> ## Documentation Index
> Fetch the complete documentation index at: https://syteca.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Move the Master Certificate to Thales HSM

> Store the Syteca master certificate on a Thales HSM external storage device using SafeNet KeySecure and SafeNet ProtectApp for extra security.

<Warning>
  **NOT AVAILABLE IN SAAS.**
</Warning>

Moving the Syteca master certificate to a Thales HSM (hardware security module) adds an extra layer of protection, using Thales SafeNet KeySecure together with SafeNet ProtectApp.

## Prerequisites

* **SafeNet KeySecure** — install the keystore application on any machine, and set up a user account in its Management Console. See SafeNet's own documentation for details.
* **SafeNet ProtectApp for .NET SDK** — install on every machine running Syteca Application Server. In a multi-node High Availability cluster, install and configure it on each node individually.

## 1. Integrate the Application Server with Thales HSM

<Steps>
  <Step title="Open the SafeNet properties file">
    Locate `ProtectAppForDotNet.properties` in the SafeNet ProtectApp for .NET SDK installation.
  </Step>

  <Step title="Set the KeySecure server address">
    Find the `NAE_IP=` line and add the IP address of the machine running SafeNet KeySecure.
  </Step>

  <Step title="Enable SSL if required">
    Change `Protocol=tcp` to `Protocol=ssl` if certificate SSL authentication is required.
  </Step>

  <Step title="Enable credential encryption if required">
    Change `Credentials_Encrypted=no` to `Credentials_Encrypted=yes` if credentials should be encrypted.

    <Note>
      Other options (for example, load balancing) can also be configured here — see SafeNet ProtectApp for .NET's own documentation.
    </Note>
  </Step>

  <Step title="Restart the Application Server">
    Right-click the **Syteca Server** tray icon and stop, then start, the **EkranServer** service.
  </Step>
</Steps>

## 2. Move the master certificate to Thales HSM

<Steps>
  <Step title="Open Database Parameters">
    As a local user, right-click the **Syteca Server** tray icon and select **Database Parameters**.
  </Step>

  <Step title="Start the switch">
    On the **Advanced** tab, click **Switch Master Certificate to SafeNet KeySecure**.
  </Step>

  <Step title="Authenticate">
    Enter the credentials of a user with the [administrative Tenant Management and System Configuration permission](/docs/administration/users/administrative-permissions), then click **Next**.
  </Step>

  <Step title="Configure SafeNet KeySecure options">
    Fill in:

    * **SafeNet properties file location** — path to the `.properties` file.
    * **PassPhraseSecure.exe location** — only if credentials are encrypted in the properties file.
    * **User name** / **Password** — SafeNet KeySecure Management Console credentials.
    * **Key name** — leave empty to generate a new key (first-time setup), or enter an existing key name and select **First node deployment**.

    Click **Next**.
  </Step>

  <Step title="Restart to complete">
    Click **Yes** to restart the Application Server and finish the integration.
  </Step>
</Steps>

<Warning>
  After the move: the old master certificate's storage location can no longer be used (a new key was generated for it, though the old copy can be deleted manually), and the **Reissue Master Certificate** button on the Advanced tab no longer works. If the Application Server is reinstalled, the certificate stays on the HSM and remains fully functional without further action.
</Warning>

## 3. Update the connection parameters

Whenever the `.properties` file changes, or the SafeNet KeySecure Management Console credentials change, update the connection:

<Steps>
  <Step title="Copy the existing key">
    On the **Advanced** tab of Database Parameters, copy the value in **Key name**.
  </Step>

  <Step title="Reopen the switch dialog">
    Click **Switch Master Certificate to SafeNet KeySecure** again.
  </Step>

  <Step title="Update the values, keeping the same key">
    Change whatever values need updating, paste the copied key back into **Key name**, and select **First node deployment**.

    <Warning>
      The key can't be rotated (by leaving **Key name** empty) while updating connection options — that only works when intentionally rotating the key, described below.
    </Warning>
  </Step>

  <Step title="Restart to apply">
    Click **Next**, then **Yes** to restart the Application Server.
  </Step>
</Steps>

## 4. Rotate the key

Click **Switch Master Certificate to SafeNet KeySecure** again, and either:

* Leave **Key name** empty to generate a new key, or
* Enter an existing key name and select **First node deployment** to reuse it.

Restart the Application Server to apply the change. Don't modify any other values in the dialog while rotating.

## Large deployments with multiple Application Server instances

The process is the same, but for each additional node: copy the key from the first node's **Key name** field, paste it into the additional node's **SafeNet KeySecure Options** dialog, and select **Subsequent node deployment** instead of **First node deployment**. After configuring each additional node, close and reopen its Database Parameters tool and re-enter the database parameters if they don't display automatically.

<Note>
  Any time **Switch Master Certificate to SafeNet KeySecure** is used again on any node — whether updating options or rotating the key — every additional node needs to be reconfigured the same way.
</Note>

<Warning>
  `EkranMasterCertificate` and `EkranServer` are literal system identifiers, preserved verbatim from source.
</Warning>

## Related

<CardGroup cols={2}>
  <Card title="Master certificate" icon="key" href="/docs/administration/security/master-certificate">
    Standard master certificate management, without an HSM.
  </Card>

  <Card title="Database parameters" icon="database" href="/docs/administration/database/database-parameters">
    Where the Advanced tab and Database Parameters tool live.
  </Card>

  <Card title="High availability" icon="server" href="/docs/administration/deployment/high-availability">
    Multi-node deployments this HSM setup extends to.
  </Card>
</CardGroup>