inoQulate by pQCee

inoQulate is a service to protect your PDF documents against Quantum attacks. This is the administration manual for the inoQulate solution.

For more information about inoQulate product or pQCee, please visit https://www.pqcee.com/inoqulate.

The inoQulate solution is built upon several key components:

1. EJBCA - A Certification Authority Software

2. Signserver - A solution that cryptographically signs code and documents

3. PostgreSQL Database - A Relational Database

4. A service runner that automates the process of contacting Signserver to sign a batch of PDF files.

Table of Contents

• 1. Getting Started with inoQulate on the Azure Marketplace in a Sandbox Environment
  • 1.1. Before You Start
    • 1.1.1. Prepare Credentials
      • 1.1.1.1. VM Credentials
      • 1.1.1.2. Database Admin Credentials
      • 1.1.1.3. Database Credentials for Certification Authority Software
      • 1.1.1.4. Database Credentials for Signer Software
      • 1.1.1.5. Trust Store Credentials
      • 1.1.1.6. Client Certificate Password
      • 1.1.1.7. TLS Keystore for Signserver
      • 1.1.1.8. Certification Authority Application - HSM Token SO PIN
      • 1.1.1.9. Certification Authority Application - HSM Token User PIN
      • 1.1.1.10. Signer Application - HSM Token SO PIN
      • 1.1.1.11. Signer Application - HSM Token User PIN
      • 1.1.1.12. Summary
    • 1.1.2. Register Resource Providers
  • 1.2. Subscribe to inoQulate from the Azure Marketplace
    • 1.2.1. inoQulate Marketplace Listing
    • 1.2.2. Basics
    • 1.2.3. Kubernetes Cluster
    • 1.2.4. Management VM
    • 1.2.5. Tags
    • 1.2.6. Review
  • 1.3. Set up the Solution
    • 1.3.1. References for this page
    • 1.3.2. Log in to the VM
    • 1.3.3. Connect the network drive and create directories
    • 1.3.4. Download Additional Configuration Files
    • 1.3.5. Set up Authenticated Access to EJBCA
      • 1.3.5.1. Access the EJBCA page
      • 1.3.5.2. Import pre-configured profiles
      • 1.3.5.3. Request and Install a Client Certificate
      • 1.3.5.4. Remove Unauthenticated Access from EJBCA
    • 1.3.6. Create certificates for the other services
      • 1.3.6.1. Import ManagementCA Certification Authority into Signserver
      • 1.3.6.2. Import ManagementCA Certification Authority into Service runner
      • 1.3.6.3. Request a TLS certificate for Signserver
      • 1.3.6.4. Install the TLS certificate in Signserver
      • 1.3.6.5. Summary
    • 1.3.7. Create a Certification Authority
      • 1.3.7.1. Initialise HSM Token
      • 1.3.7.2. Create a Crypto Token
      • 1.3.7.3. Create a new Certification Authority
      • 1.3.7.4. Edit End Entity Profiles to select the new CA
    • 1.3.8. Set up an inoQulate service
      • 1.3.8.1. Initialise HSM Token
      • 1.3.8.2. Create a CryptoWorker
      • 1.3.8.3. Create a TimestampSigner Worker
      • 1.3.8.4. Summary
    • 1.3.9. Install the inoQulate PDF Verifier
    • 1.3.10. Test run the service
    • 1.3.11. Stop unncessary resources
  • 1.4. Recommended Next Steps (Optional)
    • 1.4.1. VM File Integrity Monitoring
    • 1.4.2. Allowed Container Images
    • 1.4.3. Restrict Kubernetes API Access
• 2. Using the inoQulate Solution
  • 2.1. TL;DR
  • 2.2. Working Directory
  • 2.3. Scheduled Runs
  • 2.4. Create a Pipeline for your documents
  • 2.5. Verifying the inoQulation
    • 2.5.1. Adobe Acrobat Reader
    • 2.5.2. inoQulate PDF Verifier
  • 2.6. Accessing the Administrator pages
• 3. Troubleshooting
  • 3.1. I cannot connect to my Virtual Machine via RDP.
    • 3.1.1. Configure Inbound security rules
  • 3.2. I am installing the solution for the first time, but I can’t access the EJBCA or Signserver Admin page.
    • 3.2.1. The db logs repeatedly show FATAL: no pg_hba.conf entry for host "10.xx.xx.xx", user "xx", database "xx", no encryption.
  • 3.3. My Firefox browser won’t recognise my SuperAdmin certificate.
• 4. Frequently Asked Questions
  • 4.1. How do I get the region code name of my Azure resource?
  • 4.2. How do I retrieve the Object ID of the administrator?
  • 4.3. How do I start my Administration Virtual Machine?
  • 4.4. What’s the web address for the EJBCA Admin page / Signserver Admin Page?
  • 4.5. Can I configure more than one IP Address that are allowed to access the VM?
  • 4.6. Can I request temporary access from another IP address to access the VM?
  • 4.7. How do I fully uninstall the solution?
  • 4.8. My Storage Account of Kind FileStorage has secure transfer disabled!