--- title: "Installing the Crypto and Secrets plugins" slug: "dpo-api-server-plugins-for-crypto-and-secrets-installation" updated: 2026-10-27T20:13:12Z published: 2026-10-27T20:13:12Z canonical: "docs.onespan.com/dpo-api-server-plugins-for-crypto-and-secrets-installation" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.onespan.com/llms.txt > Use this file to discover all available pages before exploring further. # Installing the Crypto and Secrets plugins The following instructions are for customers who deploy DigipassONE authentication software on Linux. They do not apply to customers who use the DigipassONE Cloud Deployment Toolkit. If you are deploying DigipassONE authentication software using the DigipassONE Cloud Deployment Toolkit, please [contact OneSpan Customer Support](mailto:support@onespan.com) before continuing. When you install the Crypto or the Secrets Plugin on a production Server, the steps to follow depend on whether you are implementing both. If you are implementing the Crypto Plugin only, then follow the steps in [Installing Crypto Plugin Only](/dpoa/docs/s3suite94-installing-the-crypto-and-secrets-plugins-1#installing-crypto-plugin-only). If you are implementing the Secrets Plugin only, then follow the steps in [Installing Secrets Plugin Only](/dpoa/docs/s3suite94-installing-the-crypto-and-secrets-plugins-1#installing-secrets-plugin-only). If you implemented both plugins, install them using the following instructions. ## Installing both Crypto and Secrets plugin Before installing the DigipassONE Server, set up your external secrets manager with your operational database password along with its handle. You can choose to load any remaining passwords and their handles into your external secrets manager after installation. Begin by completing Steps 1, 2 and 3 of [Install the DigipassONE Servers on Linux](/dpoa/docs/s3suite94-using-linux-1). If you plan to store any passwords in encrypted form in the DigipassONE database, then also complete [Step 4](/dpoa/docs/s3suite94-step-4-encrypt-credentials-used-by-the-server-1) of *Install the* *DigipassONE* *Servers on Linux.* Next, uncomment and update the properties below in [nnl-install.properties](/dpoa/docs/s3suite94-sample-nnl-installproperties-file-1). | **Property** | **Expected Value** | | --- | --- | | NNL_CRYPTO_PLUGIN_CLASS_NAME | The name of your class that implements the interface CryptoPlugin. | | NNL_SECRETS_PLUGIN_CLASS_NAME | The name of your class that implements the interface SecretsPlugin. | | NNL_EXT_DIR_PATHS | The directory paths to your Crypto plugin, Secrets plugin, and other required JAR files. | What you do next depends on if you plan to use a handle to retrieve the password or store the encrypted password in the database. **Use a handle to the external secrets manager** If you will not be storing any encrypted passwords in the database, i.e. you will always use a handle to the external secrets manager, then make the following changes to the [nnl-install.properties](/dpoa/docs/s3suite94-sample-nnl-installproperties-file-1) file: - Comment out DB_ENCRYPTED_USER_PASSWD_ENV - Uncomment and configure DB_SECRET_HANDLE_ENV=**{handle}** Note that "**{handle}**" is prefixed literally. **Store the encrypted password in the database** In certain circumstances you will install the Secrets plugin and continue to store an encrypted password in the database. In this case, make the following changes to the [nnl-install.properties](/dpoa/docs/s3suite94-sample-nnl-installproperties-file-1) file: - Uncomment and configure DB_ENCRYPTED_USER_PASSWD_ENV - Comment out DB_SECRET_HANDLE_ENV In either case: After you have completed the configuration of the Secrets plugin, go to [Step 6. Install the Server and its Components](/dpoa/docs/s3suite94-step-6-install-the-server-and-its-components-1) to run the installation script and then return here. If you completed installation successfully, you see the following: - Inside the tomcat/bin/setenv.sh file: ```plaintext CATALINA_OPTS="${CATALINA_OPTS}-Dnnl.crypto.plugin.class.name=" ``` - JARs from the paths specified in NNL_EXT_DIR_PATHS are copied into the web applications' lib directories. For example: tomcat/webapps/nnl/WEB-INF/lib/ - Use the following nnl-mgmt.sh command to list the SYSTEM tenant's properties so you can verify the values. For details, see [Properties Commands](/dpoa/docs/s3suite94-properties-commands-1). ```plaintext ./nnl-mgmt.sh properties list -tenantid system ``` Verify the values for the properties listed below: ```plaintext nnl.default.external.encryption.key.jce.provider.name=NokNokCryptoProvider nnl.jce.providers=com.noknok.crypto.provider.NokNokCryptoProvider,org.bouncycastle.jce.provider.BouncyCastleProvider ``` - Inside the tomcat/bin/setenv.sh file : ```plaintext CATALINA_OPTS="${CATALINA_OPTS}-Dnnl.secrets.plugin.class.name=" ``` - The JARs from the paths specified in NNL_EXT_DIR_PATHS are copied into the correct server and web applications' lib directories. For example, for the Authentication Server, these libraries are in tomcat/webapps/nnl/WEB-INF/lib/. - The handle for the Operational database password in the external secrets manager is updated in the following files: - /bin/setenv.sh - /admin/conf/nnl-db.properties - /admin/conf/application.properties Verify the installation by running the /install/nnl-postinstall-checks.sh script. Examine the output to uncover any configuration issues. After you verify the installation, perform the [Post Installation](/dpoa/docs/s3suite94-post-installation-1) tasks. For the Crypto plugin, configure an alias for the encryption key for default and Admin tenants. If required, also configure an alias for the encryption key for other tenants. You can enter the aliases using the Admin Console or using the command line interface. See [*Rotate Encryption Keys*](/dpoa/docs/s3suite94-rotate-encryption-keys-1). ## Installing Crypto plugin only Use the instructions below to install and configure just a Crypto plugin in the DigipassONE Server. Do not use these instructions if you are planning on installing both the Crypto and the Secrets plugin. Begin by completing Steps 1, 2, 3 and 4 of [Install on Linux](/dpoa/docs/s3suite94-using-linux). Next, update the Crypto plugin properties in [nnl-install.properties](/dpoa/docs/s3suite94-sample-nnl-installproperties-file-1) - NNL_CRYPTO_PLUGIN_CLASS_NAME = - NNL_EXT_DIR_PATHS = You are now ready to install, go to [Step 6. Install the Server and its Components](/dpoa/docs/s3suite94-step-6-install-the-server-and-its-components-1) to run the installation script and then return here. If you completed installation successfully, you see the following - Inside the tomcat/bin/setenv.sh file : ```plaintext CATALINA_OPTS="${CATALINA_OPTS} -Dnnl.crypto.plugin.class.name=" ``` - Jars from the paths specified in NNL_EXT_DIR_PATHS are copied into the web applications' lib directories. For example: tomcat/webapps/nnl/WEB-INF/lib/ - The following properties are configured for the SYSTEM tenant: - nnl.default.external.encryption.key.jce.provider.name=NokNokCryptoProvider - nnl.jce.providers=com.noknok.crypto.provider.NokNokCryptoProvider,org.bouncycastle.jce.provider.BouncyCastleProvider Verify the installation by running the /install/nnl-postinstall-checks.sh script. Examine the output to uncover any configuration issues. After you verify the installation, perform the Post Installation tasks. Configure an alias for the encryption key for default and Admin tenants. If required, also configure an alias for the encryption key for other tenants. You can enter the aliases using the Admin Console or using the command line interface. If you are using the command line interface, enter the following commands and respond to the resulting prompts by entering your alias: ```plaintext ./nnl-mgmt.sh key add -tenantid default -autogenerate no ./nnl-mgmt.sh key add -tenantid Admin -autogenerate no ``` ## Installing Secrets plugin only Before installing the DigipassONE Server, set up your external secrets manager with your operational database password along with its handle. You can choose to load any remaining passwords and their handles into your external secrets manager after installation. Use these instructions to install and configure the Secrets plugin alone. Do not use these instructions if you are going to deploy both the Secrets plugin and the Crypto plugin. Begin by completing Steps 1, 2 and 3 of [Install using Linux](/dpoa/docs/s3suite94-step-1-download-and-untar-the-server-installation-package-1). If you plan to store any passwords in encrypted form in the DigipassONE database, then also complete [Step 4](/dpoa/docs/s3suite94-step-4-encrypt-credentials-used-by-the-server-1) of *Installing the* *DigipassONE Server**s.* Next, uncomment and update the Secrets plugin properties in [nnl-install.properties](/dpoa/docs/s3suite94-sample-nnl-installproperties-file-1). - NNL_SECRETS_PLUGIN_CLASS_NAME= - NNL_EXT_DIR_PATHS= What you do next depends on if you plan to use a handle to retrieve the password or store the encrypted password in the database. **Use a handle to the external secrets manager** If you will not be storing any encrypted passwords in the database, i.e. you will always use a handle to the external secrets manager, then make the following changes to the [nnl-install.properties](/dpoa/docs/s3suite94-sample-nnl-installproperties-file-1) file: - Comment out DB_ENCRYPTED_USER_PASSWD_ENV - Uncomment and configure DB_SECRET_HANDLE_ENV=**{handle}** Note that "{handle}" is prefixed literally. **Store the encrypted password in the database** In certain circumstances you will install the Secrets plugin and continue to store an encrypted password in the database. In this case, make the following changes to the [nnl-install.properties](/dpoa/docs/s3suite94-sample-nnl-installproperties-file-1) file: - Uncomment and configure DB_ENCRYPTED_USER_PASSWD_ENV - Comment out DB_SECRET_HANDLE_ENV In either case: After you have completed the configuration of the Secrets plugin, go to [Step 6. Install the Server and its Components](/dpoa/docs/s3suite94-step-6-install-the-server-and-its-components-1) to run the installation script and then return here. If you completed installation successfully, you see the following: - Inside the tomcat/bin/setenv.sh file: ```plaintext CATALINA_OPTS="${CATALINA_OPTS}-Dnnl.secrets.plugin.class.name=" ``` - The jars from the paths specified in NNL_EXT_DIR_PATHS are copied into the web applications' lib directories. For example, for the authentication server these libraries will be in tomcat/webapps/nnl/WEB-INF/lib/ - The handle for the operational database password in the external secrets manager is updated in the following files: - /bin/setenv.sh - /admin/conf/nnl-db.properties - /admin/conf/application.properties Verify the installation by running the /install/nnl-postinstall-checks.sh script. Examine the output to uncover any configuration issues. After you verify the installation, perform the Post Installation tasks. Formerly Digipass S3 software. Formerly known as Digipass S3. Formerly known as Digipass S3 Server.