Adding CLOUDHSM as a provider for use with keytool?

Question

Hello,

I am trying to use keytool to import a working certificate into cloudHSM. I looked at
https://docs.aws.amazon.com/cloudhsm/latest/userguide/using_keystore_with_keytool_5.html and https://docs.aws.amazon.com/cloudhsm/latest/userguide/import_working_cert_using_keytool_5.html
but I am not able to get keytool to recognize the store type CLOUDHSM. I followed the instructions on https://docs.aws.amazon.com/cloudhsm/latest/userguide/keystore-prerequisites_5.html and added 
security.provider.10=com.amazonaws.cloudhsm.jce.provider.CloudHsmProvider to java.security.

When I try to list the providers using the following Java program, I do not see CLOUDHSM or anything remotely similar to that.
```
public class ListProviders {
    public static void main(String[] args) {
        for (Provider provider : Security.getProviders()) {
            System.out.println("Provider: " + provider.getName() + " (" + provider.getInfo() + ")");
            for (Provider.Service service : provider.getServices()) {
                if (service.getType().equals("KeyStore")) {
                    System.out.println("  KeyStore Type: " + service.getAlgorithm());
                }
            }
        }
    }
}
```

What am I missing?

Thank you,
CK

re:Post Agent · Answer

When using keytool with AWS CloudHSM, you need to specify the CloudHSM key store type and Java classpath directly in your keytool command rather than expecting it to appear in your system's default providers list.

For keytool commands with AWS CloudHSM, you should include these specific arguments:

For Linux:
```
-storetype CLOUDHSM -J-classpath '-J/opt/cloudhsm/java/*'
```

For Windows:
```
-storetype CLOUDHSM -J-classpath '-J"C:\Program Files\Amazon\CloudHSM\java\*"'
```

The CloudHSM provider isn't registered as a standard KeyStore provider that would appear in your provider list. Instead, the `-J-classpath` argument dynamically adds the CloudHSM Java libraries to the classpath when keytool runs, making the CLOUDHSM store type available for that specific command execution.

For example, to import a certificate, your full command would look like:

```
keytool -importcert -noprompt -alias  \
-file my_certificate.crt \
-keystore example_keystore.store \
-storetype CLOUDHSM \
-J-classpath '-J/opt/cloudhsm/java/*'
```

This approach allows keytool to recognize and use the CLOUDHSM store type for that specific command execution without requiring it to be permanently registered in your system's provider list.  
**Sources**  
[Use AWS CloudHSM key store with keytool using Client SDK 5 - AWS CloudHSM](https://docs.aws.amazon.com/cloudhsm/latest/userguide/using_keystore_with_keytool_5.html)  
[Import a working certificate into AWS CloudHSM key store using keytool - AWS CloudHSM](https://docs.aws.amazon.com/cloudhsm/latest/userguide/import_working_cert_using_keytool_5.html)

Adding CLOUDHSM as a provider for use with keytool?

Add your answer

Relevant content