The Cryptographic Security Platform platform does not require a database. However, some Entrust solutions have the requirements described in the table below.

Database Management System

The external databases of Entrust solutions support the following Database Management Systems (DBMs) 

Solution

Oracle

PostgreSQL

Microsoft SQL Server

Certificate Authority

(error) 

15+

(error) 

Certificate Manager

(error)  

15+

(error)

Validation Authority

21.3.0

14.3 or 15.6

2019 CU15

2022 CU13

Database storage

Calculate the required database storage based on the expected data.

For example, the Certificate Manager solution database requires nearly 1GB for 25,000 certificates and a few weeks of reports.

25,000 certificates x 20 KB/certificate =  500 MB

200 reports x 1 MB/report = 200 MB

Total: 700 MB

Database packages

Pre-packaged PostgreSQL packages typically include the postgresql-contrib subpackage. If not included, install this subpackage to obtain some of the required extensions.

https://www.postgresql.org/docs/current/contrib.html

Database user permissions

The database user must have permissions on the public schema.

For example, to create a Certificate Manager database user with sufficient permissions, connect to PSQL using the default PostgreSQL user and execute the following commands.

CREATE USER ${POSTGRES_USER} WITH NOSUPERUSER CREATEDB ENCRYPTED PASSWORD '${POSTGRES_PWD}';
\c postgres ${POSTGRES_USER}
CREATE DATABASE cm;
\c cm ${POSTGRES_USER}
CREATE EXTENSION IF NOT EXISTS pg_trgm;

Where:

Database allowed connections

Restrict database incoming connections to those originating from the Cryptographic Security Platform host.

To restrict incoming connections on a PostgreSQL database

  1. Edit the following PostgreSQL configuration file.

    pg_hba.conf

  2. Add the following line.

    hostssl cm ${POSTGRES_USER} <host> scram-sha-256

    Where <host> is the IP address of the Cryptographic Security Platform host.

Database SSL certificate

In SSL-protected connections with the database, the SSL certificate of the database must include the IP address or hostname Cryptographic Security Platform will use to connect with the database. You can alternatively:

  • Set the hostname or IP address in the CN attribute of the certificate subject.
  • Set the hostname in a SAN attribute of the dNSName type.
  • Set the IP address in a SAN attribute of the iPAddress type.

Entrust solutions in production mode should always be configured to enforce SSL-protected connections with the database.

Database names

In the Certificate Manager database, names should not use uppercase letters to avoid case sensitivity problems. Unquoted identifiers in SQL syntax are converted to lowercase, which can lead to problems when mapping to a name with uppercase letters.