Product Documentation
ADC
Current Release 13.1 13.0 12.1
View PDF

Configure a FIPS appliance for the first time

January 18, 2023
Contributed by:
S S C

Notes

A certificate-key pair is required for HTTPS access to the configuration utility and for secure remote procedure calls. RPC nodes are internal system entities used for system-to-system communication of configuration and session information. One RPC node exists on each appliance. This node stores the password, which is checked against the one provided by the contacting appliance. To communicate with other Citrix ADC appliances, each appliance requires knowledge of the other appliances, including how to authenticate on the other appliance. RPC nodes maintain this information, which includes the IP addresses of the other Citrix ADC appliances and the passwords used to authenticate on each.

On a Citrix ADC MPX appliance virtual appliance, a certificate-key pair is automatically bound to the internal services. On a FIPS appliance, a certificate-key pair must be imported into the hardware security module (HSM) of a FIPS card. To do so, you must configure the FIPS card, create a certificate-key pair, and bind it to the internal services.

Configure secure HTTPS by using the CLI

To configure secure HTTPS by using the CLI, follow these steps

  1. Initialize the hardware security module (HSM) on the FIPS card of the appliance. For information about initializing the HSM, seeConfigure the HSM.

  2. If the appliance is part of a high availability setup, enable the SIM. For information about enabling the SIM on the primary and secondary appliances, see “Configure FIPS appliances in a high availability setup.

  3. Import the FIPS key into the HSM of the FIPS card of the appliance. At the command prompt, type:

    import ssl fipskey serverkey -key ns-server.key -inform PEM

  4. Add a certificate-key pair. At the command prompt, type:

    add certkey server -cert ns-server.cert -fipskey serverkey

  5. Bind the certificate-key created in the previous step to the following internal services. At the command prompt, type:

    bind ssl service nshttps-127.0.0.1-443 -certkeyname server

    bind ssl service nshttps-::11-443 -certkeyname server

Configure secure HTTPS by using the GUI

To configure secure HTTPS by using the GUI, follow these steps:

  1. Initialize the hardware security module (HSM) on the FIPS card of the appliance. For information about initializing the HSM, seeConfigure the HSM.

  2. If the appliance is part of a high availability setup, enable the secure information system (SIM). For information about enabling the SIM on the primary and secondary appliances, seeConfigure FIPS appliances in a high availability setup.
  3. Import the FIPS key into the HSM of the FIPS card of the appliance. For more information about importing a FIPS key, see theImport an existing FIPS keysection.
  4. Navigate toTraffic Management > SSL > Certificates.
  5. In the details pane, clickInstall.
  6. In the Install Certificate dialog box, type the certificate details.
  7. ClickCreate, and then clickClose.
  8. Navigate toTraffic Management > Load Balancing > Services.
  9. In the details pane, on theActiontab, click内部服务.
  10. Selectnshttps-127.0.0.1-443from the list, and then clickOpen.
  11. On theSSL Settingstab, in theAvailablepane, select the certificate created in step 7, clickAdd, and then clickOK.
  12. Selectnshttps-::11-443from the list, and then clickOpen.
  13. On theSSL Settingstab, in theAvailablepane, select the certificate created in step 7, clickAdd, and then clickOK.
  14. ClickOK.

Configure secure RPC by using the CLI

To configure secure RPC by using the CLI, follow these steps:

  1. Initialize the hardware security module (HSM) on the FIPS card of the appliance. For information about initializing the HSM, seeConfigure the HSM.

  2. Enable the secure information system (SIM). For information about enabling the SIM on the primary and secondary appliances, seeConfigure FIPS appliances in a high availability setup.

  3. Import the FIPS key into the HSM of the FIPS card of the appliance. At the command prompt, type:

    import ssl fipskey serverkey -key ns-server.key -inform PEM

  4. Add a certificate-key pair. At the command prompt, type:

    add certkey server -cert ns-server.cert -fipskey serverkey

  5. Bind the certificate-key pair to the following internal services. At the command prompt, type:

    bind ssl service nsrpcs-127.0.0.1-3008 -certkeyname server

    bind ssl service nskrpcs-127.0.0.1-3009 -certkeyname server

    bind ssl service nsrpcs-::1l-3008 -certkeyname server

  6. Enable secure RPC mode. At the command prompt, type:

    set ns rpcnode -secure YES

    For more information about changing an RPC node password, seeChange an RPC node password.

Configure secure RPC by using the GUI

To configure secure RPC by using the GUI, follow these steps:

  1. Initialize the hardware security module (HSM) on the FIPS card of the appliance. For information about initializing the HSM, seeConfigure the HSM.
  2. Enable the secure information system (SIM). For information about enabling the SIM on the primary and secondary appliances,Configure FIPS appliances in a high availability setup.
  3. Import the FIPS key into the HSM of the FIPS card of the appliance. For more information about importing a FIPS key, theImport an existing FIPS keysection.
  4. Navigate toTraffic Management > SSL > Certificates.
  5. In the details pane, clickInstall.
  6. In theInstall Certificatedialog box, type the certificate details.
  7. ClickCreate, and then clickClose.
  8. Navigate toTraffic Management > Load Balancing > Services.
  9. In the details pane, on theActiontab, click内部服务.
  10. Selectnsrpcs-127.0.0.1-3008from the list, and then clickOpen.
  11. On theSSL Settingstab, in theAvailablepane, select the certificate created in step 7, clickAdd, and then clickOK.
  12. Selectnskrpcs-127.0.0.1-3009from the list, and then clickOpen.
  13. On theSSL Settingstab, in theAvailablepane, select the certificate created in step 7, clickAdd, and then clickOK.
  14. Selectnsrpcs-::11-3008from the list, and then clickOpen.
  15. On theSSL Settingstab, in theAvailablepane, select the certificate created in step 7, clickAdd, and then clickOK.
  16. ClickOK.
  17. Navigate toSystem > Network > RPC.
  18. In the details pane, select the IP address, and clickOpen.
  19. In theConfigure RPC Nodedialog box, selectSecure.
  20. ClickOK.
Configure a FIPS appliance for the first time
January 18, 2023
Contributed by:
S S C
January 18, 2023
Contributed by:
S S C

In this article

Site feedback | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999-Cloud Software Group, Inc. All rights reserved.