (x86)\ncipher\nfast\bin folder and run cngimport.exe command as follows. C:\Program Files (x86)\ncipher\nfast\bin\cngimport -m -M -k "MS CAPI key name "Any name for imported key" Note For Example: Microsoft CAPI key name can be found from C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys folder. C:\Program Files (x86)\ncipher\nfast\bin\cngimport -m -M -k "48753e97af44aee2f5fe8b6f9d82e29f_b4c2885b-321a-42b d " "KeyImport" 2. To check the success of the import, list the keys present in the ncipher Security World Key Storage Provider: C:\Program Files (x86)\ncipher\nfast\bin\cnglist64.exe --list-key KeyImport : RSA machine Importing a certificate into certificate store To import certificate to certificate store: 1. Open the Microsoft Management Console (Start >Select Run > Type MMC > Click OK). 2. At the initial screen, click on File > Add/Remove Snap-in and select Add. 3. From the Available Standalone Snap-ins, select Certificates and click Add. Integration Guide: Microsoft Internet Information Services (IIS)

13 4. In the Certificates snap-in window, select Computer account and click Next. 5. In the Select Computer window, select Local computer, click Finish and click OK. 6. Navigate to Certificates directory (Certificates (Local Computer) > Personal > Certificates) Right-click on the certificate folder and select All Tasks > Import. 7. The Welcome to the Certificate Import Wizard window appears. Click Next. 8. Navigate to the location of the certificate from the Origin Server and click Next. 9. In the Certificate Store window, select Place all certificates in the following store and click Next. The Completing the Certificate Import Wizard window appears. 10. Click Next. 11. Click OK. 12. Run the following command from the windows terminal: C:\Program Files(x86)\nCipher\nfast\bin>certutil -f -csp "ncipher Security World Key Storage Provider" -repairstore my <serial number of certificate> 13. Open the IIS Manager from Start > Administrative Tools > Internet Information Services (IIS) Manager. 14. Under Sites on the left hand side of the IIS Manager Window, select the desired Web site. 15. On the right hand side of the IIS Manager, click the Bindings link. 16. In the Site Bindings window, click Add. 17. Select the protocol https. 18. Select the certificate from the drop-down list. 19. To complete the certificate binding for SSL connection, click OK. 20. Open a browser and type If necessary, accept the certificate in the browser to continue with SSL connection to the IIS7 Web Server Integration Guide: Microsoft Internet Information Services (IIS)

14 12. Addresses Americas 2200 North Commerce Parkway Suite 200 Weston Florida USA Tel: or [email protected] Asia Pacific Units /F Vicwood Plaza 199 Des Voeux Road Central Hong Kong PRC Tel: [email protected] Australia Northbourne Avenue Turner ACT 2601 Australia Tel: [email protected] Europe, Middle East, Africa Meadow View House Long Crendon Aylesbury Buckinghamshire HP18 9EQ UK Tel: + 44 (0) [email protected] Internet addresses Web site: Support: Online documentation: International sales offices: Integration Guide: Microsoft Internet Information Services (IIS)