Skip to main content

Frequently Asked Questions (FAQ)

Operating system update​

Per default the server does not update automatically. If auto updates are desired, the following steps have to be followed (Kernel will not be updated automatically):

  • systemctl enable apt-daily.timer
  • systemctl enable apt-daily-upgrade.timer

Updates are triggered ever 2nd tuesday at 02:00am. A redundant server is offset by 1 week.

To change the time/day of auto updates, the files /etc/system/systemd/apt-daily.timer and /etc/system/systemd/apt-daily-upgrade.timer have to be edited. Afterwards the command systemctl daemon-reload has to be executed

Why is Internet access required?​

Internet access is needed for the function "Issue certificates (online)".

If no Internet connection is available, the certificates can be issued in an offine process. In this case a file is exported from a.sign RK HSM, and is imported into the webshop. The result from the webshop is re-imported into the a.sign RK HSM.

What is important when changing the IP addresses?​

Automatic synchronization does not work and has to be reconfigured. See chapter Changing the IP address

SSL/TLS connection to a.sign RK HSM​

It is possible to use SSL/TLS to secure the communicate to the a.sign RK HSM. See chapter SSL certificate and chapter Configuration for Internet and untrusted networks

How can multiple a.sign RK HSM servers be operated in fail-safe mode?​

See chapter Operating multiple a.sign RK HSM Server

Number of available certificates​

The server comes with pre-generated keys for which the customer can issue certificates. The web interface provides an overview of available, used and unused certificates of the RK-HSM. If the sum of Number of used certificates and Number of unused certificates does not match with the Number of available certificates, then this means that a certificate request was cancelled or not finished.