Keytool usage with existing keys

if keys were already created in CloudHSM using keytool or other methods, they can be imported into a new CloudHSM keystore.

To do this:

• Create a new empty CloudHSM keystore and load it.

• Use the key_mgmt_util importPrivateKey command to import each existing private key file into the HSM, specifying the new keystore alias.

• The public key certificate corresponding to each private key can then be imported into the new keystore using keytool -importcert

• Save the keystore to persist the imported keys. The keystore can then be reloaded as needed to access the imported keys.

https://docs.aws.amazon.com/cloudhsm/latest/userguide/alternative-keystore.html

https://docs.aws.amazon.com/cloudhsm/latest/userguide/manage-keys.html