Microsoft IIS: nShield HSM Integration Guide

We have successfully tested the nShield HSM integration with IIS in the following configuration:

Supported nShield features

Supported nShield hardware and software versions

Before installing the software, we recommend that you familiarize yourself with the IIS documentation and setup process, and that you have the nShield documentation available. We also recommend that there is an agreed organizational Certificate Practices Statement and a Security Policy/Procedure in place covering administration of the HSM. In particular, these documents should specify the following aspects of HSM administration:

• The number and quorum of Administrator Cards in the Administrator Card Set (ACS), and the policy for managing these cards

• Whether the application keys are protected by the HSM module key or an Operator Card Set (OCS) protection

• Whether the Security World should be compliant with FIPS 140-2 Level 3

• Key attributes such as the key algorithm, key length and key usage.

For more information, see the User Guide for the HSM.

Install the HSM and Security World software using the instructions in the Installation Guide for the HSM. We recommend that you do this before installing and configuring IIS.

1. Install the latest version of the Security World Software as described in the User Guide for the HSM.

2. Initialize a Security World as described in the User Guide for the HSM.

You can also use the CNG Configuration Wizard to create a Security World. If you are using an OCS, to adhere to IIS requirements it must be a 1-of-N with no passphrase, where N is the number of cards in the set.

To install Microsoft Internet Information Services:

1. Open Server Manager by selecting Start > Server Manager .

2. Select Manage and then select Add Roles and Features .

3. On the Before you begin screen, select Next .

4. On the Select installation type screen, ensure the default selection of Role or Feature Based Installation is selected and select Next .

5. On the Server Selection screen, select a server from the server pool and select Next .

6. On the Select server roles screen, select the Web Server (IIS) Role and select Next

7. When prompted to install Remote Server Administration Tools, select Add Features and select Next .

8. On the Select features screen, keep the default selection and select Next .

9. On the Web Server Role (IIS) screen, select Next .

10. On the Select Role Service screen, select Next .

11. On the confirmation screen, select Install .

12. Once the installation completes, Select Close .

1. Open a command window as administrator and type the following to put the HSM in pre-initialization mode. This operation takes about a minute to complete.

   >enquiry -m 1
   Module #1:
    enquiry reply flags  none
    enquiry reply level  Six
    serial number        BD10-03E0-D947
    mode                 operational
    ...
   
   >nopclearfail -I -m 1
   Module 1, command ClearUnitEx: OK
   
   >enquiry -m 1
   Module #1:
    enquiry reply flags  none
    enquiry reply level  Six
    serial number        BD10-03E0-D947
    mode                 pre-initialization
    ...

2. Select the Start button to access all applications. Look for the recently installed nShield utilities.

3. Double-click the CNG configuration wizard and run it as Administrator.

4. Select Next on the CNG Install welcome screen.

5. Select Next on the Enable HSM Pool Mode screen. Leave the Enable HSM Pool Mode for CNG Providers check box un-checked.

6. At the Security World screen, select:

   • Use the existing security world if you already have a Security World that you intend to use for Always Encrypted. The corresponding world and module_xxxx-xxxx-xxxx files most be present in the %NFAST_KMDATA%\local folder. Be prepared to present the quorum of Administrator cards.

   • Create a new Security World if you do not currently have a Security World or would like to create a new Security World.

     In this integration, we used an existing Security World. For instructions on how to create and configure a new Security World, see the Installation Guide and User Guide for your HSM.

     Select Next .

7. The Set Module States pop-up shows the available HSM(s). Select the desired HSM. The state of the selected HSM should be (pre-)initialisation . Select Next .

8. At the Module Programming Options screen, clear Enable this module as a remote target and select Next . It will take about a minute before the screen changes.

   Note	Please be aware that this is not to be confused with the nShield Remote Administration utility.

9. Insert the first Administrator Card in the HSM, enter the passphrase and select Next . Repeat this step for the other Administrator Cards as required.

   Loading or creating the Security World takes about a minute.

10. Return the HSM to Operational mode.

    This operation takes about a minute to complete.

    >enquiry -m 1
    Module #1:
     enquiry reply flags  none
     enquiry reply level  Six
     serial number        BD10-03E0-D947
     mode                 initialization
     ...
    
    >nopclearfail -O -m 1
    Module 1, command ClearUnitEx: OK
    
    C:\Windows\system32>enquiry -m 1
    Module #1:
     enquiry reply flags  none
     enquiry reply level  Six
     serial number        BD10-03E0-D947
     mode                 operational
     ...

    The module state will change to Usable .

    Select Next .

11. Select the protection method.

    Note	Due to limitations of IIS itself, any OCS protection must be passphrase-less 1/n quorum, and any softcard protection is not supported. For this reason, use only OCS or module protection.

    • Operator Card Set protection

      1. Select Operator Card Set in the Key Protection Setup , then select Next .

      2. Enter the OCS name, K of N values, select Persistent and Usable remotely , then select Next .

      3. Insert a blank Operator Card in the HSM.

      4. In Insert Next Card , enter a name to for the OCS card. Leave the Card requires a pass phrase checkbox unchecked as OCS protection must be passphrase-less, then select Next .

    • Module protection

      1. In Key Protection Setup , select Module protection , then select Next .

      2. Select Next and Finish .

    The nShield CNG providers are installed and the key Storage Provider is registered.

12. Open a command window as administrator and type the following to confirm that the KSP has been successfully registered. Look for nCipher Security World Key Storage Provider .

    > cnglist.exe --list-providers
    Microsoft Key Protection Provider
    Microsoft Passport Key Storage Provider
    Microsoft Platform Crypto Provider
    Microsoft Primitive Provider
    Microsoft Smart Card Key Storage Provider
    Microsoft Software Key Storage Provider
    Microsoft SSL Protocol Provider
    Windows Client Key Protection Provider
    nCipher Primitive Provider
    nCipher Security World Key Storage Provider

13. Check the registry in CNGRegistry :

    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Cryptography\Providers\nCipherSecurityWorldKeyStorageProvider

IIS Manager does not support the creation of certificates protected by CNG Keys and these need to be created using the Microsoft command line utilities. Commands executed in this section are run on a PowerShell in Windows.

Complete the following steps to create a certificate request:

1. To make sure the nCipher Primitive Provider and nCipher Security World Key Storage Providers are listed, run:

   % cnglist.exe --list-providers
   
   Microsoft Key Protection Provider
   Microsoft Passport Key Storage Provider
   Microsoft Platform Crypto Provider
   Microsoft Primitive Provider
   Microsoft Smart Card Key Storage Provider
   Microsoft Software Key Storage Provider
   Microsoft SSL Protocol Provider
   Windows Client Key Protection Provider
   nCipher Primitive Provider
   nCipher Security World Key Storage Provider

   Note	If the nCipher Primitive Provider and nCipher Security World Key Storage Provider are not listed, please follow the steps in the Install and register the CNG provider section.

2. Set up a template file:

   1. Generate a request for an SSL certificate linked to a 2K RSA key by creating a file called request.inf with the following information:

      [Version]
      Signature= "$Windows NT$"
      [NewRequest]
      Subject = "CN=interop.com,C=US,ST=Florida,L=Sunrise,O=InteropCom,OU=WebServer"
      HashAlgorithm = SHA256
      KeyAlgorithm = RSA
      KeyLength = 2048
      ProviderName = "nCipher Security World Key Storage Provider"
      KeyUsage = 0xf0
      MachineKeySet = True
      [EnhancedKeyUsageExtension]
      OID = 1.3.6.1.5.5.7.3.1

      Your request.inf file does not have to contain exactly the code given above. This is an example, not a definitive model.

   2. Specify the subject details of the Domain Controller which is issuing the certificate.

   3. Specify the key algorithm and key length as required, for example RSA 2048.

   4. Specify the Provider name as nCipher Security World Key Storage Provider .

   5. When you have set up the template successfully, save it as request.inf on the C:\ drive.

3. Open a command prompt and go to the local drive, in this case C:\ .

4. To create the certificate request for the Certification Authority, execute the command:

   % certreq.exe -new request.inf IISCertRequest.csr
   
   CertReq: Request Created

   A certificate request called IISCertRequest.csr is generated and placed on the C:\ drive. This file is used to be sent to a Certificate Authority.

1. Submit the CSR file to a CA such as VeriSign, Entrust, and so on.

2. The CA authenticates the request and returns a signed certificate or a certificate chain.

3. Save the reply from the CA in the current working directory.

In this guide the signed certificate file is IISCertRequest.cer .

Make the certificate available to be used in IIS and bind the certificate with the https settings in IIS.

Commands used in this section are run from a Windows PowerShell.

Make the certificate available for use in IIS

% certreq --accept IISCertRequest.cer

Installed Certificate:
  Serial Number: 67790b108e551446903d999aabeaaf5e003fb66f
  Subject: C=US, CN=Hostname
  NotBefore: 6/22/2021 1:22 PM
  NotAfter: 6/22/2022 1:22 PM
  Thumbprint: cd3135f897ab0b44dfe6f451bcd63076ed4228e8

Bind the certificate with a secure IIS web server

This section describes how to upgrade an existing IIS server installation to use an nShield HSM to protect the private key. It is assumed that the existing certificate must continue to be used by the server after the Prerequisites to integrate are:

• An IIS setup with software-protected certificate and private key

• nShield Software installed and a Security World created using The CNG Configuration Wizard, or the front panel of an nShield Connect

Export the software-protected certificate

Import a Microsoft CAPI key into the nCipher Security World Key Storage Provider

Import a certificate into the certificate store