Cloudera Docs

Integrating Ranger KMS DB with SafeNet Keysecure HSM

How to integrate Ranger KMS DB with SafeNet Keysecure HSM.

This task describes how to integrate Ranger KMS DB with Safenet Keysecure Hardware Security Module (HSM). This process includes setting up the SafeNet KeySecure Management Console, and configuring Ranger KMS to communicate with the Keysecure instance.

Creating the user on SafeNet keysecure

  1. Log in to keysecure as an user with admin privileges.

  2. Go to the Security tab.
  3. Go to the Users & Groups section.
  4. Click Local Authentication, and click Add to add a new user.
  5. Check both ‘User Administration Permission’ and ‘Change Password Permission’ when adding the new user.
  6. Save changes.

Creating device on SafeNet KeySecure

  1. Log in to Keysecure with user having admin privilges.
  2. Go to Device > NAE-XML protocol.
  3. Click Properties > Edit.
  4. Select Allow Key and Policy Configuration Operations and Allow Key Export .
  5. Save changes.

Configure SSL on Safenet Keysecure (NAE-XML)

Creating a local CA

  1. Log in to the Management Console as an administrator with Certificate Authority (CA) access control.
  2. Navigate to the Security, CAs & SSL Certificates section and click o Local CA's.
  3. Enter the required details and select Self-signed Root CA as the Certificate Authority Type.
  4. Click Create.

The Local CA is visble.

Creating a Server Certificate Request on the Management Console

  1. Log on to the Management Console as an administrator with Certificate Authority (CA) access control.
  2. Go to the Security tab and on the left side panel .
  3. Navigate to the Device CAs & SSL Certificates section.
  4. Click SSL certificates and modify the fields as needed.
  5. Click Create Certificate Request.

    This creates the certificate request and places it in the Certificate List section of the Certificate and CA Configuration page. The new entry shows that the Certificate Purpose is Certificate Request and that the Certificate Status is Request Pending.

Signing a Server Certificate Request with a Local CA

  1. Log on to the Management Console as an Administrator with Certificates and Certificate Authorities (CA) access controls.
  2. Navigate to the Security Tab -> Device, CAs and SSL Certificates section.
  3. Click SSL Certificates .
  4. Select the certificate request (cert50) and click Properties.
  5. Copy the text of the certificate request. The copied text must include the header (-----BEGIN CERTIFICATE REQUEST-----) and footer (-----END CERTIFICATE REQUEST-----).
  6. Navigate to the Security Tab -> Device, CAs & SSL Certificates section.
  7. Click Local CAs and select the CA name from the list.
  8. Click Sign Request to access the Sign Certificate Request section.
  9. On the Sign Certificate Request screen, select Server as certificate Purpose.
  10. Enter the validity of the certificate for Certificate Duration (days).
  11. Paste the copied text from the server certificate request, including the header and footer in Certificate Request.
  12. Click Sign Request. This takes you to the CA Certificate Information section.
  13. Copy the actual (for eaxample,. KSCAN) certificate text. The copied text must include the header (-----BEGIN CERTIFICATE-----) and footer (-----END CERTIFICATE-----).
  14. Navigate back to the Certificate List section (Device, CAs & SSL Certificates) and click SSL Certificates.
  15. Select your certificate request and click properties.
  16. Click Install Certificate.
  17. Paste the certificate as the Certificate Response.
  18. Click Save.

    The Management Console takes you to the Certificate List section. The section shows that the Certificate Purpose is Server and that the Certificate Status is Active.

Enable SSL on Keysecure (NAE-XML)

After SSL has been configured in Safenet KeySecure, perform the following steps.

  1. Log in to keysecure with admin privileges.
  2. Go to the Device tab and click NAE-XML -> properties -> edit.
  3. Select Use SSL.
  4. Select the Server Certificate from the given drop-down list (for example, cert50).
  5. Save changes.