ADSS Server Evaluation Quick Guide

Transcription

1 ADSS Server Evaluatin Quick Guide This dcument aims t prvide a quick d this and it wrks guide t evaluating ADSS Enterprise Server as a PDF Signing Server bth fr server-side signing and als fr client-side signing. Fr thse peple wishing t create mre cmplex envirnments such as PDF verificatin, XML r File (PKCS#7) signing and verificatin services it will act as a gd base which allws further explratin f the many capabilities f the ADSS Server. Overview ADSS Server ffers cmprehensive services fr creating, verifying and validating digital signatures n PDF XML data and Files r Frms. It ffers varius ptins t integrate with business applicatins and wrkflws. This guide assumes that the ADSS Client SDK is used tgether with the sample cde t interact with ADSS via web-services. Key Features Business applicatins can be easily integrated using web-services directly r easier still using the ADSS Client SDK with high-level APIs. Very easy t install and cnfigure withut any special training requirements Strng, plicy-based cntrl ver all peratr and user interactins Sphisticated remte management wrkstatin with rle-based separatin f administratr respnsibilities. Prvides access t detailed user reprting inf t ease management burdens Offers multiple interfacing / interactin ptins t make it easy t deply and integrate with business applicatins. Offers multiple signature plicy ptins that enable applicatins t cntrl the digital signature prcess -r have partial r n cntrl as determined by ADSS plicies Able t sign dcuments using server-held crprate keys and certificates Using ne r mre keys in sftware Using ne r mre keys held with an HSM Able t sign dcuments using end-user keys and certificates When multi-user server-side signing is used, PDF Signer Server prvides key generatin and certificatin using either an in-built CA (rted internally r externally) r via links t external CAs, e.g. Windws Certificate Server. When Zer-ftprint client-side signing is used then either sftware, USB r smart card based credentials n the user s system can be accessed using ur G>Sign Desktp/Applet. Able t verify and trust-check signatures n dcuments and pass varius signer details t the applicatin Able t ffer histric verificatin f lder digital signatures Allws multiple trust issuers t be registered and used by the system fr enterprise, multi-third party, natinal r glbal envirnments Able t apply and verify timestamps Able t act as an On-line Certificate Status Prtcl (OCSP) respnder Able t create lng-term signatures t ETSI and PDF standards Offers a simple intuitive web-based administratin interface that ffers substantial peratinal management advantages cmpared with ther appraches. Signing, validatin, certificatin, OCSP and TSA services can all be cnfigured and managed frm a single cnsistent brwser-based remte management interface. Supprts multiple database technlgies including: Micrsft SQL Server 2016, 2014, 2012 (Express, Standard, Web r Enterprise Editin) Ascertia Limited Cmmercial-in-Cnfidence Page 1 f 6

2 ADSS Server Evaluatin Quick Guide Azure SQL Database (Database-as-a-service) Oracle 12c, 11gR2, 11g PstgreSQL v10.x, v9.x, v8.x MySQL 5.x (Percna and Oracle) Supprts the ptins f using varius HSMs fr secure key management as well as smartcard based credentials fr peratr authenticatin Further Infrmatin References This dcument is a quick guide t get a simple cnfiguratin f the OCSP Service installed, tested and peratinal. Mre detailed infrmatin is available in the fllwing dcuments: ADSS Server Installatin Guide detailed installatin guide ADSS Server Admin Manual details all the administrative features ADSS Server SQL Server Installatin Guide ADSS Server Admin Manual details all the administrative features. The manual is available nline at the fllwing lcatin: Ascertia has maintained an nline knwledgebase fr custmer ease. Yu can fllw these link fr mre details: The ADSS Client SDK dcuments shuld als be read: ADSS Develpers Guide detailed infrmatin n hw t interact with ADSS Server Additinally, the G>Sign client side signing demnstratins can be cnfigured and run nce the evaluatin installatin is cmplete. They are part f the ADSS Client SDK dcument set: ADSS G>Sign Develpers Guide ADSS G>Sign Desktp Installatin Guide Evaluatin System Requirements Please see the ADSS Server Installatin Guide fr supprted perating systems, databases and ther related infrmatin. Yu can als fllw this nline link: Quick Installatin Steps ADSS Server can be quickly installed fr evaluatin purpses using the fllwing steps: Install MS SQL Server and create a new, empty database Install ADSS Server Optinally chsing t use the sample evaluatin data (*1) (*1) The installer includes sample evaluatin data which can be used t ppulate the ADSS Server database with the necessary cryptgraphic and prfile data t start perfrming example signature, verificatin and certificatin transactins (explained later in this guide). This is a recmmended ptin t help with the evaluatin f ADSS Server. D nt select r use this ptin when yu are installing ADSS Server in a prductin envirnment. The evaluatin uses the ADSS Server s sftware crypt libraries, hwever multiple hardware security mdules (HSMs) can be used if required. Fr further infrmatin refer t the ADSS Server Admin Manual Key Manager. It is recmmended that yu cntact Ascertia fr further cnfiguratin infrmatin when evaluating with an HSM. Install MS SQL Server and create an ADSS evaluatin database Read the separate guide fr installing and cnfiguring MS SQL Server. The key pints t nte are: Ensure that mixed mde authenticatin is selected during the installatin. Using Micrsft Windws Authenticatin will lead t installatin issues. Ascertia Limited Cmmercial-in-Cnfidence Page 2 f 6

3 ADSS Server Evaluatin Quick Guide Ensure that TCP prts are set t 1433 (fr IP1, IP2 and IP All) Cnfigure a database wner with administratr permissins Ensure the language is set t English Install ADSS Server Extract the ADSS Server installatin zip file t a target flder, e.g. D:\ADSS-Server Nte: The flder path cannt have spaces s yu cannt use ADSS Server r similar Frm <ADSS Installatin Directry>/setup run install.bat which starts a cnfiguratin Wizard Nte: Setup cannt be run and cmpleted mre than nce - If the evaluatin needs t be reinstalled then the ADSS Server installatin directry needs t be deleted and the zip reextracted The ADSS Server Installatin Wizard shws a welcme screen then the license agreement and then asks if yu wish t upgrade an existing installatin r if yu are installing fr the first time. Fr new users yu are installing fr the first time s select this ptin. If yu are adding a secnd server yu are als installing fr the first time. Cnfirm the installatin path and click Next > Select the license type i.e. ne f the evaluatin license ptins ffered, r prvide the path fr the cmmercial license if yu already have gt ne. Uncheck the ptin t use the sample data and cnfiguratins these are nt that useful fr OCSP services. Select SQL Server and Typical Cnfiguratins and click Next > Enter the cnnectin details fr the ADSS evaluatin database and click Next> Setup nw attempts t cnnect t the database. If this fails, check the cnnectin details are crrect, if they are then the prblem is ften fund t be either: That the IP cnfiguratins are nt enabled (use SQL Server Cnfiguratin Manager) That SQL Server was nt installed with mixed mde authenticatin (it will need t be reinstalled) Select Typical installatin and click Install After the prgress bar cmpletes leave the default Service Settings selected and click Finish The Windws installatin wizard will appear s that the ADSS Server admin key and certificate can be installed in the brwser. The certificate allws an administratr t securely lgin t the ADSS Admin Cnsle ver an SSL/TLS sessin with client and server authenticatin. Fllw the wizard instructins and install the certificate in the Windws Persnal stre. The passwrd f the Default Admin certificate is: passwrd. This is an initial certificate and it shuld be replaced nce ADSS Server is running. After this an HTML page pens in the default web brwser prviding a link t the ADSS Admin Cnsle. Click n this link if using Internet Explrer. If using Firefx then yu must brwse t t lg int the ADSS Admin Cnsle Firefx als wishes t see the keys and certificates in its lcal trust stre. The brwser will indicate that the server certificate is nt trusted this is because a temprary certificate is used by ADSS Server at this time that can be changed later and trusted fr prductin use. Select cntinue If yu are presented with a list f client certificates - select the ne called ADSS Default Admin At this pint ADSS Server has been successfully installed and the ADSS Admin Cnsle can nw be used t cnfigure the ADSS Server. The system is nw ready fr evaluatin use and is able t run sample transactins. In additin t the dcuments specified abve, yu shuld read the readme.html dcuments in the ADSS Client SDK flders fr details n hw t run the samples and the client-side signing zer-ftprint G>Sign applet based demnstratins. Ascertia Limited Cmmercial-in-Cnfidence Page 3 f 6

4 ADSS Server Evaluatin Quick Guide ADSS Server Cncept The way we divide ADSS Server int separate services has advantages when it cmes t secure management. Reading thrugh this shrt descriptin will clarify what elements need t be cnfigured and why: 1. Business applicatins make signing r verificatin requests t ADSS Server. (Aut File Prcessr is an Ascertia supplied applicatin and it can be deplyed t create watched flder prcessing fr multiple files such as PDFs, XML data and ther file types. See the separate AFP guide fr further infrmatin). 2. ADSS Server authenticates the applicatin request message based n an embedded OriginatrID, with ptinal SSL and ptinal signature. 3. The request is checked fr authrisatin by lking at the ADSS Client Manager Interface which lists all knwn clients, which services they can access, which service prfiles and ptinally which certificates can be requested. 4. The prfiles within the services define the detail f the signing, verificatin r certificatin request, fr signing PDFs these define detailed attributes. 5. The Key Manager is used t cntrl all the keys used fr signing and ther tasks 6. The Trust Manager is used t cntrl the Trust Authrities including lcally issued certs Glbal settings are used t define the certificate templates fr certificate requests, a cnnectin t an external TSA, system integrity and ther settings. The evaluatin database explained The sample script ppulates the ADSS Server database with the fllwing example data: Keys and Certificates these are keys and certificates that are nrmally generated by the ADSS Admin Cnsle under the Key Manager tab. They are selected fr use by a client applicatin during a signing, verificatin, certificatin, XKMS, OCSP, TSA, and SCVP transactins with ADSS. See the ADSS Admin Manual, Key Manager sectin, fr further details. Trusted CA this is a trust anchr certificatin authrity that is nrmally cnfigured by ADSS Admin Cnsle under the Trust Manager tab and additinally under the Verificatin Service/Registered CA menu. It is used as a trust pint (Trust Anchr) when a digital signature is being verified. See the ADSS Admin Manual Trust Manager and Verificatin Service Step 2 sectins fr further details. Client s Originatr ID this the ID that the client applicatin uses t verify t the ADSS Server that it is authrised t cmmunicate with ADSS, and which services are available t that applicatin. It is nrmally cnfigured under the ADSS Admin Cnsle, Client Manager tab and additinally under the Verificatin Service/Client Manager Menu. See the ADSS Admin Manual Client Manager and Verificatin Service Step 4 fr further details. Signing Prfiles these prfiles determine fr a particular ADSS signing transactin what type f dcument is t be signed, where the signature is t be placed n the page, the lk f the signature and ther signature infrmatin. It is nrmally cnfigured by the Signing Service/Signing Prfiles menu. See the ADSS Admin Manual Signing Service sectin fr further details. Signature Appearance Prfiles these prfiles determine hw exactly the signature appearance fields are shwn in the visible signature n signed PDF files. Operatr can als specify whether t shw r hide specific signature appearance fields. Certificatin Prfiles these prfiles determine fr a particular ADSS certificatin transactin, which CA is t be used (lcal r external) and the characteristics f the key that is t be generated fr certificatin. It is nrmally cnfigured by the Certificatin Service/Certificatin Prfile menu. See the ADSS Admin Manual Certificatin Service sectin fr further details. Verificatin Prfiles these prfiles determine fr a particular ADSS verificatin transactin, which type f signatures can be verified. It is nrmally cnfigured by the Verificatin Service/Verificatin Prfile menu. See the ADSS Admin Manual Verificatin Service sectin fr further details. TSA Prfiles these prfiles determine fr particular timestamp request, which TSA certificate shuld be used t generate the timestamp tken and sme ther settings fr the timestamp transactins. It is nrmally cnfigured by the TSA Service/Registered TSA Prfile menu. See the ADSS Admin Manual TSA Service sectin fr further details. XKMS Prfiles these prfiles determine fr a particular XKMS certificate validatin request, which Trust Anchrs t use, which path discvery and path validatin mechanisms t be used fr the service Ascertia Limited Cmmercial-in-Cnfidence Page 4 f 6

5 ADSS Server Evaluatin Quick Guide requests. It is nrmally cnfigured by the XKMS Service/XKMS Prfile menu. See the ADSS Admin Manual XKMS Service sectin fr further details. SCVP Plicies these plicies determine which Trust Anchrs and path discvery and path validatin mechanisms shuld be used fr SCVP service requests. It is nrmally cnfigured by the SCVP Service/Validatin Plicies menu. See the ADSS Admin Manual SCVP Service sectin fr further details. LTANS Prfiles these prfiles determine fr particular data archive requests, hw the archived data shuld be prduced, hw the archived infrmatin shuld be stred, renewed and restred. It is nrmally cnfigured by the LTANS Service/LTANS Prfile menu. See the ADSS Admin Manual LTANS Service sectin fr further details. Trubleshting the ADSS Server If prblems arise when installing r running ADSS Server then please check the fllwing: Failed t cnnect t the database when installing ADSS Server if ADSS Server setup wizard is unable t cnnect t the database then check that: The database cnnectin details are crrect The database server is up and running The database user has sufficient access privileges Failed t install ADSS Server using a new database if yu are unable t install ADSS Server when using a new database then check that: The database fr ADSS Server has already been created The same database has nt been used fr an earlier installatin f ADSS Server The database user has sufficient access privileges n the selected database Unable t access the ADSS Server cnsle if ADSS Server cnsle is nt accessible after installatin then check that: The default client authenticatin certificate i.e. ADSS Default Admin is installed in Internet Explrer persnal key stre f the Windws desktp being used The apprpriate default client authenticatin certificate i.e. ADSS Default Admin is being selected when accessing ADSS Server cnsle The ADSS Server Windws service is started and is running The database service is started and is running. Re-start ADSS Server Windws service if database server ges dwn while ADSS Server was running (especially if testing n XP). Unable t run sample prgrams in the Client SDK If yu are unable t run the sample prgrams within the Client SDK then check that: The lading f the database samples was requested during ADSS Server installatin Lgin t ADSS cnsle and cnfirm that the sample prfiles and data have been successfully ppulated within the ADSS Server. The ADSS Server Windws service has been restarted and is running Ascertia Limited Cmmercial-in-Cnfidence Page 5 f 6

6 ADSS Server Evaluatin Quick Guide Prduct Ntes 1. The evaluatin versin f ADSS Server nly allws up t 100 signing peratins, 100 verificatin transactins. The number f keys that can be generated and certified is limited t 20. The number f Trust Authrities and clients that can be registered is als restricted. 2. Ascertia can prvide free phne based assistance, paid nsite assistance, training and additinal services fr the ADSS Server. 3. There are a number f ways f using ADSS Server t suit a variety f business needs fr enhanced sign-ff, apprval, traceability and accuntability speak t Ascertia r yur lcal partner fr further relevant infrmatin n hw ADSS Server can meet yur needs. Cntact Details Fr Cmmercial Sales: +44 (0) , sales@ascertia.cm Fr Technical Supprt: supprt@ascertia.cm Ascertia Limited Cmmercial-in-Cnfidence Page 6 f 6