Limitations
For any changes to the HSM-related configuration in an existing setup, such as adding or removing an HSM, or creating a high availability setup, copy ‘/etc/Chrystoki.conf’ to ‘/var/safenet/config’.
After adding, removing, or restarting an HSM, you must restart the ‘/var/safenet/gateway/safenet_gw’ binary. If you don’t restart the gateway binary, the HSM will not serve any traffic after it is added back or after it restarts.
To reboot or stop the current ‘/var/safenet/gateway/safenet_gw’ binary, use
kill –SIGTERM
kill –SIGINT Important! Do not use
kill –9
orkill -6
Before removing an existing HSM from the ADC, remove, from the ADC, all the keys and certificate-key pairs that are associated with that HSM. You can’t delete these files from the ADC after you remove the HSM.
On a standalone Citrix ADC appliance, Thales Luna HSMs in HA are supported for Luna version 6.2 and later.
EXPORT ciphers are not supported.
Update certificate-key pair operation is not supported.
When you generate an HSM key on a third-party tool, the private and public key names must be the same. When you add the HSM key on the appliance, provide this name as the key name.
The
#
character is not supported in a key name and partition password.Cluster and admin partitions are not supported.