Skip to main content
NOT AVAILABLE IN SAAS.
Moving the Syteca master certificate to a Thales HSM (hardware security module) adds an extra layer of protection, using Thales SafeNet KeySecure together with SafeNet ProtectApp.

​
Prerequisites

  • SafeNet KeySecure — install the keystore application on any machine, and set up a user account in its Management Console. See SafeNet’s own documentation for details.
  • SafeNet ProtectApp for .NET SDK — install on every machine running Syteca Application Server. In a multi-node High Availability cluster, install and configure it on each node individually.

​
1. Integrate the Application Server with Thales HSM

1

Open the SafeNet properties file

Locate ProtectAppForDotNet.properties in the SafeNet ProtectApp for .NET SDK installation.
2

Set the KeySecure server address

Find the NAE_IP= line and add the IP address of the machine running SafeNet KeySecure.
3

Enable SSL if required

Change Protocol=tcp to Protocol=ssl if certificate SSL authentication is required.
4

Enable credential encryption if required

Change Credentials_Encrypted=no to Credentials_Encrypted=yes if credentials should be encrypted.
Other options (for example, load balancing) can also be configured here — see SafeNet ProtectApp for .NET’s own documentation.
5

Restart the Application Server

Right-click the Syteca Server tray icon and stop, then start, the EkranServer service.

​
2. Move the master certificate to Thales HSM

1

Open Database Parameters

As a local user, right-click the Syteca Server tray icon and select Database Parameters.
2

Start the switch

On the Advanced tab, click Switch Master Certificate to SafeNet KeySecure.
3

Authenticate

Enter the credentials of a user with the administrative Tenant Management and System Configuration permission, then click Next.
4

Configure SafeNet KeySecure options

Fill in:
  • SafeNet properties file location — path to the .properties file.
  • PassPhraseSecure.exe location — only if credentials are encrypted in the properties file.
  • User name / Password — SafeNet KeySecure Management Console credentials.
  • Key name — leave empty to generate a new key (first-time setup), or enter an existing key name and select First node deployment.
Click Next.
5

Restart to complete

Click Yes to restart the Application Server and finish the integration.
After the move: the old master certificate’s storage location can no longer be used (a new key was generated for it, though the old copy can be deleted manually), and the Reissue Master Certificate button on the Advanced tab no longer works. If the Application Server is reinstalled, the certificate stays on the HSM and remains fully functional without further action.

​
3. Update the connection parameters

Whenever the .properties file changes, or the SafeNet KeySecure Management Console credentials change, update the connection:
1

Copy the existing key

On the Advanced tab of Database Parameters, copy the value in Key name.
2

Reopen the switch dialog

Click Switch Master Certificate to SafeNet KeySecure again.
3

Update the values, keeping the same key

Change whatever values need updating, paste the copied key back into Key name, and select First node deployment.
The key can’t be rotated (by leaving Key name empty) while updating connection options — that only works when intentionally rotating the key, described below.
4

Restart to apply

Click Next, then Yes to restart the Application Server.

​
4. Rotate the key

Click Switch Master Certificate to SafeNet KeySecure again, and either:
  • Leave Key name empty to generate a new key, or
  • Enter an existing key name and select First node deployment to reuse it.
Restart the Application Server to apply the change. Don’t modify any other values in the dialog while rotating.

​
Large deployments with multiple Application Server instances

The process is the same, but for each additional node: copy the key from the first node’s Key name field, paste it into the additional node’s SafeNet KeySecure Options dialog, and select Subsequent node deployment instead of First node deployment. After configuring each additional node, close and reopen its Database Parameters tool and re-enter the database parameters if they don’t display automatically.
Any time Switch Master Certificate to SafeNet KeySecure is used again on any node — whether updating options or rotating the key — every additional node needs to be reconfigured the same way.
EkranMasterCertificate and EkranServer are literal system identifiers, preserved verbatim from source.

Master certificate

Standard master certificate management, without an HSM.

Database parameters

Where the Advanced tab and Database Parameters tool live.

High availability

Multi-node deployments this HSM setup extends to.