Integrating nShield with Secret Server

Third-party vendors create and maintain this integration. Delinea does not guarantee that the integration will work properly or that it respects Delinea product limitations. Delinea has not reviewed this integration and Delinea Support staff can only assist with the Delinea side of setup.

This integration protects the Secret Server encryption key with an Entrust nShield hardware security module (HSM).

Secret Server on-premises is the only supported deployment. If you are using Secret Server Cloud or Secret Server on the Delinea Platform, see AWS Key Management and Azure Managed HSM Services.

When the HSM is enabled, Secret Server generates its encryption key on the nShield HSM and keeps it there, not on the Secret Server host. That key protects every privileged credential in the vault, and it now sits in certified hardware your security team controls. Without the HSM the vault cannot be decrypted, so an attacker who copies the server or the database still cannot read your secrets.

Secret Server connects to the HSM through the Microsoft CNG provider or the PKCS #11 API, and supports operator card set (OCS), softcard, and module protection.

Use Cases

  • Hardware-protected vault key: Keep the key that encrypts every secret in a FIPS-certified HSM instead of in software.

  • Regulatory compliance: Meet requirements such as PCI DSS, FIPS 140, and internal policies that call for hardware-based key protection.

  • Key custody and separation of duties: Split the control so the security team manages the HSM and its cards, while Secret Server administrators manage secrets.

  • High availability: Enroll Secret Server with multiple nShield HSMs so key operations continue if one HSM is unavailable.

Entrust tested this integration with Secret Server 12.2.7, nShield 5c and nShield Connect XC, and Security World software 13.6.18 and 13.9.6. For the full test matrix, see Entrust's nShield HSM Integration Guide for Delinea Secret Server.

Before You Begin

  • Back up encryption.config and the Secret Server database before you enable, disable, or rotate the HSM key.

  • Run the Secret Server application pool as a dedicated service account with Load User Profile set to True. The NETWORK SERVICE account is not supported.

  • Set the OCS quorum to 1 (1-of-N) if you use operator card set protection. Secret Server interacts with the HSM in silent mode and cannot prompt for a card.

  • Store the HSM credentials outside Secret Server, somewhere you can still reach if Secret Server becomes unavailable.

For HSM hardware and Security World details, use the Entrust Guide. For more information about this integration, see the following topics: