Utimaco Se Series User manual

CryptoServer LAN
Se-Series
Operating Manual

Imprint
Copyright 2016
Utimaco IS GmbH
Germanusstr. 4
D-52080 Aachen
Germany
Phone
+49 (0)241 / 1696-200
Fax
+49 (0)241 / 1696-199
Internet
http://hsm.utimaco.com
e-mail
[email protected]
Document Version
1.1.4
Date
29.05.2016
Status
Final
Document No.
M010-0006-en
All Rights reserved
No part of this documentation may be reproduced in any form (printing, photocopy or
according to any other process) without the written approval of Utimaco IS GmbH or be
processed, reproduced or distributed using electronic systems.
Utimaco IS GmbH reserves the right to modify or amend the documentation at any time
without prior notice. Utimaco IS GmbH assumes no liability for typographical errors and
damages incurred due to them.
All trademarks and registered trademarks are the property of their respective owners.

Table of Contents
Page 3 of 26
Table of Contents
1Introduction ................................................................................................................................5
1.1 About this Manual ...................................................................................................................... 5
1.1.1 Target Audience for this Manual .......................................................................................... 5
1.1.2 Contents of this Manual ....................................................................................................... 5
1.1.3 Document Conventions ........................................................................................................ 5
1.2 Other Manuals ............................................................................................................................ 6
1.3 Import and Export Regulations................................................................................................... 7
1.4 Damage in Transit ...................................................................................................................... 8
1.5 Deliverables................................................................................................................................ 8
2General Safety Instructions......................................................................................................... 9
2.1 Moving and Storing .................................................................................................................... 9
2.2 Environmental Temperature....................................................................................................... 9
2.3 19″Rack....................................................................................................................................10
2.4 Desktop ....................................................................................................................................10
2.5 Power Supply and Power Supply Cable.................................................................................... 11
2.6 Opening the Device...................................................................................................................12
2.7 Batteries ...................................................................................................................................12
2.7.1 External Battery in the Battery Compartment ....................................................................13
2.7.2 Carrier Battery of the CryptoServer Se...............................................................................13
2.8 Cleaning....................................................................................................................................13
3Bringing into Service.................................................................................................................14
3.1 Ports and Interfaces on the Rear Face.....................................................................................14
3.2 Ports and Operating Elements on the Front Face ....................................................................15
3.3 Connectors and Operating Elements in the Battery Compartment ..........................................15
3.3.1 Menu Control Buttons.........................................................................................................16
3.4 Bringing the CryptoServer LAN into Service ............................................................................17
4Maintenance..............................................................................................................................18
4.1 Checking the Battery Status..................................................................................................... 18
4.2 Replacing the External Battery.................................................................................................19
5Switching off the CryptoServer LAN ..........................................................................................22
6Disposing of the CryptoServer LAN............................................................................................23
7Technical Data...........................................................................................................................24
8Contact Address for Support Queries ........................................................................................26

Table of Contents
Page 4 of 26

Introduction
Page 5 of 26
1Introduction
Thank you for purchasing our CryptoServer LAN security system with an integrated
CryptoServer Se plug-in card (referred to below as CryptoServer LAN). We hope you are
satisfied with our product. Please do not hesitate to contact us if you have any complaints or
comments.
1.1 About this Manual
The Utimaco IS GmbH reserves the right to modify or amend this manual at any time without
prior notice. Utimaco IS GmbH assumes no liability for typographical errors and damages
incurred due to them.
1.1.1 Target Audience for this Manual
This manual is intended for system administrators who bring the CryptoServer LAN with an
integrated CryptoServer Se-Series into service and administer it.
1.1.2 Contents of this Manual
In this operating manual you will find all the necessary information for using the hardware of
the CryptoServer LAN as well as essential security instructions that are to be followed in order
to ensure that the device can be operated safely.
1.1.3 Document Conventions
We use the following conventions in this manual:
Convention
Usage
Example
Bold
Items of the Graphical User Interface
(GUI), e.g., menu options
Press the OK button.
Monospaced
File names, folder and directory
names, commands, file outputs,
programming code samples
You will find the file example.conf in
the /exmp/demo/ directory.
Italic
References and important terms
See Chapter 3, "Sample Chapter" in the
CryptoServer LAN/CryptoServer
CryptoServer Command-line Administration
Tool -csadm -Manual for System
Administrators.

Introduction
Page 6 of 26
We have used icons to highlight the most important notes and information.
Here you find important safety information that should be followed.
Here you find additional notes or supplementary information.
1.2 Other Manuals
The CryptoServer is supplied as a PCI-Express (PCIe) plug-in card in the following series:
■CryptoServer CSe-Series
■CryptoServer Se-Series
The CryptoServer LAN (appliance) is supplied in the following series:
■CryptoServer LAN CSe-Series
■CryptoServer LAN Se-Series
We provide the following manuals on the product CD for the CryptoServer PCIe CSe- and Se-
Series plug-in cards and for the CryptoServer LAN (appliance) CSe- and Se-Series:
Quick Start Guides
You will find these manuals in the main folder of the SecurityServer product CD. They are
available only in English, do not cover all possible scenarios, and are intended as a
supplement to the product documentation provided on the SecurityServer product CD.
■CryptoServer LAN - Quick Start Guide
If you are looking for step-by-step instructions on how to bring the CryptoServer LAN into
service, how to prepare a computer (Windows 7) for the CryptoServer administration and
how to start administrating your CryptoServer with the Java-based GUI CryptoServer
Administration Tool (CAT), read this document.
■CryptoServer PCIe - Quick Start Guide
If you are looking for step-by-step instructions on how to bring the CryptoServer PCIe plug-
in card into service, how to install the CryptoServer driver on a computer with minimal
RHEL 7.0 installation and how to start administrating your CryptoServer with the
CryptoServer Command-line Administration Tool (csadm), read this document.

Introduction
Page 7 of 26
Manuals for System Administrators
You will find these manuals on the product CD in the following folder:
…Documentation\Administration Guides\
■CryptoServer - Manual for System Administrators
If you need to administer a CryptoServer PCIe plug-in card or a CryptoServer LAN using
the CryptoServer Administration Tool (CAT), read this manual. Furthermore, this manual
provides a detailed description of the CryptoServer functions, required for the correct and
effective operation of the product.
■CryptoServer LAN - Manual for System Administrators
If you need to administer a CryptoServer LAN (appliance), read this manual. Since a
CryptoServer plug-in card is integrated into the CryptoServer LAN, please read the
CryptoServer - Manual for System Administrators, as well.
■CryptoServer LAN/CryptoServer - Troubleshooting
If problems occur while you are using a CryptoServer PCIe plug-in card or a CryptoServer
LAN (appliance), read this manual.
■CryptoServer LAN/CryptoServer
PKCS#11 CryptoServer Administration Tool –Manual for System Administrators
If you need to administer the PKCS#11 R2 interface with the PKCS#11 CryptoServer
Administration Tool (P11CAT), read this manual.
■CryptoServer LAN/CryptoServer
CryptoServer Command-line Administration Tool - csadm - Manual for System Administrators
If you need to administer a CryptoServer PCIe plug-in card or a CryptoServer LAN using
the CryptoServer Command-line Administration Tool (csadm), read this manual (only
English version available).
Operating Manuals
You will find these manuals on the product CD in the following folder:
…Documentation\Operating Manuals\. They contain all the necessary information for using
the hardware of the CryptoServer PCIe plug-in card respectively the CryptoServer LAN
(appliance).
1.3 Import and Export Regulations
The export and use of CryptoServer LAN outside Germany is subject to the legal foreign trade
regulations of the Federal Republic of Germany and requires the appropriate authorization.
The import of CryptoServer LAN is subject to the legal requirements or other regulations that
apply in the particular destination (import license)

Introduction
Page 8 of 26
Please contact your own national customs authorities for more detailed information.
1.4 Damage in Transit
By purchasing CryptoServer LAN you have acquired a device that has been carefully tested
and packed for delivery. Nevertheless, damage may occur during transport or improper
temporary storage.
If you discover that the transport boxes are damaged when they arrive, please immediately
contact your reseller or Utimaco IS GmbH (the address and telephone number are given in
Chapter 8, "Contact Address for Support Queries"). Please have the delivery note and the
device's serial number ready
1.5 Deliverables
The CryptoServer LAN deliverables include:
■one CryptoServer LAN
■one power supply cable
■one CryptoServer LAN Se-Series Operating Manual (this manual)
■one PIN pad
■ten smartcards for administering CryptoServer LAN.

General Safety Instructions
Page 9 of 26
2General Safety Instructions
Please follow all the warnings, safety notes and instructions given on the device or in this
manual. If you fail to do so, Utimaco IS GmbH will not accept any liability for any resulting
damage caused.
The CryptoServer LAN includes a CryptoServer Se. If the predefined limit values for its internal
temperature are exceeded (or not reached), all the data on the CryptoServer Se will be deleted.
Before unpacking the device and bringing it into operation, please read the safety
instructions below carefully to ensure that the device can be operated safely.
Always keep these instructions handy, in a safe place.
2.1 Moving and Storing
When moving and storing the device, please follow these instructions:
■Before moving CryptoServer LAN, ensure that the power supply cable has been pulled out
of the socket and that all other connection cables have been removed from the other
devices.
■CryptoServer LAN should only be moved and stored in its original packaging.
■You must make sure that CryptoServer LAN is always stored at temperatures between -
10°C and +55°C (+14°F to +131°F).
■Do not subject the device to impacts and vibrations or any other physical events that may
damage the packaging.
■If the device is to be stored for a longer time period, ensure that the battery replacement
time is not exceeded.
■Keep this manual together with your CryptoServer LAN so that it is handy if you need to
reinstall the system.
2.2 Environmental Temperature
CryptoServer LAN must only be operated and stored in a particular temperature range.
■You must make sure that CryptoServer LAN is always stored at temperatures between
-10 °C and +55 °C (+14 °F to +131 °F).

General Safety Instructions
Page 10 of 26
■You must make sure that CryptoServer LAN is always operated at temperatures between
+10 °C and +50 °C (+50 °F to +122 °F).
If the environmental temperature is out of the permitted range, the device sensor will
delete all the data on it.
2.3 19″Rack
Brackets are attached to either side of the device so that CryptoServer LAN can be installed in
a 19″rack.
■Before it is installed in a 19″rack, CryptoServer LAN must be placed on rails that are
strong enough to bear its weight. You must ensure that the device is evenly balanced and
is placed squarely on the rails to ensure that it is stable. To ensure the weight is evenly
distributed, do not stack too many devices on each set of rails. Find out what weight load
the rails will bear.
■To install CryptoServer LAN in a 19″rack, simply attach the securing brackets to the 19″
rack.
■The temperature inside the 19″rack may be higher than the temperature outside the 19″
rack. This is particularly true if several devices are installed in the same 19″rack. Please
ensure that the temperature inside the 19″rack does not exceed the maximum permitted
environmental temperature.
■Take care that, when you install the device in a 19″rack, the ventilation slots are kept free
to ensure that air circulates enough.
■You can use slide rails for the installation of the CryptoServer LAN in a 19″rack which you
can purchase from the manufacturer Utimaco IS GmbH.
2.4 Desktop
If you do not want to install CryptoServer LAN in a 19″rack, please note the following:
■Place the device on a secure, stable surface. Avoid impacts and blows to the device.
■Never operate CryptoServer LAN close to water or other liquids. Never spill liquid on the
device.
■Do not place objects, articles of clothing or papers on the device itself.
■Protect CryptoServer LAN against humid or dusty environments, vibrations, extreme
temperature variations and direct sunlight. Do not place the device next to heating units,
air conditioning units, etc.

General Safety Instructions
Page 11 of 26
■Ensure that the maximum permitted environmental temperature is not exceeded.
■Ensure adequate ventilation. Never install the device in a cabinet or similar object in which
the circulation of air is impeded. The ventilation slots on the device must never be
covered.
■Do not connect the device to sockets that are switchable or have timers.
■Avoid connecting the device to electrical circuits to which other power-hungry devices
(such as motors, air conditioning units, photocopiers etc.) are connected. This would put
the device at risk of sudden power fluctuations.
This device has not been designed for use at a workstation within the user's field of vision.
To avoid disturbing reflections, do not place this product at a workstation directly in the field
of vision.
2.5 Power Supply and Power Supply Cable
The CryptoServer LAN is equipped with an alternating current (AC) power supply. It can be
connected to power voltage of 90 V to 264 V (AC).
Check the power voltage. Connecting CryptoServer LAN to the incorrect power voltage may
destroy the device.
■Check the electrical connection to the power circuit to ensure it will not be overloaded.
■Ensure that the device's electrical connection is properly earthed. If you connect several
devices together, their total power consumption may exceed the total safe limit.
■Handle the power supply cable carefully. Always disconnect it by pulling on the plug, not
on the cable itself. Pulling on the cable loosens the contacts and can cause problems.
■Protect the power supply cable against physical damage. Never place furniture or other
heavy objects on the power supply cable and do not drop any sharp-edged or heavy
objects on it.
■Do not tie knots in the power supply cable.

General Safety Instructions
Page 12 of 26
2.6 Opening the Device
CryptoServer LAN must only be opened by the employees of Utimaco IS GmbH or certified
sales partners.
If CryptoServer LAN is opened by someone else, instead of an employee of Utimaco IS
GmbH or a certified sales partner, Utimaco IS GmbH accepts no liability for any damage
caused by opening the device.
However, if there is an urgent need to open the device, it is essential that the power supply
plug is removed from the socket before the device is opened.
To ensure that CryptoServer LAN cannot be opened without anyone noticing, there are two
security seals on the device itself. The following information is given on these seals:
No warranty if seal is broken!
A broken seal is a security risk!
Please contact the security administrator!
■To avoid the risk of electrical shocks or fires, do not attempt to tamper with any
components inside the device.
■Do not attempt to repair CryptoServer LAN in any way.
■If water, wires or other parts penetrate the device by accident, immediately disconnect the
power supply cable and inform your dealer or Utimaco IS GmbH. If you operate the device
in this condition, you risk either causing a fire, or electrical shocks.
■Do not insert any objects into the openings in the CryptoServer LAN casing because they
may hit live components and cause a short circuit. This may result in a fire or a life-
threatening electrical shock.
■Incorrect or improper use may seriously damage CryptoServer LAN.
2.7 Batteries
The CryptoServer LAN contains two batteries. These ensure that no security-critical
information is lost or deleted in the CryptoServer Se when the device is switched off, or if
operation is interrupted due to a power failure. The External Battery is located in the battery
compartment of the CryptoServer LAN. The Carrier Battery is placed on the carrier of the
CryptoServer Se.

General Safety Instructions
Page 13 of 26
These batteries are not rechargeable.
Using the wrong batteries may cause an explosion. Utimaco IS GmbH accepts no liability for
damage caused by using any other batteries except the ones supplied by Utimaco IS GmbH.
2.7.1 External Battery in the Battery Compartment
The battery compartment behind the CryptoServer LAN's front door contains one 3.6 V lithium
battery (size D) which is directly connected to the CryptoServer Se.
This battery is already in use when the device is supplied.
The External battery can power the CryptoServer Se for at least two years if the device is not
connected to a power supply with the power supply cable. Check the status of this battery at
regular intervals. When the battery reaches a critically low power level, it must be replaced.
Customers are permitted to change the External Battery.
2.7.2 Carrier Battery of the CryptoServer Se
The CryptoServer Se has a 3 V lithium battery. The Carrier Battery powers the sensor and the
quenching circuit when CryptoServer LAN is switched off and the External Battery in the
battery compartment does not have enough power to supply the CryptoServer Se.
The Carrier Battery can power the CryptoServer Se for at least six months.
The Carrier Battery must only be replaced by an employee of Utimaco IS GmbH or one of
its certified sales partners.
2.8 Cleaning
■Clean CryptoServer LAN with a soft, clean cloth dampened with a mild soapy solution.
Then dry the device with a clean dry cloth.
■If the device has become wet, wipe it with a clean, dry, soft cloth.
■Never use benzene, thinner, alcohol or other aggressive substances to clean the device.

Bringing into Service
Page 14 of 26
3Bringing into Service
Before you start up CryptoServer LAN, check whether all its parts are present:
■one CryptoServer LAN
■one power supply cable
■one CryptoServer Se-Series LAN Operating Manual (this Manual)
■one PIN pad
■ten smartcards for administering CryptoServer LAN.
3.1 Ports and Interfaces on the Rear Face
1
Power supply switch (switches power on/off)
2
Power supply socket
3
CryptoServer Se
4
External serial port of the CryptoServer Se for connecting peripheral devices
such as a PIN pad or log terminal
5
USB port for CryptoServer Se
6
VGA connector (screen)
7
Ethernet port 10/100/1000 (RJ45) eth0
8
Ethernet port 10/100/1000 (RJ45) eth1
9
Two USB ports

Bringing into Service
Page 15 of 26
3.2 Ports and Operating Elements on the Front Face
1
PS/2 power supply for PIN pads. Can also be used as a keyboard connector
(without PS/2 Y adapter).
2
Serial port for CryptoServer LAN administration
3
Serial port of the CryptoServer Se
4
USB 2.0 port of the CryptoServer Se
5
Light to show when the device is in operation
6, 7
Buttons for CryptoServer LAN menu control
8
Two USB 2.0 ports of the CryptoServer LAN
9
Mute button for the signal tone that sounds if a power supply fails or is switched
off
10
On/off switch
11
Two USB 2.0 ports of the CryptoServer LAN
12
Battery compartment
The Connectors and operating elements 8 to 12 are located behind the front door on the
right of the front face.
3.3 Connectors and Operating Elements in the Battery Compartment
The battery compartment 12 is designed like a drawer that you simply pull to open.
Inside the battery compartment there is a plug 13 for the size D 3.6V lithium battery used by
CryptoServer LAN to provide power to the sensor system and the quenching switch for when
the device is switched off.

Bringing into Service
Page 16 of 26
Behind this battery you will find a sealed delete switch 14.
If you press this switch 14 you will trigger the deletion procedure in the CryptoServer Se
and all the security-critical information will be deleted.
The resulting maintenance tasks are not covered by Utimaco IS GmbH's liability.
3.3.1 Menu Control Buttons
There are six menu control buttons.
Button
Meaning
EXIT
Quit the currently displayed menu level or menu item
OK
Select the menu level or confirm the menu item

Move up in the menu control

Move to the right in the menu control

Move down in the menu control

Move to the left in the menu control

Bringing into Service
Page 17 of 26
3.4 Bringing the CryptoServer LAN into Service
To bring the device into operation, follow these steps:
1. Put the CryptoServer LAN in a 19″rack or put it in the place where you want.
2. Connect the power supply socket 2on the rear face of the CryptoServer LAN to a power
supply using the power supply cable supplied with the device.
3. Connect the Ethernet port 7on the rear face of the CryptoServer LAN to your network with
a twisted pair cable (RJ45).
4. Switch on the power switch 1on the rear face of the CryptoServer LAN.
5. Press the on/off switch 10 on the front of the device to switch on the CryptoServer LAN.
After a few seconds you will hear a short signal tone and see the first messages on the
display panel on the front of the device.
After approximately 30 seconds, CryptoServer LAN will be ready for use. You will see this
status information on the display panel:
CryptoServer Se
Mode: Operational OK Temp.: 31,0 °C
Trans./min.: 0 Clients: 1
Load: 0 %

Maintenance
Page 18 of 26
4Maintenance
The only maintenance task that a customer is permitted to perform on the CryptoServer LAN
is to check the power level of the batteries and if necessary to change the External Battery in
the battery compartment. When the External Battery reaches a critically low power level, it
must be replaced.
Apart from this, no maintenance tasks should be carried out on the CryptoServer LAN.
If you should open CryptoServer LAN for any other maintenance work, all liability claims
against Utimaco IS GmbH become null and void.
4.1 Checking the Battery Status
The CryptoServer LAN displays LOW when the External Battery in the battery compartment or
the Carrier Battery of the CryptoServer PCI reaches a critical power level.
CryptoServer Se
Mode: Operational LOW Temp.: 31,0 °C
Trans./min.: 5 Clients: 1
Load: 0 %
To find out which of these batteries has reached this critical power level, follow these steps:
1. Click OK.
2. Click the button to select the CryptoServer Administration menu item and then click OK.
3. Click OK to select Show CryptoServer Info.
4. Use the direction key to go to the Battery State menu item and then click OK.
In the CryptoServer LAN display, the Battery State is shown as follows:
Battery State:
Carrier Battery: LOW (1.104 V)
External Battery: LOW (1.574 V)

Maintenance
Page 19 of 26
If the system could not find out the battery state, because the CryptoServer Se register is
currently being accessed by someone else, then you should try to find out the battery state
again after waiting a few minutes.
In the case of CryptoServer LAN you can change External Battery.
The Carrier Battery of the CryptoServer Se must only be replaced by the manufacturer,
Utimaco IS GmbH or a certified sales partner.
■If the External Battery state displayed is LOW, it means the CryptoServer LAN's battery
charge has sunk to a critical level. You must now immediately, and whilst the device is in
operation, replace the External Battery in the battery compartment.
■If the Carrier Battery state displayed is LOW, it means the power level of the CryptoServer
Carrier Battery has sunk to a critical level. In this case, contact Utimaco IS GmbH or a
certified sales partner and have them replace the Carrier Battery of the CryptoServer Se.
4.2 Replacing the External Battery
To replace the External Battery in the CryptoServer LAN's battery compartment you will need a
battery replacement kit which you can purchase from Utimaco IS GmbH, and a wire cutter.
This battery is not rechargeable.
Using the wrong batteries may cause an explosion.
Utimaco IS GmbH accepts no responsibility for damage caused by any batteries other than
those supplied by Utimaco IS GmbH.
Please ensure you dispose of spent batteries in accordance with the manufacturer's
instructions and in an environmentally responsible manner.
The battery replacement kit includes a 3.6 V lithium battery (with a connection plug) a cable
tie and a metal hook that you use to open the battery compartment.
You should replace the battery whilst the device is running normally so that the CryptoServer
Se will continue to be supplied with power.
1. Open the front door of the CryptoServer LAN.
2. Insert the ends of the hook in the holes in the battery compartment as shown in the next
picture.

Maintenance
Page 20 of 26
3. Now carefully pull out the battery compartment.
During the next steps, take great care not to touch the delete switch on the back wall of the
battery compartment.
4. Unplug the power supply plug 13 from the back wall of the battery compartment.
5. Use the wire cutter to carefully disconnect the cable tie from the battery.