1.0 Introduction
This article describes how to integrate Fortanix-Data-Security-Manager (DSM) with Skyhigh Secure Web Gateway (SWG) to deliver Hardware Security Module (HSM) capabilities. The HSM serves the purpose of safeguarding private keys utilized in SSL communication.
After it is installed, the HSM assumes responsibility for private key operations associated with the keys under its protection. To facilitate seamless integration with the hardware module, HSM software is installed on the Web Gateway.
2.0 Prerequisites
Ensure the following:
Command Line Interface (CLI) accessibility.
Secure Web Gateway v12.2.3 is supported.
3.0 Configure Fortanix DSM
A Fortanix DSM service must be configured, and the URL must be accessible. To create a Fortanix DSM account and group, refer to the following sections:
3.1 Signing Up
To get started with the Fortanix Data Security Manager (DSM) cloud service, you must register an account at <Your_DSM_Service_URL>. For example, https://eu.smartkey.io.
For detailed steps on how to set up the Fortanix DSM, refer to the User's Guide: Sign Up for Fortanix Data Security Manager SaaS documentation.
3.2 Creating an Account
Access the <Your_DSM_Service_URL> on the web browser and enter your credentials to log in to the Fortanix DSM.
Figure 1: Logging In
3.3 Creating a Group
Perform the following steps to create a group in the Fortanix DSM:
Click the Groups menu item in the DSM left navigation panel and click the + button on the Groups page to add a new group.
Figure 2: Add Groups
On the Adding new group page, enter the following details:
Title: Enter a title for your group.
Description (optional): Enter a short description for the group.
Click the SAVE button to create the new group.
The new group has been added to the Fortanix DSM successfully.
3.4 Creating an Application
Perform the following steps to create an application (app) in the Fortanix DSM:
Click the Apps menu item in the DSM left navigation panel and click the + button on the Apps page to add a new app.
Figure 3: Add Application
On the Adding new app page, enter the following details:
App name: Enter the name of your application.
Interface (optional): Select the REST API option as interface type from the drop down menu.
ADD DESCRIPTION (optional): Enter a short description for the application.
Authentication method: Select the default API Key as the method of authentication from the drop down menu. For more information on these authentication methods, refer to User's Guide: Authentication documentation.
Assigning the new app to groups: Select the group created in Section 3.3: Creating a Group from the list.
Click the SAVE button to add the new application.
The new application has been added to the Fortanix DSM successfully.
3.5 Copying the API Key
Perform the following steps to copy the API key from the Fortanix DSM:
Click the Apps menu item in the DSM left navigation panel and click the app created in Section 3.4: Creating an Application to go to the detailed view of the app.
On the INFO tab, click the VIEW API KEY DETAILS button.
From the API Key Details dialog box, copy the API Key of the app to use it later.
3.6 Update the Client Configuration Settings
Perform the following steps:
Access the Settings menu to modify the setting of the Fortanix DSM account.
Figure 4: Settings
Navigate to the CLIENT CONFIGURATION section.
Figure 5: Client Configuration
For logging, enable the option and update the file log path to
/opt/mwg/log/debug/fortanix/fortanix.log.
Figure 6: Add Path
4.0 Loading the Private Key Identifiers
To enable SWG to utilize keys within Fortanix DSM, it is essential to enumerate the available keys in the SWG User Interface (UI).
Perform the following steps:
Open the Skyhigh Secure Web Gateway User Interface (UI).
Navigate to Configuration → Appliances → Hardware Security Module.
Figure 7: Hardware Security Module
Select the Start local HSM server check box.
Figure 8: HSM Server
From the Crypto Module drop down menu, select the Fortanix DSM (from Fortanix) option.
Figure 9: Select Module
Enter the Fortanix DSM API key and click the Set button to confirm. To know this app API key, refer to the Section 3.5: Copying the API Key.
Figure 10: Enter Fortanix DSM API Key
Enter the Fortanix DSM app API Key as a Password and click the OK button.
Figure 11: Enter Password
To modify the Fortanix DSM app API Key, select the Change button.
Figure 12: Modify Fortanix DSM API Key
In the Keys to be loaded section, click the "+" icon to add the key as a string.
Figure 13: Add Keys
The format for adding keys is
<engine-label>:<pkcs11-URI>.The engine-label should be "pkcs11" to inform SWG that these are PKCS#11 keys.
Enter the key as a string using the format:
pkcs11:pkcs11:object=<Key>. The value of 'Key' is based on the Key Label name created in Fortanix DSM UI.
Figure 14: Add the String
5.0 Creating Certificate Using Fortanix DSM Private Keys
You can create certificates seamlessly in SWG using Fortanix DSM private keys by setting up the app API key and executing OpenSSL commands through CLI access.
Perform the following steps:
Open the SWG console through the CLI.
In the root directory, create a new file named
fortanix.cfgto store theAPI_KEYvalue as created in Section 3.5: Copying the API Key:api_key = "API_KEY"Run the following command to provide the required permissions:
chmod 777 fortanix.cfgRun the following commands to export the file:
# export FORTANIX_PKCS11_NUM_SLOTS=1 # echo $FORTANIX_PKCS11_NUM_SLOTS 1Use the following OpenSSL commands:
openssl1.1 OpenSSL> engine -pre MODULE_PATH:/opt/fortanix/pkcs11/fortanix_pkcs11.so -pre VERBOSE pkcs11This command generates the following sample output:
Figure 15: Sample Output
Run the following OpenSSL "req" command to generate the certificate:
OpenSSL> req -engine pkcs11 -keyform engine -new -key "pkcs11:object=<key>;pin-value=file:///root/fortanix.cfg" -x509 -days 3650 -out FILENAME.crt -set_serial 0xdeadbeefThis command successfully creates the certificate file.
Figure 16: Certificate Generated