Key Management Service：Getting started with Cloud Hardware Security Module

An HSM cluster includes one master HSM and multiple non-master HSMs. In a cluster, HSMs that reside in the same zone use the same VPC subnet.

1. On the Instances page, find an HSM that you want to use as the master HSM and click Create Cluster in the Actions column.

2. In the Create and Activate Cluster panel, complete the Create Cluster step and click Next.

   Parameter	Description
   Cluster Name	The name of the cluster. The name must be unique and cannot exceed 24 characters in length.
   Configure Whitelist	The range of the IP addresses that are allowed to access the cluster. If you do not configure a whitelist, all IP addresses are allowed to access the cluster. If you configure a whitelist, only the IP addresses in the whitelist are allowed to access the cluster. IP addresses and CIDR blocks are supported. You can specify one IP address or one CIDR block in each row. You can specify up to 10 rows in total. Important The whitelist of a cluster has a higher priority than the whitelist of an HSM in the cluster. For example, if you add 10.10.10.10 to the whitelist of an HSM and add 172.16.0.1 to the whitelist of the cluster that includes the HSM, you can access the HSM only from 172.16.0.1. The whitelist configuration of 0.0.0.0/0 is not supported. If you enter 0.0.0.0/0, requests from all IP addresses are allowed. For security reasons, we recommend that you do not allow requests from all IP addresses. If you need to allow requests from all IP addresses, do not configure the whitelist.
   Specify vSwitches	The vSwitches that you need to select based on your business requirements. In an HSM cluster, you must configure at least two vSwitches to create and activate the cluster.

3. In the Create and Activate Cluster panel, complete the Activate Cluster step.

   1. Import a cluster certificate.

      1. In the Upload Cluster Certificate section, click Cluster CSR Certificate to download a certificate signing request (CSR) file. Then, upload the CSR file to the ECS instance. In this example, the CSR file is named cluster.csr.

      2. Create a private key and configure a password for the private key as prompted. In this example, the private key and the password are saved in the issuerCA.key file.

         openssl genrsa -aes256 -out issuerCA.key 2048

      3. Create a self-signed certificate. In this example, the self-signed certificate is saved in the issuerCA.crt file.

         openssl req -new -x509 -days 3652 -key issuerCA.key -out issuerCA.crt

      4. Sign the CSR and save the issued certificate in the cluster.crt file.

         Note

         In this step, the cluster.csr, issuerCA.key, and issuerCA.crt files are used.

         openssl x509 -req -in cluster.csr -days 3652 -CA issuerCA.crt -CAkey issuerCA.key -set_serial 01 -out cluster.crt

      5. Go to the Activate Cluster step in the Cloud Hardware Security Module console, import the cluster certificate, and then click Submit.

         • In the Enter the issuer certificate in the PEM format section, enter the content of the issuerCA.crt file.

         • In the Enter the issued cluster certificate in the PEM format section, enter the content of the cluster.crt file.

   2. Initialize the master HSM.

      Step	Description
      Step 1: Download the HSM management tool.	Important You can install the HSM management tool only in Linux operating systems. CentOS Method 1: Click here to download the HSM management tool. Method 2: Run the following command to download the HSM management tool. This operation requires the ECS instance to be connected to the Internet. wget -O hsm-client-v2.03.15.10-1.x86_64.rpm 'https://yundun-hsm4.oss-ap-southeast-1.aliyuncs.com/hsm-client-v2.03.15.10-1.x86_64.rpm' Method 3: On the Instances page, find the master HSM and click the icon in the Specifications column. Method 4: On the Activate Cluster page, click Download HSM Management Tool. Debian Visit hsm-client-2.03.15.10-20240710_1.x86_64.deb to download the HSM management tool.
      Step 2: Install the HSM management tool.	Run the following command to install the program and client configuration file in the /opt/hsm directory: CentOS sudo yum install -y hsm-client-v2.03.15.10-1.x86_64.rpm Debian sudo dpkg -i hsm-client-2.03.15.10-20240710_1.x86_64.deb
      Step 3: Modify the client configuration file.	Modify the configuration items in servers in the /opt/hsm/etc/hsm_mgmt_tool.cfg file. name and hostname: Replace the values with the private IP address of the master HSM. owner_cert_path: Replace the value with the path to the issuerCA.crt file. Example of the hsm_mgmt_tool.cfg file { "servers": [ { "name" : "172.16.XX.XX", "hostname" : "172.16.XX.XX", "port" : 2225, "certificate": "/opt/hsm/etc/client.crt", "pkey": "/opt/hsm/etc/client.key", "CAfile": "", "CApath": "/opt/hsm/etc/certs", "ssl_ciphers": "", "server_ssl" : "yes", "enable" : "yes", "owner_cert_path":"<issuerCA.crt file path>" }], "scard": { "enable": "no", "port": 2225, "ssl": "no", "ssl_ciphers": "", "certificate": "cert-sc", "pkey": "pkey-sc" } }
      Step 4: Log on to the master HSM and query a list of users.	Run the following command to log on to the master HSM: /opt/hsm/bin/hsm_mgmt_tool /opt/hsm/etc/hsm_mgmt_tool.cfg Run the listUsers command to query users. cloudmgmt>listUsers Users on server 0(172.16.XX.XX): Number of users found:2 User Id User Type User Name MofnPubKey LoginFailureCnt 2FA 1 PRECO admin NO 0 NO 2 AU app_user NO 0 NO
      Step 5: Change a precrypto officer (PRECO) to a crypto officer (CO).	Run the loginHSM command to log on to the master HSM as a PRECO. cloudmgmt>loginHSM PRECO admin password loginHSM success Run the changePswd command to change the password of the PRECO. After you change the password, the PRECO changes to a CO. cloudmgmt>changePswd PRECO admin <NewPassword> *************************CAUTION******************************** This is a CRITICAL operation, should be done on all nodes in the cluster. Cav server does NOT synchronize these changes with the nodes on which this operation is not executed or failed, please ensure this operation is executed on all nodes in the cluster. **************************************************************** Do you want to continue(y/n)?y Changing password for admin(PRECO) on 1 nodes Run the listUsers command to query users and check whether the PRECO changes to a CO. cloudmgmt>listUsers Users on server 0(172.16.XX.XX): Number of users found:2 User Id User Type User Name MofnPubKey LoginFailureCnt 2FA 1 CO admin NO 0 NO 2 AU app_user NO 0 NO
      Step 6: Create a crypto user (CU).	Warning Before you add non-master HSMs to a cluster, you must create a CU. Otherwise, the CU information cannot be synchronized to the non-master HSMs. Run the createUser command to create a CU. The username and password of a CU can contain ASCII characters. The username can be up to 20 characters in length. The password can be 8 to 32 characters in length. In this example, the username is crypto_user. You can specify the username based on your business requirements. If you configure an HSM cluster for an instance of the hardware key management type, you can specify kmsuser as the username. createUser CU crypto_user <enter password> Run the listUsers command to check whether the CU is created. Expected output: cloudmgmt>listUsers Users on server 0(172.16.XX.XX): Number of users found:3 User Id User Type User Name MofnPubKey LoginFailureCnt 2FA 1 CO admin NO 0 NO 2 AU app_user NO 0 NO 3 CU crypto_user NO 0 NO
      Step 7: Check the status of the master HSM.	In the Activate Cluster step, click the icon to refresh the status of the master HSM. Then, click Next.

4. In the Add HSM step, add the non-master HSM to the cluster as prompted and click Complete.

   You can purchase additional HSMs and add the HSMs to the cluster based on your business requirements.