1.0 Introduction
This article describes how to integrate Fortanix-Data-Security-Manager (DSM) with Enterprise Java Beans Certificate Authority (EJBCA).
It also contains the information that a user requires to:
Create an application (app) in Fortanix DSM.
Download and install the Fortanix PKCS#11 driver in the EJBCA server.
Create a PKCS#11 Crypto Token in the EJBCA Admin web.
Generate key pairs using the Crypto Token to create a Certificate Authority.
2.0 Prerequisites
Ensure the following:
sudo
privilege or Root access on the EJBCA server.Internet connectivity from the EJBCA Server to the Fortanix Service.
Admin Access to the EJBCA UI to configure the Crypto Token.
The Fortanix PKCS#11 driver can be downloaded from here.
3.0 Configure Fortanix DSM
A Fortanix DSM service must be configured, and the URL must be accessible. To create a Fortanix DSM account and group, refer to the following sections:
3.1 Signing Up
To get started with the Fortanix DSM cloud service, you must register an account at <Your_DSM_Service_URL>. For example, https://eu.smartkey.io.
For detailed steps on how to set up the Fortanix DSM, refer to the User's Guide: Sign Up for Fortanix Data Security Manager SaaS documentation.
3.2 Creating an Account
Access <Your_DSM_Service_URL> in a web browser and enter your credentials to log in to Fortanix DSM.
.png?sv=2022-11-02&spr=https&st=2025-06-01T00%3A36%3A05Z&se=2025-06-01T00%3A50%3A05Z&sr=c&sp=r&sig=u%2FDLdktRy4dG65%2FqwKXiGdxjs71uZRG7Wy2i4fGGJlI%3D)
Figure 1: Logging in
For more information on how to set up an account in Fortanix DSM, refer to the User's Guide: Getting Started with Fortanix Data Security Manager - UI.
3.3 Creating a Group
Perform the following steps to create a group in the Fortanix DSM:
In the DSM left navigation panel, click the Groups menu item, and then click the + button to create a new group.
Figure 2: Add groups
On the Adding new group page, do the following:
Title: Enter a name for your group.
Description (optional): Enter a short description of the group.
Click SAVE to create the new group.
The new group is added to the Fortanix DSM successfully.
3.4 Creating an Application
Perform the following steps to create an application (app) in the Fortanix DSM:
In the DSM left navigation panel, click the Apps menu item, and then click the + button to create a new app.
Figure 3: Add application
On the Adding new app page, do the following:
App name: Enter the name for your application.
ADD DESCRIPTION (optional): Enter a short description of the application.
Authentication method: Select the default API Key as the authentication method from the drop down menu. For more information on these authentication methods, refer to the User's Guide: Authentication.
Assigning the new app to groups: Select the group created in Section 3.3: Creating a Group from the list.
Click SAVE to add the new application.
The new application is added to the Fortanix DSM successfully.
3.5 Copying the API Key
Perform the following steps to copy the API key from the Fortanix DSM:
In the DSM left navigation panel, click the Apps menu item, and then click the app created in Section 3.4: Creating an Application to go to the detailed view of the app.
On the INFO tab, click VIEW API KEY DETAILS.
From the API Key Details dialog box, copy the API Key of the app to use it later.
4.0 Install PKCS#11 Driver
SSH to the EJBCA server.
Download the Fortanix PKCS#11 driver.
curl -L https://download.fortanix.com/clients/4.2.1500/fortanix-pkcs11-4.2.1500-0.x86_64.rpm -o fortanix-pkcs11-4.2.1500-0.x86_64.rpm
Install the Fortanix PKCS#11 driver.
sudo dnf localinstall -y fortanix-pkcs11-4.2.1500-0.x86_64.rpm rm -rf fortanix-pkcs11-4.2.1500-0.x86_64.rpm
Change to the
wildfly
user and open theweb.properties
file to edit.sudo su - wildfly vim /opt/ejbca/conf/web.properties
Add the following to the end of the
web.properties
file.cryptotoken.p11.lib.60.name=Fortanix cryptotoken.p11.lib.60.file=/opt/fortanix/pkcs11/fortanix_pkcs11.so
Save and close the file and exit the
wildfly
account.:wq exit
NOTE
To log in to Fortanix DSM from the Docker EJBCA container and create keys, add the following command to
/opt/primekey/bin/start.sh
.export FORTANIX_API_ENDPOINT=https://<FORTANIX_DSM_URL>
The above command is for Linux only.
5.0 Create Crypto Token
Restart the Wildfly Application Server.
sudo systemctl restart wildfly
Access the EJBCA adminweb with a web browser.
Click Crypto Tokens in the left navigation pane to create a new crypto token.
Figure 4: EJBCA Adminweb
Click the Create new... link to create a new crypto token.
Figure 5: Create new crypto token
In the Type field, select PKCS#11 NG from the drop down menu.
Figure 6: Crypto token type
Select Fortanix from the PKCS#11 : Library drop down menu.
Select Slot ID from the PKCS#11 : Reference Type drop down menu.
Use the default value for the PKCS#11 : Reference field.
Type a Name for the Crypto token, for example, Fortanix.
Type the Fortanix App API key for the Authentication Code and the Repeat Authentication Code fields.
Figure 7: Configure crypto token
Click Save to save the changes.
Figure 8: Save the new crypto token
Use the default name for the key (signKey), select the key size (RSA4096), and select Sign and Encrypt for the key usage.
Click Generate new key pair.
Figure 9: Create key pair
Repeat Steps 6-7 to create the defaultKey and testKey.
Figure 10: Create key pairs
The three keys are created, and the crypto token can now be used to create a CA.