Configuring an nShield HSM for High Availability

After you have configured KeyControl Vault as an nShield HSM client, you can add an additional nShield HSM to create a high availability cluster. You can either use a standalone KeyControl Vault node or a KeyControl Vault cluster.

When the KeyControl Vault cluster is configured with multiple HSM servers, the KeyControl Vault cluster uses HSM servers for High Availability (HA) and load sharing purposes. The HSM servers are not affiliated with specific KeyControl Vault node(s), but are configured for and used by ALL members of the KeyControl Vault cluster.

Before You Begin 

  • Ensure that you have completed Configuring KeyControl Vault as an HSM Client using an nShield HSM.

  • Obtain the Security World Bundle file for the new HSM that you want to add. It must have the same security world as the first HSM server inside of the Security World Bundle file, but the module file must be for the new HSM. Please contact your  HSM Administrator to ensure that this is set up correctly.

    You cannot establish HA functionality if the servers do not share the same security world.

    Tip: This information can be found in 'Security Worlds' and ‘Creating a Security World’ in your HSM User Guide.

FIPS 140-2 Level 3 – smart card requirement

If your nShield HSMs are configured in a FIPS 140-2 Level 3 compliant Security World environment, an ACS or OSC card must be loaded in all HSMs. When using multiple HSMs for high availability, operations are load balanced between the HSM servers connected to KeyControl Vault. If one HSM fails, traffic is rerouted to another HSM. If a valid card is not located in the HSM, it will continue to receive traffic but operations requiring a FIPS authorization token will fail. A valid card (with a listed serial number, unless ‘Accept all cards’ is selected) must be loaded in the HSM to ensure operations do not fail. For more information regarding nShield HSMs and FIPS 140-2 Level 3, see Configuring KeyControl Vault as an HSM Client using an nShield HSM .

Procedure 

  1. Log into the KeyControl webGUI using an account with Security Admin privileges.

    Note: If you are using a cluster, you only need to use the webGUI for one node.

  2. In the top menu bar, click Settings.
  3. In the System Settings section, click HSM Server Settings.

  4. On the nShield HSM Server Settings page, click the Client List and copy the IP address and keyhash of the KeyControl Vault nodes.

  5. Use the IP address and keyhash to authenticate KeyControl Vault on nShield. Please see your nShield documentation.

    Important: For KeyControl Vault clusters, you will need to authenticate the IP address and keyhash for each KeyControl Vault cluster node.

  6. Copy the Security World Bundle from nShield and place it on your local machine. It should be in the format world.zip.

  7. On the Basic tab of the nShield HSM Server Settings page, select Actions > Add New HSM Server.

  8. After reading the Get Started Screen, click Continue.

  9. On the Enrollment screen, complete the following: 

    Note: All information is from the nShield HSM. The Server Name is used for display purposes and the Server IP/FQDN is used for communication.

    Field

    Description

    Server Name

    Enter the FQDN of the nShield HSM.

    Server IP/FQDN

    Enter the IP address or FQDN for the nShield HSM.

    Server ESN

    Enter the nShield Electronic Serial Number (ESN).

    Type

    Select the location of the nShield HSM. This can be On Prem or Cloud.

    Server Port

    Enter the port used for the nShield HSM.

    Server Keyhash

    Enter the keyhash of the nShield HSM.

  10. Click Enroll and Continue.
  11. On the Security World screen, click Load File and locate the security world bundle that you downloaded from the nShield HSM.
  12. Click Upload and Continue.

  13. Click Complete Setup.

    After the setup is complete, you will be returned to the nShield HSM Server Settings page, which now displays the values for both HSMs.

    Note: If the configuration failed, then you can simply remove the HSM by selecting it and then selecting Actions > Remove Server and add it again.