Phase 2: HSM Provisioning
The HSM provides the protected environment in which the new CA private keys are generated and used. EC provisions the HSM resources assigned to the customer's hierarchy and completes the required key ceremonies before configuring the Root and Issuing CAs.
Key activities
- Allocate the dedicated HSM or appropriately segregated HSM resources specified in the approved architecture. Confirm the HSM model, cryptographic provider, partition configuration, administrative roles, and applicable validation level.
- Configure access controls and the required multi-person authorization procedures. Establish the process for HSM administration, key generation, protected backup, and recovery.
- Conduct a documented Root CA key generation ceremony using the approved algorithm and key size. Record the participants, approvals, HSM resource, key identifier, and results of the ceremony.
- Generate the Issuing CA key or keys through separate documented ceremonies, according to the agreed hierarchy. Confirm that each CA is associated with the correct HSM key and cryptographic provider.
- Create and verify protected HSM backups under the agreed key custody procedure. Confirm that recovery material is stored and accessible only to authorized personnel.
Phase outcome
When this phase is complete, the cryptographic foundation of the new PKI is in place. The HSM resources assigned to the customer's hierarchy are configured with the agreed administrative roles, access controls and multi-person authorization. The Root CA key and the Issuing CA keys are generated inside the HSM through documented key ceremonies, so the private keys never exist outside protected hardware. Each key is recorded with its identifier, the participants and the approvals, and protected backups exist under the agreed custody procedure. With the keys generated, recorded and recoverable, EC can build the Root CA and the Issuing CAs in the next phases.