After you have initialized a service using CCC, you need to run the CCC client (ccc_client.jar) from your crypto application server to register your client with the HSM used to host the service before you can begin to use the service. When you run ccc_client.jar, it automatically creates an NTLS or STC connection between your crypto application server and the device(s) associated with the service. The connection is NTLS unless the service configuration indicates that the STC should be enabled on the device partition(s). You can view the STC status for a service in the capabilities tab.

The only information you require is the CCC hostname, IP address, or fully qualified domain name, your CCC username, and for services that use both STC and Per-Partition Security Officer (PPSO), the partition officer credentials. The fully qualified domain name is preferred, as that value is recommended for the common name of the server certificate to prevent IP address conflicts in high availability configurations. If you wish to specify an IP address or hostname, contact your CCC Administrator to regenerate the certificate using IP address in the subjectAltName field.

If you have multiple deployed and initialized services awaiting registration, ccc_client.jar presents a list of the available services, from which you can select the service you want to register.

Using CCC Client to Deploy an NTLS Service

After you download and install the CCC Client to your crypto application server, you can use it to deploy services on the workstation.

The option to support the "Repair Client" feature for PPSO-STC partially initialized services is not available.

To deploy an NTLS service:

1. Use sudo (Linux) or launch an Administrator command prompt (Windows) on the crypto application server that will use the service.

2. Go to the directory where ccc_client.jar is installed:

   Linux	cd /usr/safenet/lunaclient/bin
   Windows	C:\Program Files\SafeNet\LunaClient\

3. Run ccc_client.jar:

   java -jar ccc_client.jar -user [-password ] [-otp -host [-port ]

   If you specify a password as part of the command, enclose it in single quotation marks (in Linux, as in the example), or double quotation marks (in Windows). If you do not specify a password, you are prompted for one, in which case do not use quotation marks.

   If your account has one-time password (OTP) configured, you must either include the -otp parameter, or respond when prompted for the one-time password code. Consult your two-factor application on your mobile device for a current OTP code. Enter the six digit code with no spaces.

   The -port parameter is optional. If not specified, the default port 8181 is used, as reflected in the example below:

   java -jar ccc_client.jar -user myname@myorg -password 'mypassword' -host cccserver 

4. You are prompted to accept the CCC server certificate. This message is not displayed if you previously imported the certificate on this client:

   Connecting ...Server certificate is not trusted.
Select one of the following options to proceed:
1: Show the certificate details
2: Trust the certificate this time only
3: Trust the certificate and permanently import it to the trusted keystore at: C:\Program Files\Java\jre8\lib\security\cacerts
4: Exit
Enter an option(1-4):
Enter 1 to display the certificate.
Enter 2 to trust the certificate for this deployment only.
Enter 3 to permanently trust the certificate.
Enter 4 to exit the client without deploying the service.

5. A client certificate for NTLS connections to service partitions is created, if the certificate is not present. You are prompted for an IP or hostname to register with partitions.

   Creating certificate...
Please choose the IP address or hostname you want to register with HSMs
1) 1.1.1.1
2) 192.168.1.1
3) Manually enter a different IP or hostname
Option: 1 

6. If you choose to permanantly trust the certificate, you are prompted to enter the trusted keystore password:

   Enter the trusted keystore password:
   Enter the trusted keystore password for the Java JDK installed on the Thales Luna HSM client workstation. The default password is changeit.

7. A list of services created for your organization that are available to be deployed are displayed. Select the service you want to authorize your client to use.
   Logging in ... Querying current services... Please select the service you want to configure: 1) Service_with_a_smile - No description 2) Now_thats_service - Password partition 3) Self_service - PED HA group 4) Exit 

8. You are prompted to authorize, revoke, or repair access. Select option 1 to authorize access.
   Please select the action you want to execute:
1) Authorize Access
2) Repair Access
3) Revoke Access
4) Exit
Option: 1 

   When a partition is added or removed from an existing service, the CCC application owner can use "Repair Access" option to create a NTLS link with new service partition added to the client's HA group.

9. If you are authorizing a PED-authenticated HSM Partition HA Group service, go to the next step. Otherwise, the following message is displayed when the procedure gets completed:
   Would you like to authorize access to service 'Service_with_a_smile'? (Y/N): y Access to service 'Service_with_a_smile' was successfully granted. Done 

10. For PED-authenticated HSM Partition HA Group services, the service cannot be authorized until each partition in the HA group has been assigned the same challenge password and has been activated. If the HA group has the Per-Partition Security Officer (PPSO) feature enabled, you can activate through the CCC user interface. If PPSO is not enabled, continue in this section. This task can be performed by the Administrator when creating the service, or by the Application Owner when deploying the service. When you attempt to authorize the service, the following message is displayed:

    Would you like to authorize access to service 'Self_service'? (Y/N): y
Configuring HSM Partition HA group...
List of group members:
label: partition-00 (serial number: 111111111110)
label: partition-01 (serial number: 111111111111)
Have you manually changed the challenges for the 'HAGROUP' group members? (Y/N):

11. If you are sure that each partition in the HA group has been assigned the same challenge password, enter y. You are prompted to enter the challenge password:
    Enter the group challenge for group HAGROUP:

12. Enter the challenge password. If successful, the following message is displayed:
    Access to service 'Self_service' was successfully granted.

    In case there's an issue, an error indicating that the challenge passwords do not match is displayed. To overcome this issue, re-run ccc_client.jar, answer n to the challenge passwords prompt, and complete this procedure for the case when you have not manually changed the challenges for the HA group members.

    This error is displayed if either the passwords do not match, or if the partitions are not activated.

    If you have not assigned the same challenge password to each partition in the HA group, enter n. The following prompt is displayed.

    Process paused. If you wish to align the CO challenges and activate the CO roles now, open a new console and run LunaCM to perform these operations. Once you have done so, select “Continue” below to proceed with this HA Group configuration.
1. Continue
2. Exit

    Set the challenge password for each listed member.