--- title: Setting up a new installation of AWS CloudHSM description: Configure your hardware security module. You must have a AWS CloudHSM cluster to complete step 3. For more information, see the Amazon documentation. component: pingaccess version: 8.2 page_id: pingaccess:pingaccess_user_interface_reference_guide:pa_installing_cloudhsm_initially canonical_url: https://docs.pingidentity.com/pingaccess/9.1/pingaccess_user_interface_reference_guide/pa_installing_cloudhsm_initially.html llms_txt: https://docs.pingidentity.com/pingaccess/llms.txt docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md revdate: June 9, 2023 superseded_by: https://docs.pingidentity.com/pingaccess/9.1/pingaccess_user_interface_reference_guide/pa_installing_cloudhsm_initially.html section_ids: before-you-begin: Before you begin about-this-task: About this task steps: Steps choose-from: Choose from: choose-from-2: Choose from: next-steps: Next steps --- # Setting up a new installation of AWS CloudHSM ## Before you begin * Configure your hardware security module. You must have a AWS CloudHSM cluster to complete step 3. For more information, see the [Amazon documentation](https://docs.aws.amazon.com/cloudhsm/latest/userguide/getting-started.html). * Ensure that Java 8 or 11 is installed on the PingAccess server. For more information on how to set up a Java Runtime Environment (JRE) *(tooltip: \
\

A software layer that provides the class libraries and resources needed for a Java program to run.\

\
)*, see [Installing PingAccess on your system](../installing_and_uninstalling_pingaccess/pa_installing_pa_on_your_system.html). Make sure that you use a non-Oracle version of Java (such as Corretto), and if you use JDK 11, make sure that you use 11.0.16 or later. * PingAccess must be deployed on an operating system that AWS CloudHSM supports. See [System requirements](../installing_and_uninstalling_pingaccess/pa_system_requirements.html) in the PingAccess documentation and [Supported platforms for the client SDKs](https://docs.aws.amazon.com/cloudhsm/latest/userguide/client-supported-platforms.html) in the AWS CloudHSM documentation for a list of mutually supported operating systems. ## About this task To set up a new installation of AWS CloudHSM Client SDK 5 and integrate it with PingAccess: ## Steps 1. Request a crypto user (CU) account from your AWS CloudHSM administrator. | | | | - | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | You will need to reference your username and password for this account during steps 4-5 of [Adding an AWS CloudHSM provider](pa_adding_an_aws_cloudhsm_provider.html). PingAccess uses this information to establish a connection with AWS CloudHSM. | 2. Install and configure the AWS CloudHSM Java Cryptography Extension (JCE) provider for Client SDK 5. For more information, see [Install and use the AWS CloudHSM JCE provider for Client SDK 5](https://docs.aws.amazon.com/cloudhsm/latest/userguide/java-library-install_5.html) in the AWS CloudHSM documentation. | | | | - | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | | You can't install the JCE provider if you already have the AWS CloudHSM client installed because of the structural changes made to the client between 3.x and 5.x. If you are upgrading from PingAccess 7.2 or earlier, you must remove any existing CloudHSM client software. | 3. Connect the Client SDK to the AWS CloudHSM cluster. For more information on how to connect the Client SDK, see [Bootstrap the Client SDK](https://docs.aws.amazon.com/cloudhsm/latest/userguide/cluster-connect.html#connect-how-to) in the AWS CloudHSM documentation. Use the **JCE provider** tab. 4. Run the appropriate command for your operating system to ensure that keys are available to use. | | | | - | --------------------------------------------------------------------------------------------- | | | You must complete this step even if you don't plan to use a cluster containing multiple HSMs. | ### Choose from: * On Linux operating systems, run the `sudo /opt/cloudhsm/bin/configure-jce --disable-key-availability-check` command. * On Windows operating systems, run the `C:\Program Files\Amazon\CloudHSM\bin\configure-jce.exe --disable-key-availability-check` command. 5. If you plan to use elliptic curve (EC) keys for decryption, run the appropriate command for your operating system. ### Choose from: * On Linux operating systems, run the `sudo /opt/cloudhsm/bin/configure-jce --enable-ecdh-without-kdf` command. * On Windows operating systems, run the `C:\Program Files\Amazon\CloudHSM\bin\configure-jce.exe --enable-ecdh-without-kdf` command. 6. Configure a new PingAccess installation on the network interconnected to the HSM. For more information on how to install PingAccess, see [Installing PingAccess on your system](../installing_and_uninstalling_pingaccess/pa_installing_pa_on_your_system.html). | | | | - | ------------------------------------------------------------------------------------------------------------- | | | To integrate an existing PingAccess installation with your HSM, skip this step and proceed to step 7 instead. | 7. To enable the Java interface and PingAccess integration, copy the `cloudhsm-jce-5.x.0.jar` file to the `pingaccess/deploy` directory. | | | | - | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | * On Linux operating systems, the file location is `/opt/cloudhsm/java/cloudhsm-jce-5.x.0.jar`. * On Windows operating systems, the file location is `C:\Program Files\Amazon\CloudHSM\java\cloudhsm-jce-5.x.0.jar`. | ## Next steps Return to [Adding an AWS CloudHSM provider](pa_adding_an_aws_cloudhsm_provider.html) to finish setting up an AWS CloudHSM provider in the administrative console.