This article shows how to complete the whole initialization of your PKI system from the very beginning to a successful completion of its initialization. 


Steps covered:

  1. Start Amazon Enigma Bridge PKI instance
  2. Connect to the AMI instance via Putty SSH client software
  3. Initialize the EB PKI system
Following step:
  • Install administrator authentication key on your computer

What you need:

 

  1. An account with Amazon AWS - if you look for a trial, you can create an instance with initial 750 hours of free usage on Amazon AWS. 


Procedure

Start Enigma Bridge PKI Instance

  1. Go to https://enigmabridge.com/amazonpki , click "Launch your PKI" and select the AWS Region.

    rPZYOcL1daSAoBUjzFXCPOybACueni9vBA.png


  2. The link will take you directly to Amazon AWS and initiates creation of a new server instance. (You need to have an AWS account.)

    j-SN4dNnsAnfrEWqM1gh98KlKi5tBDh-5A.png

Connect to the AMI instance
You may have already done it but if you use MS Windows with "putty" as an SSH client, you need to convert "PEM" files with your authentication key pair into a "PPK" file for putty.
  1. You can download putty.exe and puttygen.exe from http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html 
  2. Start 'puttykeygen.exe' utility in your Windows computer.
  3. Select File->Load private key

    7cf7wBTzhRarR2_-la3GE1BYwkxOk3ZSyQ.png


  4. Select the file you downloaded from Amazon AWS - the pem file for management of your AMI instance.

    Tsk4dDDDh1ABBuGpvAps46FnEpAHQGMqzw.png

  5. Confirm the key loading.

    m3LTEQ7kKaaymqMTvDMaNp-GyEruwVHa8g.png

  6. Set your private key protection password (optional, 'Key passphrase') and click 'Save private key'

    kBDRu19m9MkdZ6vHbXasywj9zVwOzAwGSw.png


  7. You should now have *.ppk file with private key for AMI authentication usable by Putty.
  8. Let's now create a new connection to your PKI instance.
  9. Start "putty.exe"
  10. Find the public IP address of your PKI instance on Amazon - the screen is similar to the following picture.

    Whm6pm1Kw_BSvbb4puZKFwFeaJdiUj64Ig.png


  11. Fill 'Host name (or IP address)' filled with Public DNS value obtained when launching the instance (Running EC2 image). 

    Fn1F7y2P0qUdifr81uD1Fb4eoOjNtxWqOA.png


  12. Set path to your private key in Putty→Connection→SSH→Auth→Private key file for authentication.

    i-G2q9eY6n1cZaIMF_CD4v5H5C6xVawjyw.png


  13. Save connection details in Session→Saved sessions→Save for later use.

    k9gUBtzX1-QgRffO5VNeCiQhHX8T2xEijA.png


  14. Click 'Open' to login to target AMI instance.
  15. Verify AMI instance fingerprint against your EC2 console and press 'Yes' in case of fingerprint match.

    Y97w87ZTNapEEqX_Uu2DjV4f5CUHMMz-QQ.png


  16. Type 'ec2-user' as user name into 'Login as' field.

    CiaKMOdC4kWgDtCtgreg5um1K6OFQMJ7Wg.png


  17. Type your private key passphrase (optional, if set during step 6 above).

    aoq-xBy6NIYZujHLqPFtqcmbYcJcJ18S9Q.png


  18. Now you are logged into your Amazon AMI instance.

Initialize the EB PKI system
As we have connected to the running AMI instance, we can start the initialization script.

  1. Type 'sudo -E -H /usr/bin/ebaws' to start EJBCA console. Note: it will do an update and eventually show this screen.

    WO_bvZOxYLXnymVDJS_nzoqMTGw4dIt6cg.png


  2. Type 'init' command to start initialization.

    vyHy37kTNxZjAv3xDzWTr0hCyXFNDQLUJQ.png


  3. You will be asked to enter your email address to obtain all details from installation - we will also create a support account for you.

    HvPAkCsmpo5mYS42vi9a40GOOgGnYiM_5Q.png


  4. You will be sent an authorization challenge via email. This challenge has to be intered into the putty terminal.

    XT3rSi21teMYsssVdzzlX5IvVvVpa91mVA.png


  5. Click the link, create a password for your new account and get the challenge.

    IRvvUAQ_NR2Vja7PQDMeU-is0yjdnkyo0A.png


  6. If using a small instance, it will be configured for the PKI system.

    Yq_CK-qLEvHIWbCMfT5Z8mWeCzeGmRtrHA.png


  7. It's time for a cup of coffee - it takes up to 15 minutes (usually 11-12 minutes) to complete the initialization.
    1. LetsEncrypt certificate for your newly registered utility domain
    2. Configuration of SoftHSM token
    3. Installation and deployment of PKI software
    4. Generation of EnigmaBridge cryptography tokens

      KaQTwg1tcw4uJL-RgN5kBlggrxgjdwldtQ.png

      SCYCbLa5UAO0X2Sxz1YYCDKaL0rIZ-1iEA.png

      EtGMNeDGOoVSRy8oC4MGgR5pgMjvMxh8dQ.png


  8. Installation and setup is complete when '[OK] System installation is completed' message is shown.
  9. Needed for the first connection to the web front-end.
    1. P12 file with your administrator key - scp command for downloading it, e.g., 'scp -i <your_Amazon_PEM_key> ec2-user@bristol4.pki.enigmabridge.com:/home/ec2-user/ejbca-admin.p12')
    2. P12 file password - also displayed.
    3. URL to your EJBCA web management console.

Follow step 4 to complete setup for the PKI administrator.