It is the responsibility of the Appliance Administrator to configure Safeguard for Privileged Passwords to integrate with an external Hardware Security Module for encryption.

Use the Hardware Security Module pane to configure the Hardware Security Module integration. The following Hardware Security Modules are supported:

• Thales Luna 7.X

• Thales Luna 6.X

• Thales Data Protection on Demand

Go to Hardware Security Module:

• web client: Navigate to Appliance Management > External Integration > Hardware Security Module.

Before you start

Before configuring the Hardware Security Module integration, the Thales Luna environment needs to be fully installed and configured. This includes but is not limited to:

• Setting the Crypto Officer password.

• Generating the Hardware Security Module server certificate(s) (network Luna only).

• Generating a Hardware Security Module client certificate for each Safeguard for Privileged Password clustered appliance (network Luna only).

• Initializing a partition.

• Creating any high availability groups Safeguard for Privileged Passwords will utilize.

Safeguard for Privileged Passwords will require the following information to configure the integration:

• Crypto Officer password

• Server certificate(s) (network Luna only)

• Client certificate(s) (network Luna only)

• Partition label (can be high availability group label)

• crystoki.ini file

If you are configuring an integration that includes a network Luna device, first install and assign the Hardware Security Module client and server certificates for your environment. For more information, see Installing a Hardware Security Module client certificate, Assigning a Hardware Security Module client certificate, and Uploading a Hardware Security Module server certificate.

CAUTION: It is best practice to only enable or disable a Hardware Security Module integration on a standalone Safeguard for Privileged Passwords appliance. The encrypted data stored within the Safeguard for Privileged Passwords appliance will be re-encrypted during these operations. If enabling or disabling in a clustered environment, the cluster will be broken and the primary Safeguard for Privileged Passwords appliance will be set to a standalone appliance and all replica’s will need to be rejoined to the cluster after the maintenance task has been completed. During this time ensure that no operations that use encrypted data, such as password check and change are performed on the replica appliances to avoid data corruption.

CAUTION: Safeguard for Privileged Passwords will use a reserved label for the encryption key stored on the Hardware Security Module partition. These labels cannot exist on the partition when doing an integration for the first time. The reserved key label name is: SafeguardMasterKey1

CAUTION: When configuring an integration that includes network Luna devices, ensure all client and server certificates have been installed on the primary Safeguard for Privileged Passwords appliance for all future cluster members. In addition, install and assign the required client certificates on the replicas prior to joining the cluster.

To configure the Hardware Security Module integration

1. Go to Hardware Security Module:

   • web client: Navigate to Appliance Management > External Integration > Hardware Security Module.

2. Select the Use External HSM checkbox.

3. In the Partition Label field, enter the partitional label Safeguard for Privileged Passwords should use on the Hardware Security Module device.

4. Enter the Crypto Officer password Safeguard for Privileged Passwords should use to connect to the Hardware Security Module device.

5. Click Upload File and browse for the crystoki.ini configuration file.

6. Once selected, click Open.

7. Click Save.

   NOTE: If there is an error with Safeguard for Privileged Passwords ability to move forward with the integration based on the provided configuration, a message displays in the user interface with further information.

Once you have finished configuring the Hardware Security Module integration, the following information and options will be available:

Table 50: Hardware Security Module: Properties

Setting	Description
Health Status	Displays the results of the last Hardware Security Module verification.
Refresh	Runs a Hardware Security Module verification. This can be used to transition a Safeguard for Privileged Passwords appliance out of the HardwareSecurityModuleError state.
Last Successful Access Date	The date and time of the last Healthy Hardware Security Module status.
Show Details	Shows the current crystoki.ini contents being used for the Hardware Security Module integration.

To disable the Hardware Security Module integration

1. Go to Hardware Security Module:

   • web client: Navigate to Appliance Management > External Integration > Hardware Security Module.

2. Deselect the Use External HSM checkbox.

3. Click Save.