Product Documentation
ADC
14.1 - Current Release 13.1 13.0 12.1
View PDF

Configure a FIPS appliance for the first time

August 20, 2024
Contributed by: 
C C S

Notes

A certificate-key pair is required for HTTPS access to the configuration utility and for secure remote procedure calls. RPC nodes are internal system entities used for system-to-system communication of configuration and session information. One RPC node exists on each appliance. This node stores the password, which is checked against the one provided by the contacting appliance. To communicate with other Citrix ADC appliances, each appliance requires knowledge of the other appliances, including how to authenticate on the other appliance. RPC nodes maintain this information, which includes the IP addresses of the other Citrix ADC appliances and the passwords used to authenticate on each.

On a Citrix ADC MPX appliance virtual appliance, a certificate-key pair is automatically bound to the internal services. On a FIPS appliance, a certificate-key pair must be imported into the hardware security module (HSM) of a FIPS card. To do so, you must configure the FIPS card, create a certificate-key pair, and bind it to the internal services.

Configure secure HTTPS by using the CLI

To configure secure HTTPS by using the CLI, follow these steps

  1. Initialize the hardware security module (HSM) on the FIPS card of the appliance. For information about initializing the HSM, see Configure the HSM.

  2. If the appliance is part of a high availability setup, enable the SIM. For information about enabling the SIM on the primary and secondary appliances, see “Configure FIPS appliances in a high availability setup.

  3. Import the FIPS key into the HSM of the FIPS card of the appliance. At the command prompt, type:

    import ssl fipskey serverkey -key ns-server.key -inform PEM

  4. Add a certificate-key pair. At the command prompt, type:

    add certkey server -cert ns-server.cert -fipskey serverkey

  5. Bind the certificate-key created in the previous step to the following internal services. At the command prompt, type:

    bind ssl service nshttps-127.0.0.1-443 -certkeyname server

    bind ssl service nshttps-::11-443 -certkeyname server

Configure secure HTTPS by using the GUI

To configure secure HTTPS by using the GUI, follow these steps:

  1. Initialize the hardware security module (HSM) on the FIPS card of the appliance. For information about initializing the HSM, see Configure the HSM.

  2. If the appliance is part of a high availability setup, enable the secure information system (SIM). For information about enabling the SIM on the primary and secondary appliances, see Configure FIPS appliances in a high availability setup.
  3. Import the FIPS key into the HSM of the FIPS card of the appliance. For more information about importing a FIPS key, see the Import an existing FIPS key section.
  4. Navigate to Traffic Management > SSL > Certificates.
  5. In the details pane, click Install.
  6. In the Install Certificate dialog box, type the certificate details.
  7. Click Create, and then click Close.
  8. Navigate to Traffic Management > Load Balancing > Services.
  9. In the details pane, on the Action tab, click Internal Services.
  10. Select nshttps-127.0.0.1-443 from the list, and then click Open.
  11. On the SSL Settings tab, in the Available pane, select the certificate created in step 7, click Add, and then click OK.
  12. Select nshttps-::11-443 from the list, and then click Open.
  13. On the SSL Settings tab, in the Available pane, select the certificate created in step 7, click Add, and then click OK.
  14. Click OK.

Configure secure RPC by using the CLI

To configure secure RPC by using the CLI, follow these steps:

  1. Initialize the hardware security module (HSM) on the FIPS card of the appliance. For information about initializing the HSM, see Configure the HSM.

  2. Enable the secure information system (SIM). For information about enabling the SIM on the primary and secondary appliances, see Configure FIPS appliances in a high availability setup.

  3. Import the FIPS key into the HSM of the FIPS card of the appliance. At the command prompt, type:

    import ssl fipskey serverkey -key ns-server.key -inform PEM

  4. Add a certificate-key pair. At the command prompt, type:

    add certkey server -cert ns-server.cert -fipskey serverkey

  5. Bind the certificate-key pair to the following internal services. At the command prompt, type:

    bind ssl service nsrpcs-127.0.0.1-3008 -certkeyname server

    bind ssl service nskrpcs-127.0.0.1-3009 -certkeyname server

    bind ssl service nsrpcs-::1l-3008 -certkeyname server

  6. Enable secure RPC mode. At the command prompt, type:

    set ns rpcnode <IP address> -secure YES

    For more information about changing an RPC node password, see Change an RPC node password.

Configure secure RPC by using the GUI

To configure secure RPC by using the GUI, follow these steps:

  1. Initialize the hardware security module (HSM) on the FIPS card of the appliance. For information about initializing the HSM, see Configure the HSM.
  2. Enable the secure information system (SIM). For information about enabling the SIM on the primary and secondary appliances, Configure FIPS appliances in a high availability setup.
  3. Import the FIPS key into the HSM of the FIPS card of the appliance. For more information about importing a FIPS key, the Import an existing FIPS key section.
  4. Navigate to Traffic Management > SSL > Certificates.
  5. In the details pane, click Install.
  6. In the Install Certificate dialog box, type the certificate details.
  7. Click Create, and then click Close.
  8. Navigate to Traffic Management > Load Balancing > Services.
  9. In the details pane, on the Action tab, click Internal Services.
  10. Select nsrpcs-127.0.0.1-3008 from the list, and then click Open.
  11. On the SSL Settings tab, in the Available pane, select the certificate created in step 7, click Add, and then click OK.
  12. Select nskrpcs-127.0.0.1-3009 from the list, and then click Open.
  13. On the SSL Settings tab, in the Available pane, select the certificate created in step 7, click Add, and then click OK.
  14. Select nsrpcs-::11-3008 from the list, and then click Open.
  15. On the SSL Settings tab, in the Available pane, select the certificate created in step 7, click Add, and then click OK.
  16. Click OK.
  17. Navigate to System > Network > RPC.
  18. In the details pane, select the IP address, and click Open.
  19. In the Configure RPC Node dialog box, select Secure.
  20. Click OK.
Configure a FIPS appliance for the first time
August 20, 2024
Contributed by: 
C C S
August 20, 2024
Contributed by: 
C C S

In this article

Site feedback | Your privacy choices footer linkYour Privacy Choices | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999- Cloud Software Group, Inc. All rights reserved.