Configuring the CSP

This topic provides instruction on configuring the CSP. After installing the CSP, the configuration wizard opens, which is where this procedure begins. After completing this procedure, the CSP will be able to communicate with the Trust Protection Foundation for authentication and virtual HSM functions.

Configuring the CSP using the configuration wizard

1. If the CSP Configuration wizard is already open, skip to the next step. If not, navigate to C:\Program Files\Venafi CodeSign Protect\MMC and run Venafi Csp Configuration.msc.

2. In the left navigation pane, select the client that you want to configure.

   Learn more about Current User and Local Machine

   The navigation pane in the CSP UI has two sections: Current User (labeled with your username) and Machine.

   • Current User: Clients configured here receive grants that are valid only for the signed-in user.
   • Machine: Clients configured here receive grants that are valid for the workstation itself. Code can be signed from the workstation even when no user is signed in, so Machine grants are less secure than Current User grants.

3. In the Actions pane on the right, click Set URLs. Enter the addresses for your Authentication server and your HSM server.

   EXAMPLE  If your company's Trust Protection Foundation URL is TPP_SERVER_URL, enter the following:

   • Authentication Server URL: https://TPP_SERVER_URL/vedauth
   • HSM Server URL: https://TPP_SERVER_URL/vedhsm

4. In the Actions pane, click Request Access. From the Method drop-down menu, select one of the following options:

   • Username/Password: Enter your Trust Protection Foundation Key User username and password
   • Integrated Windows Authentication: Authenticates a user with Windows username and password.
   • Device Authorization: Gets authorization for the device from the SCIM authentication server. Requires the SCIM Identity connector to be configured, and requires a Trust Protection Foundation server at version 26.1 or later with device authorization enabled in Enabled. For more information, see Using device authorization with Code Sign Manager clients.

For more information about the CSP Configuration Console, see Using the CSP Configuration Console.

Installing and configuring the CSP using the command line

To make mass deployments easier, you can script the CSP installation and configuration.

In order to script the configuration, you'll need an answer file. If you don't already have an answer file, follow the steps in Configuring the CSP using the configuration wizard. At the end of that procedure, you'll have the chance to save an answer file, which you can then use to script configuration of the CSP.

To install the CSP

To configure the CSP using an answer file

Run CspConfiguration.exe with the -install switch and specify the path to the answer file. This utility requires administrator privileges.

If the answer file is encrypted, provide the password:

CspConfiguration.exe supports the following options:

Option	Description
-install:<xml>	Performs a first-time install using the specified answer file. If the CSP is already installed, upgrades the current system configuration.
-uninstall	Removes CSP-related registry configuration.
-password:<pw>	Password for decrypting an encrypted answer file and for obtaining a grant.
-log:<file>	File to record the installation log to. Default location: C:\Program Files\Venafi\Logs\Csp Configuration Log.txt.
-help	Shows usage information and all return codes.

CspConfiguration.exe returns the following exit codes:

Code	Description
0	Completed successfully.
1	The specified answer file could not be opened or does not exist.
2	An error occurred processing the answer file.
3	The installation process failed. See the installation log for details.
4	Could not detect the installation mode.
5	The system is already up-to-date.
6	CspConfiguration was not run with administrator privileges.
100	An unexpected error occurred.

You can also use the CSPConfig, PKCS11Config, or GPGConfig command line utilities to script individual configuration steps.

Understanding and configuring the blocklist to block calling applications

The Blocklist registry key, located in SOFTWARE\Venafi\CSP , specifies a list of blocked calling applications. This key can be either a REG_SZ or REG_MULTI_SZ type. If the key has no value, the blocklist is disabled.

By default, if the registry key is not set, the client will block calls from IIS (specifically w3wp). This behavior helps prevent loading the Code Sign Manager CSP/KSP from Trust Protection Foundation, which runs within IIS.

To allow the CSP/KSP to run from IIS, create the registry key with an empty list.