Forthe Microsoft Windows environment, add the location of NSS libraries AS_NSS and the
NSStools directory, AS_NSS_BIN to the PATHenvironment variable. For simplicity, the
proceduresdescribed in this section use UNIX commands only. You should replace the UNIX
variableswith the Windows variables, where appropriate.
Conguringthe hardware crypto accelerators is divided into two main procedures:
■“ConguringPKCS#11 Tokens” on page 121
■“ConguringJ2SE 5.0 PKCS#11 Providers” on page 124
ConguringPKCS#11 Tokens
Thissection describes how to congure PKCS#11 tokens with the NSS security tool modutil.
Usethe following procedure to congure a PKCS#11 token.
Enterthe following command (all on one line):
modutil -dbdir AS_NSS_DB -nocertdb -force -add moduleName -libfile
absolute_path_of_pkcs11_library -mechanisms list_of_security_mechanisms
where,AS_NSS_DB is the NSS database directory (same as AS_DOMAIN_CONFIG when you use
theDomain Administration Server (DAS))
Forexample, to congure a hardware accelerator token, enter the following (all on one line):
modutil -dbdir AS_NSS_DB -nocertdb -force -add "Sun Crypto Accelerator"-libfile
/opt/SUNWconn/crypto/lib/libpkcs11.so -mechanisms RSA:DSA:RC4:DES
Thehardware accelerator in this example is a SCA–1000 cryptographic accelerator. The
correspondingPKCS#11 library, by default, is located in
/opt/SUNWconn/crypto/lib/libpkcs11.so.
Themechanisms must be a complete list of the cryptographic mechanisms that are available in
thetoken. To use just a few of the available cryptographic mechanisms, see “Conguring J2SE
5.0PKCS#11 Providers” on page 124. For a list of all supported mechanisms, see the modutil
documentationon the NSS Security Tools site at
http://www.mozilla.org/projects/security/pki/nss/tools.
Theexamples that follow assume that the token name specied at token installation time is
mytoken.
Toverify that the hardware accelerator is congured properly, enter the following command:
modutil -list -dbdir AS_NSS_DB
Thestandard output will look similar to the following:
UsingHardwareCrypto Accelerator With Enterprise Server
Chapter9 • Conguring Security 121