Is signing using osslsigncode supported with private keys in cloudHSM?

Question

I am trying to sign MSI files on Linux VM (Ubuntu 24.04) using osslsigncode with a private key hosted on CloudHSM instance.  Using pkcs11-tool, I am able to view the labels of the objects stored in cloudHSM instance. I am using the following command to sign the MSI image but the tool crashes with segmentation fault. I am checking what version of osslsigncode is working for folks.

osslsigncode sign \
	     -pkcs11engine "/usr/lib/x86_64-linux-gnu/engines-3/pkcs11.so" \
	     -pkcs11module "/opt/cloudhsm/lib/libcloudhsm_pkcs11.so" \
	     -certs "${CERT_PATH}" \
	     -key "pkcs11:object=${LABEL};type=private" \
	     -pass "${PKCS11_PIN}" \
	     -n "${APP_NAME)" \
	     -i "${APP_URL}" \
	     -in "${INPUT_MSI}" \
	     -out "${OUTPUT_MSI}" \
	     -ts https://timestamp.digicert.com

Saul Torres Salazar · Answer

Hi there, 
Yes, signing using osslsigncode is supported with private keys stored in AWS CloudHSM, but there are some important considerations:

**Requirements:**
CloudHSM PKCS#11 library must be properly configured
The private key must be accessible through PKCS#11 interface
osslsigncode must be compiled with PKCS#11 support

**Documented Support:**
AWS CloudHSM supports PKCS#11 standard operations including digital signatures
osslsigncode can work with PKCS#11 tokens/HSMs as documented in their repository.

**Recommended versions:**
Version 2.5 or higher of osslsigncode is the most stable for working with PKCS#11
Avoid using versions earlier than 2.0 as they may have compatibility issues with CloudHSM

I hope this help.

Is signing using osslsigncode supported with private keys in cloudHSM?

Add your answer

Relevant content