Use SCP to copy the Linux 64-bit SafeNet client files over to a temporary directory on the
API Gateway
.
While logged in as the
root
user, navigate to the directory on the
API Gateway
 containing the client files and then run the install script:
# ./install.sh
Enter
y
to agree to the license.
Enter
y
to install the Luna SA client.
Enter
y
to install the JSP for Luna.
Enter
n
to not install the SDK for Luna.

Navigate to the Luna SA command directory:
# cd /usr/lunasa/bin
Copy the Luna appliance server certificate to the client:
# ./ctp admin@<LunaBoxHostname>:server.pem . (for Luna 4)
# ./scp admin@<LunaBoxHostname>:server.pem . (for Luna 5)
Register the server with the client:
# ./vtl addServer -n <LunaBoxHostname> -c server.pem
Generate a client certificate:
# ./vtl createCert -n <ClientHostname>
Copy the client certificate to the server:
# ./ctp /usr/lunasa/cert/client/<ClientHostname>.pem admin@<LunaBoxHostname>: (for Luna 4)
# ./scp /usr/lunasa/cert/client/<ClientHostname>.pem admin@<LunaBoxHostname>: (for Luna 5)
Log in to the Luna HSM appliance to register the client with the server, then assign the client to a server partition:
# ssh admin@lunaboxhostname
   lunash:> client register -client <ClientHostname> -hostname
<ClientHostname>
   lunash:> client assignPartition -client <ClientHostname> 
-partition <GatewayPartition>
Run the following command only if the hostname is not resolvable:
lunash:> client hostip map <ClientHostname> <ClientIP>
 (for Luna 4)
lunash:> client hostip map -client <ClientHostname> -ip <ClientIP>
(for Luna 5)
Log out from the Luna HSM:
lunash:> exit
Set the read permissions for the certificate files in the following directories:
# chmod a+r /usr/lunasa/cert/server/*.pem
# chmod a+r /usr/lunasa/cert/client/*.pem
Verify that the client is connected to its assigned partition:
# ./vtl verify
When the verification is successful, the Luna slots partitions will be displayed.If the verification is unsuccessful, edit the file
Chrystoki.conf
within the /etc directory and then try again. The setting should be disabled, as shown:
Misc = {
    PE1746Enabled = 0;
}
Run the following command to verify that your token client PIN is correct for this partition and that the partition is empty:
# ./cmu list
Enter the partition password and follow the instructions on the Luna PED pad. If the verification is successful, you will see a display similar to the following back on the command line:

nExitCode returned was =0
Please enter password for token in slot 1 : *******************
handle=9??????? label=root.ame2.l7tech.com
handle=11?????? label=root.ame2.l7tech.com--cert0
handle=30?????? label=SSL--cert0
handle=32?????? label=SSL
handle=48?????? label=hmm--cert0
handle=49?????? label=hmm
handle=55?????? label=ame2.l7tech.com--cert0
handle=56?????? label=ame2.l7tech.com
handle=121????? label=peanuts--cert0
handle=128????? label=ssl_x4150upgrade
handle=130????? label=ssl_x4150upgrade--cert0
handle=133????? label=peanuts
handle=175????? label=ca
handle=180????? label=caec
handle=183????? label=caec--cert0
handle=189????? label=ca--cert0
handle=266????? label=test--cert0
handle=269????? label=test
handle=296????? label=testca
handle=298????? label=testca--cert0
handle=308????? label=peanuts2
handle=310????? label=peanuts2--cert0
handle=419????? label=NEWSSL--cert1
handle=432????? label=NEWSSL--cert0
handle=495????? label=peanuts2_ca
handle=503????? label=peanuts2_ca--cert0

Navigate to the following directory on the Gateway:

# cd /usr/lunasa/jsp/lib

Copy the Luna .JAR files over to the Gateway:

# cp libLunaAPI.so Luna*.jar /opt/SecureSpan/JDK/jre/lib/ext

Change the file permissions of the Luna files to make them readable by the Gateway:

# chmod a+r /opt/SecureSpan/JDK/jre/lib/ext/*Luna*

Open the following file in a text editor:

/opt/SecureSpan/JDK/jre/lib/security/java.security 

Add the following line to the file and then save and close the file:

com.safenetinc.luna.provider.createExtractableKeys=true

If your Luna machine has FIPS mode enabled, insert the following line to the java.security file as an addition:

security.provider.10=com.safenetinc.luna.provider.LunaProvider

Set the file permissions for the Luna client as follows:

# chmod -R 655 /usr/safenet

Restart the C

API Gateway

:

service ssg restart

If you will be accessing the
API Gateway
 using the Policy Manager (either browser or desktop client) over the default ports 8443/9443, follow both
"To reset the default list"
and
"To enable SafeNet Luna"
below.
If you will be accessing the
API Gateway
 only using the browser client over a custom port, follow
"To enable SafeNet Luna"
only.

Start the Policy Manager
desktop
client and connect to the
API Gateway
. Alternatively, you may use the browser client over port 8443.
Run the
Manage Listen Ports
task. The Manage Listen Ports dialog is displayed.
Select port
9443
and then click [
Properties
]. The Listen Port Properties are displayed.
Select the [
SSL/TLS Settings
] tab.
Click [
Use Default List
] and then click [
OK
] to close the dialog box.

Run the
Manage Private Keys
task. The Manage Private Keys dialog is displayed.
Click [
Manage Keystores
] to display the Manage Keystore dialog.
Click [
Enable SafeNet HSM
]. The "Current keystore type" should now display "SafeNet Luna HSM".
Enter the
API Gateway
 partition password when prompted.
Restart the
API Gateway
.

Under the Manage Private Keys task, check that the default SSL key shows location "HSM Luna".
When creating a new private key, the location should be "HSM Luna".
You should be unable to export a private key.