Renewing Flash Access Certs when a HSM is used

Question

Hi
our operations team came across a potential problem in the process of renewing Flash Access certs for
When a HSM is not used: old certs are referenced in the FA config file so that they can be used to decrypt content that has been encrypted with the old certs. We have done this in the past and works fine.
When a HSM IS used: the FA config file needs to be able to reference old certs stored on the HSM. It looks like the FA application is unable to do this. It is not possible to remove the private key from the HSM and so it is not an option to store the old certs locally on the license server (not that we would want to do that anyway).
I’m not sure if it’s an option to point FA to the HSM to look for the certs. Any ideas how this can be done?
thanks

Answer 1

Hi DeclanK,
Take a look at the flashaccess-refimpl.properties file.  The bottom of it should have all sorts of HSM-only configuration settings that you can modify to suit your needs.  You'll see that there are several additional server certificates (ServerCredential.Alias.1=, etc...) that you can set for your license server.  This is where your older certificates go.
HOWEVER, please note that your license server will not work unless you also have a non-expired certificate set (ServerCredential.Alias=).
cheers,
/Eric.
# HSM Properties #
# Enables or disables the packager use of HSM. If this is set to true, then set up all the HSM related properties.
RefImpl.HSM.Enabled=false
# Full path of configuration file name passed to sun.security.pkcs11.SunPKCS11(configFile)
RefImpl.SunPKCS11.ConfigFileName=[pkcs11-filename.cfg]
# HSM partition password ** See note above regarding passwords **
#RefImpl.HSM.PartitionPWD=[your-hardware-password]
# Alias of Adobe-issued server transport credential (certificate and private key) stored on HSM
# When HSM is enabled, use this property instead of HandlerConfiguration.ServerTransportCredential and
# HandlerConfiguration.ServerTransportCredential.password
#RefImpl.HSM.HandlerConfiguration.ServerTransportCredential.Alias=[transport_cert_alias]
# Aliases of additional Adobe-issued server transport credentials (certificate and private key) stored on HSM
# When HSM is enabled, use this property instead of HandlerConfiguration.AdditionalServerTransportCredential.n and
# HandlerConfiguration.AdditionalServerTransportCredential.n.password
#RefImpl.HSM.HandlerConfiguration.AdditionalServerTransportCredential.Alias.1=[transport_c ert_alias]
#RefImpl.HSM.HandlerConfiguration.AdditionalServerTransportCredential.Alias.2=[transport_c ert_alias]
# Aliases of authorized Domain CA certificates stored on HSM
# When HSM is enabled, use this property instead of HandlerConfiguration.DomainCAs.n
#RefImpl.HSM.HandlerConfiguration.DomainCAs.Alias.1=[domain_ca_cert_alias]
#RefImpl.HSM.HandlerConfiguration.DomainCAs.Alias.2=[domain_ca_cert_alias]
# Alias of Adobe-issued license server certificate stored on HSM
# Used to verify validity of Machine Revocation List
# When HSM is enabled, use this property instead of RevocationList.verifySignature.X509Certificate
#RefImpl.HSM.RevocationList.verifySignature.X509Certificate.Alias=[license_server_cert_ali as]
# Alias of Adobe-issued license server credential (certificate and private key) stored on HSM
# When HSM is enabled, use this property instead of LicenseHandler.ServerCredential and
# LicenseHandler.ServerCredential.password
#RefImpl.HSM.LicenseHandler.ServerCredential.Alias=[license_server_cert_alias]
# Aliases of additional Adobe-issued license server credentials (certificate and private key) stored on HSM
# When HSM is enabled, use this property instead of AsymmetricKeyRetrieval.ServerCredential.n and
# AsymmetricKeyRetrieval.ServerCredential.n.password
#RefImpl.HSM.AsymmetricKeyRetrieval.ServerCredential.Alias.1=[license_server_cert_alias]
#RefImpl.HSM.AsymmetricKeyRetrieval.ServerCredential.Alias.2=[license_server_cert_alias]
# Alias of Adobe-issued domain CA credential (certificate and private key) stored on HSM
# When HSM is enabled, use this property instead of DomainRegistrationHandler.ServerCredential and
# DomainRegistrationHandler.ServerCredential.password
#RefImpl.HSM.DomainRegistrationHandler.ServerCredential.Alias=[domain_ca_cert_alias]
# Alias of Adobe-issued Packager credential (certificate and private key) stored on HSM
# This parameter is used when converting FMRMS 1.x metadata to Adobe Access format.
# When HSM is enabled, use this property instead of MetaDataConverter.SignatureParameters.ServerCredential
# and MetaDataConverter.SignatureParameters.ServerCredential.password
#RefImpl.HSM.MetaDataConverter.SignatureParameters.ServerCredential.Alias=[packager_cert_a lias]
# Alias of Adobe-issued License Server Certificate stored on HSM
# When HSM is enabled, use this property instead of V2KeyParameters.KeyOptions.AsymmetricKeyOptions.Certificate
#RefImpl.HSM.V2KeyParameters.KeyOptions.AsymmetricKeyOptions.Certificate.Alias=[license_se rver_cert_alias]
# Alias of Adobe-issued server transport certificate stored on HSM
# When HSM is enabled, use this property instead of V2KeyParameters.LicenseServerTransportCertificate
#RefImpl.HSM.V2KeyParameters.LicenseServerTransportCertificate.Alias=[transport_cert_alias ]
# Alias of Key Server's Adobe-issued license server certificate stored on HSM
# When HSM is enabled, use this property instead of HandlerConfiguration.KeyServerCertificate
#RefImpl.HSM.HandlerConfiguration.KeyServerCertificate.Alias=key_server_cert_alias