Deploy CTLog with PKCS #11

Configure and deploy Certificate Transparency Log in the SecureSign custom resource to use PKCS #11 HSM-backed signing keys.

Before you begin

  • CTLog key ceremony is completed and the following Secrets are created:
    • ctlog-public-key containing the CTLog public key
    • hsm-credentials containing the HSM PIN
  • Fulcio root CA certificate Secret (fulcio-root-ca) is created.

Procedure

  1. Create or edit the SecureSign custom resource with CTLog PKCS #11 configuration: 
    apiVersion: rhtas.redhat.com/v1
kind: Securesign
metadata:
  name: securesign-sample
  namespace: trusted-artifact-signer
spec:
  # ... other components configuration ...
  ctlog:
    signer:
      type: pkcs11
      pkcs11:
        modulePath: /usr/lib64/pkcs11/libsofthsm2.so
        tokenLabel: PKCS11CA
        pinSecretRef:
          name: hsm-credentials
          key: pin
        publicKeyRef:
          name: ctlog-public-key
          key: public.pem
    rootCertificates:
      - name: fulcio-root-ca
        key: cert.pem
    auth:
      env:
        - name: SOFTHSM2_CONF
          value: /etc/softhsm/softhsm2.conf
    initContainers:
      - name: hsm-lib-export
        image: HSM_LIBRARY_IMAGE
        command: ["cp", "/usr/lib64/pkcs11/libsofthsm2.so", "/var/run/hsm-lib/"]
        volumeMounts:
          - name: hsm-lib
            mountPath: /var/run/hsm-lib
    volumes:
      - name: softhsm-config
        configMap:
          name: softhsm-config
      - name: hsm-tokens
        persistentVolumeClaim:
          claimName: ctlog-hsm-tokens-pvc
    volumeMounts:
      - name: softhsm-config
        mountPath: /etc/softhsm
        readOnly: true

    where:

    HSM_LIBRARY_IMAGE
    The container image containing your PKCS #11 library.
  2. Apply the SecureSign custom resource: 
    $ oc apply -f securesign-pkcs11.yaml -n trusted-artifact-signer
  3. Wait for CTLog deployment to complete: 
    $ oc wait --for=condition=Ready ctlog \
  -n trusted-artifact-signer --timeout=5m