使用 PKI 代理的 Windows KSP 和 PKCS#11¶

This document explains the usage of PKI Proxy with HSM 2. PKI Proxy enables the usage of HSM 2 through the native Microsoft Windows APIs. For this purpose, PKI Proxy includes a KSP (Key Storage Provider) that enables its use via the CNG (Cryptography API: Next Generation) interface. Additionally it provides PKCS#11 access to the HSM 2, but this should only be used if your setup requires it for example if you need the additional authentication features of PKI Proxy, or if you need to access it from a remote machine running an application that only supports PKCS#11. In all other cases use the PKCS#11 driver from the OpenSC project directly.

The deployment of HSM 2 with PKI Proxy looks like this.

Connection between HSM 2 and PKI Proxy Server, Client and exposed client interfaces.

The HSM 2 is connected via its USB interface to the PKI Proxy server. PKI Proxy uses the OpenSC PKCS#11 driver to connect to the HSM 2 and access its keys and certificates. Clients to the PKI Proxy use the REST API of the PKI Proxy server to access the keys and certificates. Applications on the client can either use the native Windows API or a PKCS#11 driver. PKI Proxy server and client can be executed on the same computer.

这种设置的可能用例有

Code signing
Document signing

小技巧

更多信息，请参阅`PKI 代理官方文档<https://cdn.nsoftware.com/help/PK1/app/default.htm>`__。

先决条件¶

HSM 2
- Initialized
- Provisioned with keys and certificates
Windows machine
- OpenSC PKCS#11 driver installed (only required on the PKI Proxy Server).

PKI 代理 - 服务器¶

The PKI Proxy server shares the keys and certificates from a HSM 2 for different users.

安装¶

Download the PKI Proxy 2024 installer from the /n software website.
打开安装程序，按照安装向导进行操作。
从 "开始 "菜单打开 PKI 代理。如果将其安装到默认位置，也可以从*Run* 对话框或 PowerShell 中使用以下命令运行它。
```
C:\Program Files\PKI Proxy 2024\PKIProxy.exe
```
备注

即使主窗口已关闭，PKI 代理也会最小化到系统托盘。

Service Configuration¶

下面的说明用于配置 PKI 代理。

Open the PKI Proxy main window.
Change to the Settings tab.
Make sure the checkbox Enable TLS is checked and an appropriate certificate is used.
Change to the Users tab.
单击**New...** 按钮创建新用户。选择所有客户端都支持的验证类型。
在主窗口的菜单栏中单击**Start** 按钮启动 PKI 代理服务。

Publish Certificates from the HSM 2¶

In the following we configure which certificates from the HSM 2 are made available through PKI Proxy.

确保 PKI 代理主窗口已打开。
Change to the Certificates tab.
单击**New...** 按钮。这将打开**股票** 窗口。
单击窗口**Certificate** 框中的**Select Certificate or Key...** 按钮。这将打开**选择私钥** 窗口。
更改为**安全密钥** 选项卡。
Click the Browse... button and select the OpenSC PKCS#11 driver library file. The text field PKCS#11 Library now shows the path to the library file.
From the dropdown menu Security Key (PKCS#11) choose the slot which contains the certificate. The listed slots depend on your configuration of the HSM 2.
在文本框“PIN ”中，输入您的 HSM 2 的 PIN 码。
Click the Open button.
The text list below Certificates now shows a list of the available certificates and generic keys on the HSM 2. Select the certificate or generic key you want to share with PKI Proxy.
单击**OK** 按钮确认选择。这将使您返回**股票** 窗口。窗口现在将显示所选证书的详细信息。
单击窗口**访问和权限** 框中的**添加...** 按钮。这将打开**选择用户** 窗口。
从下拉菜单中选择一个现有用户，或选择**Create New User...** 创建一个新用户。单击**OK** 按钮确认选择。如果选择创建新用户，则随后将显示**New User** 窗口。
回到**共享证书** 窗口，确保只允许对证书或通用密钥进行所需的操作。这可以通过**访问和权限** 框架底部的复选框进行更改。
点击**OK** 按钮发布证书。这将使您返回 PKI 代理主窗口。
Certificate Management 下方的文本列表现在显示已发布的证书。

PKI 代理 - 客户端¶

PKI 代理客户端工具提供了从 PKI 代理服务器访问共享密钥和证书的不同方法。

小技巧

PKI 代理服务器包含客户端工具。因此，运行服务器的机器本身也可以是客户端。

安装¶

从`/n 软件网站<https://www.nsoftware.com/pkiproxy/download>`__ 下载*PKI Proxy 2024 - Client Tools* 。
打开安装程序，按照安装向导进行操作。

KSP (Key Storage Provider)¶

PKI 代理提供一个 KSP，用于连接 PKI 代理服务器。KSP 可通过 CNG（密码 API：下一代）接口与应用程序一起使用本地 Windows API。更多信息请参阅`PKI Proxy 文档<https://cdn.nsoftware.com/help/PK1/app/nsoftware.PKIProxy.htm#pg_runningksp>`__ 。

PKCS#11¶

PKI 代理提供一个 PKCS#11 模块，用于连接 PKI 代理服务器。更多信息请参阅`PKI Proxy 文档<https://cdn.nsoftware.com/help/PK1/app/nsoftware.PKIProxy.htm#pg_runningpkcs11>`__ 。