upgrade demw to version 2.2.3 and switch HSM

demw-common/overlay/etc/Chrystoki.conf.d/50-ha-slot.conf

@@ -1,9 +1,12 @@
 VirtualToken = {
    VirtualToken00Label = sc_ha;
    VirtualToken00SN = 1462371088;
-   VirtualToken00Members = 462371088,610237018;
+   VirtualToken00Members = 1429929129933,1428350538479,1429933786534;
 }
 HASynchronize = {
    sc_ha = 1;
 }
 
+HAConfiguration = {
+   haLogStatus = enabled;
+}

demw-common/overlay/etc/luna/cert/server/lla-hsm2.sunet.seCert.pem

@@ -0,0 +1,20 @@
+-----BEGIN CERTIFICATE-----
+MIIDLzCCAhegAwIBAgIBADANBgkqhkiG9w0BAQsFADBbMQswCQYDVQQGEwJDQTEQ
+MA4GA1UECAwHT250YXJpbzEPMA0GA1UEBwwGT3R0YXdhMRYwFAYDVQQKDA1DaHJ5
+c2FsaXMtSVRTMREwDwYDVQQDDAhsbGEtaHNtMjAeFw0yMDAzMzAxMTI1MzNaFw0z
+MDA0MDExMTI1MzNaMFsxCzAJBgNVBAYTAkNBMRAwDgYDVQQIDAdPbnRhcmlvMQ8w
+DQYDVQQHDAZPdHRhd2ExFjAUBgNVBAoMDUNocnlzYWxpcy1JVFMxETAPBgNVBAMM
+CGxsYS1oc20yMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAw8UKBj61
+aja8nrXkMt7k5dFVAK5uufEyZ0JFeL3P7/9kVtoonh5VV8qTcwRPGjPK2pK4ZkwW
+YrwQwYU9I7XjnVjYRyEUKxyoGkBGmSUVccNKIHZI5CC6j/vA1e+eV3Pm7zBpD1Xn
+CBNS5s/bO4VU9/7G0VMRubjwhjjssVs68fH25Au3Vw0p8IeiacFzON6SZr+6j0BN
+jQ6p2q43phwOhUWYSdhufI1Yfn8jel4jGJjc97jDdFJqCCScRpyyARjxjgPJlS5v
+Pp2n8LmCNt4tnjbLGqV9Vf/2mUnyfskEx2xqnfuQTVLoAKE5c9kaanWbesEx1C1Y
+Oj2tHgpujrdtzQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQCkWHw+RIwtT7OfmFOJ
+YlJBKOgI0BgIo0dXMsm9+mEBuLyNIo5QL3Nw87/vke5Yn27J1/Q+ihW4JAj4JnQ6
+rBhm6Ns/6aqr2YWovRXo4R/N537qk9jhi5gff7L4NQrgiTUEgQ2kAQGAgzaSmD/+
+GSs9qY5gICCik5evthyeJhTDnp5eBaozjcIEEDTxtTg+xBm/gPraMQGl3hNC+p3E
+KFCf+AlIDSxIV3CjT/MDUYklsBFR2g2DVI49VKxoRU1Iloer0p2NvmtPUXn9bMXt
+X6GatvYxwNsiWVVYrNyIYUPQ59lihjQNibSIl5yqdXlhVY8pg5Xq9X1TOEMqUQ3l
+gQn2
+-----END CERTIFICATE-----

demw-common/overlay/etc/luna/cert/server/se-sthb-hsm1.sunet.seCert.pem

@@ -1,20 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDNzCCAh+gAwIBAgIBADANBgkqhkiG9w0BAQsFADBfMQswCQYDVQQGEwJDQTEQ
-MA4GA1UECBMHT250YXJpbzEPMA0GA1UEBxMGT3R0YXdhMRYwFAYDVQQKEw1DaHJ5
-c2FsaXMtSVRTMRUwEwYDVQQDEwxzZS1zdGhiLWhzbTEwHhcNMTkxMTE0MTAzNzQ5
-WhcNMjkxMTE1MTAzNzQ5WjBfMQswCQYDVQQGEwJDQTEQMA4GA1UECBMHT250YXJp
-bzEPMA0GA1UEBxMGT3R0YXdhMRYwFAYDVQQKEw1DaHJ5c2FsaXMtSVRTMRUwEwYD
-VQQDEwxzZS1zdGhiLWhzbTEwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB
-AQDezC8rs+iioz6L5r3Bai6hPr1oZeh5MhzHnW+pDKr7/8A1ZyDkAlQGbLjSN8ES
-zhnhm8oZQ2BkVbey4WWvWNAHqVLB1xaz1iGUMyTQ2r52UHTo9TBtYhtoTAc4NB/O
-ETuyaDEuB4MFHDwKsGjIEQFeCjEQurNWjDLJGtckgjyIFnLxd1DZk1xmG2SJMpNU
-2yLGYo72QW3jwnrTDb6/U6tiwfTCI42obNQmtp4Q7h8KaJLkYIQf45ZT+kvx3MED
-SwnylvDc3egakE8r1op+nrhoujfUhXbzeSreH6h16ZshZ565CPyebIFTmuqNzAc9
-+7yZVY8WFc8662wmWGOpnu4DAgMBAAEwDQYJKoZIhvcNAQELBQADggEBALOh6xgt
-+i93/1ewiBeDyaBxsYUmx4DQQCfL6Ia3FYC1CradvJpA8Y/O8MPpgZAjI0Sw8PFd
-yKaBg4H8dv7ePfFD9BjSXjzMj8VC/4mk9k1XRRTjM8e0ZKPmIG0ul5MJ+IF93Ote
-lzNBJg5uiXeSNcc/GNt3oO7ZbwGORiISMu0Lf5I6onubjepbbPc1LTEcUJn9tejT
-WMDMcuZEu8ZydZP5fWgCZZ/yO6BGTwk9FPQ5rZbUw9CCebfeQuGd8Emgx3VTz6F3
-D0N5iUR0S1RY69WGYf8GvJPfI11+f3mrZAiI7bS+P9nE7NwUk+8JB2+RHhDdrN2B
-54nRGITJJFyFwf4=
------END CERTIFICATE-----

demw-common/overlay/etc/luna/cert/server/se-tug-hsm1.sunet.seCert.pem

@@ -1,20 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDNTCCAh2gAwIBAgIBADANBgkqhkiG9w0BAQsFADBeMQswCQYDVQQGEwJDQTEQ
-MA4GA1UECBMHT250YXJpbzEPMA0GA1UEBxMGT3R0YXdhMRYwFAYDVQQKEw1DaHJ5
-c2FsaXMtSVRTMRQwEgYDVQQDEwtzZS10dWctaHNtMTAeFw0xNDA1MTMwMTE1MDha
-Fw0yNDA1MTQwMTE1MDhaMF4xCzAJBgNVBAYTAkNBMRAwDgYDVQQIEwdPbnRhcmlv
-MQ8wDQYDVQQHEwZPdHRhd2ExFjAUBgNVBAoTDUNocnlzYWxpcy1JVFMxFDASBgNV
-BAMTC3NlLXR1Zy1oc20xMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
-uEOQnpKAiWov+y5tzljds8FXZ1/u4K5mVvt6uT+uC9TyzleQ/Mvy+s96hgv32CH2
-Wb1hbnVoOg/r5cxaplmLtLAy4KQPEmEfYsoftGXc+sNhjNQaP7Sv+PVJooFEEvxP
-sicnHK2Iw0+2I5yYfnNe2k1L0Kl2EJWLS3tq2l6w6RPD/ldf21lXmB+RE7j3QEx/
-ALqLuqbiyg8tR6iamTQBM9IotG1jBIh5InVStZqV9bzyLIebNUjkyta2uCw4RCcM
-lxJpLm7HOpuDf4iLVLW5BwRLJMHBoHJ5hK7Rw9vpwUhL5ujwZ8ugiYwiYtgXUuia
-b8WgGuo5zRNA1Zm2TrvNqQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQA3/xEbq4gP
-sOrH66HHToRUoGvkD90uhYwinYNmE7KBTAFhvbnlCeOcQGo88DoVZgkYJNLpMD4K
-bhyyyNcVVt6UYHzt00N5XfuqwEy1C1QqZaeNZiyADvLLBftjym/VHth70Eu5WjHo
-f02uDEU3DkaWuFRrAqBGkkFLJwrNua0qr1vnqe5LBipOCkXPSCAUYW5iJmESeolD
-BzA3AP1ykXh7HvrinY4zeALleFAJ6cur6qXkpe3B4h/s/vT0IMvxTZzDVMz3i4Pd
-jKFAV6RbM4jygP3LNj4XseODrZj5IM9O/WEjbv8J/E7E9ON05oWDkQbZwAvklaXF
-9ez3C8WAI1q+
------END CERTIFICATE-----

demw-common/overlay/etc/luna/cert/server/sthb-hsm2.sunet.seCert.pem

@@ -0,0 +1,20 @@
+-----BEGIN CERTIFICATE-----
+MIIDMTCCAhmgAwIBAgIBADANBgkqhkiG9w0BAQsFADBcMQswCQYDVQQGEwJDQTEQ
+MA4GA1UECAwHT250YXJpbzEPMA0GA1UEBwwGT3R0YXdhMRYwFAYDVQQKDA1DaHJ5
+c2FsaXMtSVRTMRIwEAYDVQQDDAlzdGhiLWhzbTIwHhcNMjAwMzMwMTE1ODI3WhcN
+MzAwNDAxMTE1ODI3WjBcMQswCQYDVQQGEwJDQTEQMA4GA1UECAwHT250YXJpbzEP
+MA0GA1UEBwwGT3R0YXdhMRYwFAYDVQQKDA1DaHJ5c2FsaXMtSVRTMRIwEAYDVQQD
+DAlzdGhiLWhzbTIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDgdBdk
+uZy+YbKhwwHkFlJispF7wxMChFuuhpGDtDogYYEgGAR9j5aMGuz8t07pNbAX+Oex
+SYENEJYvLKCHXMgitZiDioKcdXCNlOGBJV4Y5dubrS1+ocOmJnr0mJPtm6RzAsIU
+UeqhIcw/JllHYnHHyHQeQprGn2v6l0J9PRwAc12Xja2p/eSvGR3bC4VyMQl9PB1r
+KrPCdGrXfUFpBSdrU2308RvBLNl4tjnaXHcSD7/s26QGHPJSQDqmXYZDl0MiCZi2
+eLm1hP3TAvXbHjE1kYv81zUVYNnANLFZLUHgFZhfMqOM+91sHcOaaeGx1ZtAZZO5
+GFVeAhg7u4PlqLapAgMBAAEwDQYJKoZIhvcNAQELBQADggEBACsHjivOVHSFlKgN
+zHG0CyaKY13YyLRi8PtbDKB5qiJuD7LGjveVal+SD+AIYtG60o9bF3X1xCkNDcLt
+imlfq1L39OawDbEvJZGOLGIqJDfMbEqWIUGiFureQ+4zWBD81iIHUuQ+BPDUU9zu
+xfdkchy9S2wzqP1q7of3wN0HbHj2UdwIIMipyO81bqfwCyW4xjDDRY+L9zMTGOAe
+hoqgjC/ZLYkgfkWp3THWzQ6ZBeYedU97nEaZkXJDsOwseWol9mrL5wuzDCAZjm9J
+LyjLbTDcNn7Gy74sF7nHiRsiW+Kb1zkOisFCE457+0sQFdK/0XhrCug66sBCC673
+z/6pegM=
+-----END CERTIFICATE-----

demw-common/overlay/etc/luna/cert/server/tug-hsm2.sunet.seCert.pem

@@ -0,0 +1,20 @@
+-----BEGIN CERTIFICATE-----
+MIIDLzCCAhegAwIBAgIBADANBgkqhkiG9w0BAQsFADBbMQswCQYDVQQGEwJDQTEQ
+MA4GA1UECAwHT250YXJpbzEPMA0GA1UEBwwGT3R0YXdhMRYwFAYDVQQKDA1DaHJ5
+c2FsaXMtSVRTMREwDwYDVQQDDAh0dWctaHNtMjAeFw0yMDAzMzAxMjEyNTZaFw0z
+MDA0MDExMjEyNTZaMFsxCzAJBgNVBAYTAkNBMRAwDgYDVQQIDAdPbnRhcmlvMQ8w
+DQYDVQQHDAZPdHRhd2ExFjAUBgNVBAoMDUNocnlzYWxpcy1JVFMxETAPBgNVBAMM
+CHR1Zy1oc20yMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAv13NhdzT
+8gnTZ5Gfxp10CFJjxbG+wXsrFtnzqA0o6GRpNiuqPMEoTsUiE5AaqxhLz0N+y618
+YXGQ2wSX0FkjRHVih1e9vmEy1mlNc6x8VRAMaaHotXq58OI1NrotS/nVdVqZDc44
+C74FNhckS4cy4vAamG6j27H+IhnpJEbPI2vzS6ADY7Bdas6/CBwjUrvX8IlxnSpJ
+4LYZ+mEL4DS+SOwo2QGX/wMwi3wXX/4ZwUj5N491me5lCJMB48ixulXu6bpa9yp3
+iFMPPa+886to1AbY1lv86m64daaBlkZSJtSFEjRNCNxqwV0e6DkqZnDfKHRBNNVu
+ggRpD/5MFNanfwIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQC4yhQjdluy9Uq04IKS
+1O4VsC3gJTwJFxkdn9FoyYOBnpBeWVD0cgC/lnWSoqDV7d/EYDaIWhTxYKVZFq1I
+OQ5+66gScfYAPtbNz5QfYtxzXa16HvI8b3SEQDruEsrwDmA+gmC++HFP4L6YLrIB
+5BptWDPvWJO/TLrv44Oc9Ymjdb4RDHgUrWSZ1VznNQl7ILzNJkYbxOwxEuqVu3h8
+yujRM4TYolv6Ipx5/w6pKTOBofuGdcS6WsQJeGR4THy4sh+IfGwCcBSucXkhNvMy
+/sQhcwPWc3sf5SSJzqfkpw53Ay+vPVLbhZVYGojvq7/JaTep8aRnGo/vELm7sUSL
+HZHt
+-----END CERTIFICATE-----

demw-common/overlay/opt/eidas-middleware/configuration/hsm/pkcs11.properties.sh

@@ -3,7 +3,7 @@ hsmExternalCfgLocations=/opt/eidas-middleware/configuration/hsm/demw-sunpkcs11-c
 hsmPin=${PKCS11_PIN}
 hsmLib=/usr/safenet/lunaclient/lib/libCryptoki2_64.so
 hsmProviderName=Luna
-hsmSlot=5
+hsmSlot=6
 keySourceAlias=sc_eidas_sign
 keySourceCertLocation=/opt/eidas-middleware/configuration/credentials/sign.crt
 keySourceAliasEnc=sc_eidas_encrypt

global/overlay/etc/puppet/cosmos-rules.yaml

@@ -713,7 +713,7 @@ demw-1.sveidas.se:
    konsulter:
    autoupdate:
    eidas_de_middleware_hsm:
-      version: 222-sc-p11
+      version: 223-sc-p11_hsm2
       hostname: demw.eidas.swedenconnect.se
    saml_metadata:
       filename: /opt/eidas-middleware/configuration/serviceprovider-metadata/connector-metadata.xml