It has been implemented fully in Java EE for multi-platform support, performance and high-availability. ADSS XKMS Server is the marketing name for ADSS Server when licensed for XKMS services only.
The following highlights just some of its main features.
Respond for multiple CAs from a single ADSS XKMS Server instance. Configure separate validation policy for each CA, including unique XKMS signing keys and certificates. XKMS server certificates can optionally be issued using a built-in CA and auto renewed.
Dynamically build certificate paths using either information held within certificates (e.g. AIA cert issuer field) or from pre-configured LDAP repositories. Receiving intermediate certificates within request message as well as pre-registered on server is also supported. Each XKMS profile defines which of these options to use. ADSS XKMS Server has been subjected to independent evaluation and certification against the latest NIST Path Discovery test suite.
Complete RFC 5280 based certificate path validation. Supports all standard extensions like acceptable certificate policies, policy mapping, name validation, key usage, extended key usage and many others. ADSS XKMS Server has been subjected to independent evaluation and certification against the latest NIST PKITS test suite.
Retrieve certificate status information from CAs using multiple methods, e.g. HTTP/S CRLs, LDAP/S CRLs. Configure which input feed to use on a per CA basis.
Meet latest RFC 6960 and CAB Forum white-list checking requirements. The XKMS server can check if the certificate was actually issued by the CA (supports the Extended Revoked Definition extension of RFC 6960) a countermeasure against recent attacks on some CAs which resulted in the issue of fake certificates.
Provides CRL streaming for efficient import of very large CRLs, provides flexible CRL polling including ability to detect over-issued CRLs, multiple CRL source can be monitored, with ability to have watched-dog process for high availability ensuring no CRL is missed. Indirect CRLs, Delta CRLs and Partitioned CRLs are fully supported.
ADSS XKMS Server comes with our sophisticated ADSS CRL Monitor module for automated monitoring of multiple CRL issuers, fully verifying and validating the imported CRLs and real-time alerting of operators on any faults, e.g. unavailability of CRLs. See the CRL Monitor page for full details. Optionally ADSS XKMS Server can also republish a retrieved CRL to a defined location, e.g. on the internal network for local users as a fallback option. Auto-archiving of old CRLs is also provided.
The ADSS XKMS Server access control module allows operators to restrict client access based on TLS/SSL client certificates, XKMS request signing and/or using IP address filtering. Multiple rules can be set up to detect specific client certificate fields and range of IP addresses to accept/reject.
ADSS Server is built using Java EE architecture to provide high performance and scalability. It supports virtualised environments, where CPU and memory can be increased for performance gains. Even on a single server ADSS XKMS Server can provide several hundred XKMS transactions per second, furthermore the use of a hardware load-balancer with multiple ADSS XKMS Server instances can satisfy any demanding performance requirements.
The core services within ADSS XKMS Server can be split to allow separate back-end servers to import CRLs, thereby allowing front-end XKMS servers to focus solely on handling high XKMS transaction loads, ensuring maximum performance.
Multiple ADSS Servers can be used in load-balanced mode to maximise availability across one or more live sites (also use DB replication/clustering and HSM replication for complete infrastructure resilience).
ADSS XKMS Service comes with its own management reporting module. This provides the ability to create graphic and tabular reporting on all service requests within a particular date period. The management reports show the number of transactions processed, their results, who the main XKMS clients are, which end-entity (target) certificates were checked the most etc. Reports can be exported in PDF and CSV format.
All XKMS request/response transactions are securely logged in the ADSS XKMS Server database. To support administrators review of these transactions, viewers are provided which automatically convert the XKMS binary transactions into human-readable form, thus allowing easy analysis of reported trust issues or interoperability checking.
FIPS and Common Criteria certified HSMs from SafeNet, Thales and Utimaco can be used to stored and protect all cryptographic keys. Support for other PKCS#11 compliant HSMs can also be provided if required. HSMs can be network, PCIe or USB connected. One or more HSMs, smart cards or USB tokens can be connected to ADSS Server. Another key feature of ADSS Server is the sophisticated auto-reconnect feature that prevents a network issue requiring operator intervention to reconnect a network HSM!
Support for the common cryptographic algorithms is provided including SHA1, SHA-2 (SHA-256, SHA-384, SHA-512), RSA keys up to 4096 bits and ECDSA up to 521 bits.
ADSS Server operators are authenticated using certificates over a mutually authenticated TLS/SSL sessions. The operator’s private key and certificates can be on a hardware token for strong multi-factor authentication. ADSS Server performs full certificate validation, including revocation checking, before allowing operators to login to the console.
ADSS Server enables multiple operator roles to be defined. Each operator registered within the system is assigned a role. The role-based access control system enables very fine control over specific service modules that an operator can see and whether they have read, write, edit or delete capability for specific areas of functionality.
ADSS Server implements dual control in a flexible and practical way, i.e. dual control can be applied selectively to the important aspects of functionality that are considered most sensitive (such as key generation, policy change etc). When used, an operator’s actions are queued for a Security Officer role-holder to review and then approve or reject the action.
Business applications are authenticated using TLS/SSL client certificates that are pre-registered in ADSS Server. The application’s access to specific profiles and/or keys is checked as part of the ADSS Server authorisation process when service requests are received.
Cryptographic tamper-resistant logs are provided for all service transaction logs that contain details of requests and responses, all operator activity logs and all system event logs. Advanced reporting, reviewing including searching and filtering of log records is provided. All database log records are cryptographically protected to prevent record modification, deletions or additions.
All ADSS Server configurations and settings held in the database are cryptographically protected to prevent record modification, deletion or addition. The system automatically checks these records at pre-defined intervals or on demand to ensure system integrity. A detailed report is produced for any issues that are found.
Selected system operators can be alerted when certain event conditions occur using email or SMS messages. Management systems can be alerted using SNMP messages or via Syslog (log4j) messages.
ADSS Server is feature rich to minimise IT operations time. The simple installation wizard, the automatic checking of system integrity and auto-archiving and alerting ensure the system runs without daily operator involvement. The detailed transaction logs and detailed request/response viewers reduce support desk time in resolving operational issues. ADSS CA Server is also able to run an automatic upgrade process for its settings and data to run the latest version of software.
ADSS Server features an optional NTP Time Monitor service that regularly checks the operating system time and compares this with one or more configured NTP time servers to detect unacceptable time drift or IT operational errors. Configured time thresholds allow ADSS Server operators to be alerted to time issues and ultimately all trust services can also be stopped automatically.
To prevent database bloating ADSS Server can be configured to automatically archive database log records. As the archive log files are created and written to disk, they are digitally signed to provide authentication and integrity. The archived files can later be imported, verified and viewed within the transaction log viewer.