To enable secure auditing for systems that do not use an HSM, the OneSpan Authentication Server Maintenance Wizard creates a master audit key pair in a PKCS#12 file during installation.
OneSpan Authentication Server generates a signature using the private key in the PKCS#12 file. This signature will be used as the epoch ID. OneSpan Authentication Server then generates an epoch key pair, consisting of an epoch public key and epoch private key. Each secure audit entry will contain the epoch public key, and the epoch ID.
To verify each secure audit entry, the Secure Auditing Verification Tool uses the following:
The epoch public key
The epoch ID (supplied on each secure audit line)
The master audit public key which has been exported to a PEM file.
During installation, the Maintenance Wizard performs all the required processing to create the PKCS#12 file for the keystore, according to the variables provided on the corresponding page. The Maintenance Wizard will create a self-signed certificate, but secure auditing can be configured to use a commercial SSL certificate.
Creating secure auditing certificate files manually
Manually created Secure Auditing certificate files must be generated from supported elliptic curve keys. Secure Auditing for OneSpan Authentication Server only supports elliptic curve keys that are:
ECDSA
NIST P-256 compliant
Stored in PKCS #12 format
Password-protected (i.e. empty password is not valid)
Additionally, the certificate file must meet the following requirements:
It must be in the correct file format:
If you are installing the certificate file via the Configuration Wizard during installation, it should be in .pem file format
If you are installing the certificate file via the Configuration Utility, it should be in .p12 file format.
The elliptic curve must be password-protected (i.e. an empty password is not valid).
The certificate must be generated from the elliptic curve key.
The elliptic curve key must be placed in the certificate file.
To manually generate your own secure auditing certificate file, you can use openssl.
OneSpan Authentication Server ships with a specific version of the OpenSSL utility. We recommend that you use this version for any procedures involving the openssl command.
By default, this specific version of OpenSSL is located in %PROGRAMFILES%\VASCO\IDENTIKEY Authentication Server\bin on Windows and in /opt/vasco/ias/bin on Linux, respectively.
Typical steps to manually generate a secure auditing certificate file
Open a command-line terminal.
Create an elliptic curve key file (in this case, named tmp.pem) via the following command:
openssl ecparam -out tmp.pem -name prime256v1 -genkey
Set the elliptic curve key file as password-protected. To do so, run the following command in a different command-line terminal:
openssl ec -in tmp.pem -des3 -out key.pem -passout pass:password
The output of this command is a valid, password-protected, elliptic curve key file named key.pem.
Generate a certificate file (in this case, named cert.pem) from the password-protected elliptic curve key:
openssl req -new -x509 -key key.pem -sha256 -out cert.pem -days 3650
The next step depends on how you plan to install the certificate file:
If you plan to install the certificate file via the Maintenance Wizard (e.g., during installation), then merge the contents of both password-protected elliptic curve key and the generated certificate file into a third PEM file.
On Linux, you can do so via the cat command:
cat key.pem cert.pem > audit.pem
This command outputs the contents of key.pem and cert.pem into audit.pem, which you can install via the Maintenance Wizard.
If you plan to install the certificate file via the Configuration Utility, import the password-protected elliptic curve key and the generated certificate file into a PKCS#12-formatted certificate file.
To do so, use the following command:
openssl pkcs12 -export -in cert.pem -inkey key.pem -name "Test Certificate" -out testaudit.p12
This command outputs a certificate file named testaudit.p12, which you can then install via the Configuration Utility.