Utimaco CryptoServer Se Series User manual

CryptoServer PCIe
Se-Series
Operating Manual

Imprint
Copyright 2017
Utimaco IS GmbH
Germanusstr. 4
D-52080 Aachen
Germany
Phone
+49 (0)241 / 1696-200
Fax
+49 (0)241 / 1696-199
Internet
http://hsm.utimaco.com
e-mail
[email protected]
Document Version
1.1.6
Date
2017-02-08
Status
Final
Document No.
M010-0004-en
All Rights reserved
No part of this documentation may be reproduced in any form (printing, photocopy or
according to any other process) without the written approval of Utimaco IS GmbH or be
processed, reproduced or distributed using electronic systems.
Utimaco IS GmbH reserves the right to modify or amend the documentation at any time
without prior notice. Utimaco IS GmbH assumes no liability for typographical errors and
damages incurred due to them.
All trademarks and registered trademarks are the property of their respective owners.

Table of Contents
Page 3 of 28
Table of Contents
1Introduction ................................................................................................................................5
1.1 About this Manual ...................................................................................................................... 5
1.1.1 Target Audience for this Manual .......................................................................................... 5
1.1.2 Contents of this Manual ....................................................................................................... 5
1.1.3 Document Conventions ........................................................................................................ 5
1.2 Other Manuals ............................................................................................................................ 6
1.3 Import and Export Regulations................................................................................................... 8
1.4 Damage in Transit ...................................................................................................................... 8
1.5 Deliverables................................................................................................................................ 8
2General Safety Advice ................................................................................................................. 9
2.1 Moving and Storing .................................................................................................................... 9
2.2 Battery......................................................................................................................................10
2.3 Safely Transporting the CryptoServer......................................................................................10
2.4 Environmental Temperature.....................................................................................................11
3Components of CryptoServer Se (PCIe) .....................................................................................12
4Unpacking and Handling............................................................................................................13
4.1 General Notes...........................................................................................................................13
4.2 Installing the CryptoServer Se..................................................................................................14
4.3 Removing the CryptoServer Se.................................................................................................15
5Installation of the CryptoServer Driver Software........................................................................16
5.1Installation on Windows Operating Systems............................................................................16
5.1.1 Installing the Driver ............................................................................................................ 16
5.1.2 Performing a Functional Test.............................................................................................17
5.1.3 Updating the Driver............................................................................................................. 18
5.1.4 Uninstalling the Driver........................................................................................................19
5.2 Installation on Linux Operating Systems .................................................................................19
5.2.1 Compiling/Installing the Driver...........................................................................................19
5.2.2 Performing a Functional Test.............................................................................................20
5.2.3 Updating the Driver............................................................................................................. 21
5.2.4 Uninstalling the Driver........................................................................................................21
6Replacing the Battery................................................................................................................22
7Disposing of the CryptoServer Se ..............................................................................................26
8Technical Data...........................................................................................................................27
9Contact Address for Support Queries ........................................................................................28

Table of Contents
Page 4 of 28

Introduction
Page 5 of 28
1Introduction
Thank you for purchasing our CryptoServer Se-Series security system (referred to below as
CryptoServer Se). We hope you are satisfied with our product. Please do not hesitate to
contact us if you have any complaints or comments.
1.1 About this Manual
In this operating manual you will find all the necessary information for using the hardware of
the CryptoServer Se as well as essential security instructions that are to be followed in order
to ensure that the device can be operated safely.
1.1.1 Target Audience for this Manual
This manual is intended for system administrators who bring the CryptoServer Se into service
and administer it.
1.1.2 Contents of this Manual
Chapter 2 provides safety instructions that should be read carefully, before unpacking the
CryptoServer Se and bringing it into operation.
Chapter 3 shows the different components of the CryptoServer Se.
Chapter 4 contains some general notes about how to safely unpack and handle the
CryptoServer Se, as well as general description of the procedure for installation and
uninstallation of the CryptoServer Se PCIe plug-in card.
Chapter 5 describes how to install the CryptoServer Se driver on the host computer, update,
test and remove it under Windows and Linux operating systems.
Chapter 6 provides instructions on how to replace the battery of the CryptoServer Se.
Chapter 7 gives information about what needs to be taken into account when disposing of the
CryptoServer Se.
Chapter 8 is an overview of CryptoServer Se's essential technical data.
Chapter 9 provides the manufacturer's contact data in case you have questions on
CryptoServer Se or problems occurred while operating the CryptoServer Se.
1.1.3 Document Conventions
We use the following conventions in this manual:
Bold
Items of the Graphical User Interface (GUI), e.g., menu options
Monospaced
File names, folder and directory names, commands, file outputs,
programming code samples
Italic
References and important terms

Introduction
Page 6 of 28
We have used icons to highlight the most important notes and information.
Here you find important safety information that should be followed.
Here you find additional notes or supplementary information.
1.2 Other Manuals
The CryptoServer is supplied as a PCI-Express (PCIe) plug-in card in the following series:
■CryptoServer CSe-Series
■CryptoServer Se-Series
■CryptoServer Se-Series Gen2
The CryptoServer LAN (appliance) is supplied in the following series:
■CryptoServer LAN CSe-Series
■CryptoServer LAN Se-Series
■CryptoServer LAN Se-Series Gen2
We provide the following manuals on the product CD for the CryptoServer PCIe CSe- and Se-
Series and Se-Series Gen2 plug-in cards and for the CryptoServer LAN (appliance) CSe-, Se-
and Se-Series Gen2:
Quick Start Guides
You will find these Manuals in the main folder of the SecurityServer product CD. They are
available only in English, do not cover all possible scenarios, and are intended as a
supplement to the product documentation provided on the SecurityServer product CD.
■CryptoServer LAN - Quick Start Guide
If you are looking for step-by-step instructions on how to bring the CryptoServer LAN into
service, how to prepare a computer (Windows 7) for the CryptoServer administration and
how to start administrating your CryptoServer with the Java-based GUI CryptoServer
Administration Tool (CAT), read this document.

Introduction
Page 7 of 28
■CryptoServer PCIe - Quick Start Guide
If you are looking for step-by-step instructions on how to bring the CryptoServer PCIe plug-
in card into service, how to install the CryptoServer driver on a computer with minimal
RHEL 7.0 installation and how to start administrating your CryptoServer with the
CryptoServer Command-line Administration Tool (csadm), read this document.
Manuals for System Administrators
You will find these manuals on the product CD in the following folder:
…Documentation\Administration Guides\
■CryptoServer - Manual for System Administrators
If you need to administer a CryptoServer PCIe plug-in card or a CryptoServer LAN using
the CryptoServer Administration Tool (CAT), read this manual. Furthermore, this manual
provides a detailed description of the CryptoServer functions, required for the correct and
effective operation of the product.
■CryptoServer LAN - Manual for System Administrators
If you need to administer a CryptoServer LAN (appliance), read this manual. Since a
CryptoServer plug-in card is integrated into the CryptoServer LAN, please read the
CryptoServer - Manual for System Administrators, as well.
■CryptoServer LAN/CryptoServer - Troubleshooting
If problems occur while you are using a CryptoServer PCIe plug-in card or a CryptoServer
LAN (appliance), read this manual.
■CryptoServer LAN/CryptoServer
PKCS#11 CryptoServer Administration Tool –Manual for System Administrators
If you need to administer the PKCS#11 R2 interface with the PKCS#11 CryptoServer
Administration Tool (P11CAT), read this manual.
■CryptoServer LAN/CryptoServer
CryptoServer Command-line Administration Tool - csadm - Manual for System Administrators
If you need to administer a CryptoServer PCIe plug-in card or a CryptoServer LAN using
the CryptoServer Command-line Administration Tool (csadm), read this manual (only
English version available).
Operating Manuals
You will find these manuals on the product CD in the following folder:
…Documentation\Operating Manuals\. They contain all the necessary information for
using the hardware of the CryptoServer PCIe plug-in card respectively the CryptoServer LAN
(appliance).

Introduction
Page 8 of 28
1.3 Import and Export Regulations
The export and use of CryptoServer Se outside Germany is subject to the legal foreign trade
regulations of the Federal Republic of Germany and requires the appropriate authorization.
The import of CryptoServer Se is subject to the legal requirements or other regulations that
apply in the particular destination (import license).
Please contact your own national import authorities for more detailed information.
1.4 Damage in Transit
By purchasing CryptoServer Se you have acquired a device that has been carefully tested and
packed for delivery. Nevertheless, damage may occur during transport or improper temporary
storage.
If you discover that the transport boxes are damaged when they arrive, please immediately
contact your reseller or Utimaco IS GmbH (the address and telephone number are given in
Chapter 9 of the current document). Please have the delivery note and the device's serial
number ready
1.5 Deliverables
The CryptoServer Se deliverables include:
■one CryptoServer Se PCI Express plug-in card
■one CryptoServer PCIe Se-Series Operating Manual (this Manual)
You can also use smartcards to administer the CryptoServer Se. These smartcards, and also
the appropriate PIN pad can be purchased from Utimaco IS GmbH.
You cannot use PIN pads and smartcards that were not purchased from Utimaco IS GmbH to
administer the CryptoServer Se.

General Safety Advice
Page 9 of 28
2General Safety Advice
Please follow all the warnings, safety notes and instructions given on the device or in this
introduction. If you fail to do so, Utimaco IS GmbH will not accept any responsibility for any
resulting damage caused.
The hardware security module CryptoServer Se is fitted with a sensor which will delete all the
data from the device if it is physically tampered with, or if the environmental temperature rises
above, or falls below, the permitted operating temperature range.
Please read the safety instructions below carefully, before unpacking the device and bringing
it into operation, to ensure that the device can be operated safely, and to prevent the
CryptoServer Se sensors from deleting data by mistake.
Always keep these instructions handy, in a safe place.
Do not attempt to repair the CryptoServer Se in any way.
2.1 Moving and Storing
When moving and storing the device, follow these instructions:
■The CryptoServer Se should only be moved and stored in its original packaging.
■Do not subject the device to impacts and vibrations or any other physical events that may
damage the packaging.
■You must make sure that the CryptoServer Se is always stored at temperatures between -
10 °C and +55 °C (+14 °F and +131 °F).
■If the device is to be stored for a longer time period, please ensure that the battery
replacement time is not exceeded.
■Keep this Manual together with your CryptoServer Se so that it is handy if you need to
reinstall the system.
■The PCIe connector is fragile, and can be damaged or even broken during movement and
transport by force and acceleration of the computer chassis, where the CryptoServer is
installed in.
■There is a point of mechanical stress on the printed circuit board (PCB) near the PCIe
bracket, which can be damaged.
■The maximum permissible deflection of the CryptoServer's PCB across its surface during
movement and transport is restricted to 2 mm.

General Safety Advice
Page 10 of 28
For these reasons careful attention is required during transport, movement and storage of the
CryptoServer plug-in cards all series. We strongly recommend to remove the CryptoServer
PCIe plug-in card from the computer prior to any planned transport or movement. All
cryptographic keys stored on the plug-in card remain securely maintained during the transport
or movement since the CryptoServer is continuously supplied with power by a battery.
2.2 Battery
One 3 V lithium battery ensures that the CryptoServer Se sensors and the erase circuit are
always able to function correctly, that is, as long as the CryptoServer is not installed in a
computer or even if the computer, where it is installed in, is switched off. This battery can
power the CryptoServer for at least six months, and is already in use when the device is
supplied.
This battery is not rechargeable.
If the CryptoServer Se is operated in a computer that is not itself switched on, you must
change the battery at regular intervals. If you do not do so, an alarm might be triggered and
all the data on the device may be lost.
2.3 Safely Transporting the CryptoServer
To ensure the safe transport of the CryptoServer plug-in card proceed as follows:
1. Check the battery state with the csadm command GetBattState.
▣Example on a Windows operating system:
C:\>csadm Dev=PCI:0 GetBattState
▣Example on a Linux operating system:
C:\>csadm Dev=/dev/cs2 GetBattState
If the residual battery power is displayed as ok, for example,
Carrier Battery: ok (3.068 V),
continue with step 3.
If the residual battery power is displayed as low, for example,
Carrier Battery: low (2.650 V),
continue with step 2.
2. Replace the battery by a new one (3 V, Lithium, FDK CR 12600 SE-T1 with soldering tags,
or similar type). You will find step-by-step instructions on how to do that in chapter 6 of
the current document. Please note that this battery ensures the power supply of the
CryptoServer Se for at least six months.