Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

Configure CloudHSM SDK on a local machine

0

I want to run a signtool command on my local windows development machine that uses a code signing certificate which points to it's private key over AWS CloudHSM Cluster. Currently I am not able to configure AWS CloudHSM SDK to enable that code signing certificate sees it's private key.

Thanks

Topics
Security, Identity, & Compliance
Tags
AWS CloudHSM
Language
English
asked 15 days ago30 views
1 Answer
1

To configure AWS CloudHSM SDK on your Windows development machine for code signing with SignTool, you'll need to follow these steps:

  1. Install the AWS CloudHSM Client SDK on your Windows development machine.

  2. Configure the CloudHSM CLI by specifying the location of your customer CA certificate:

& "C:\Program Files\Amazon\CloudHSM\bin\configure-cli.exe" --hsm-ca-cert <customerCA certificate file>

This certificate should be the self-signed certificate used to initialize your CloudHSM cluster.

  1. Create a key pair in AWS CloudHSM and generate the corresponding certificate. You can use the Windows Certreq application for this, which supports the Key Storage Provider (KSP) standards and works with the AWS CloudHSM KSP that was installed as part of the client installation.

  2. After obtaining the signed certificate from your Certificate Authority, export it to a file (e.g., as a DER encoded binary X.509 file).

  3. Import the certificate into your Windows Personal Certificate Store by running:

certreq.exe -accept signedCertificate.cer

You can verify it exists by running certlm.msc and viewing the Personal Certificates.

  1. Associate the AWS CloudHSM key with the certificate using the import_key.exe utility (included in CloudHSM version 3.0 and higher). This step is crucial for importing the key's metadata into the local certificate store and associating it with your certificate.

  2. Once the association is complete, you should be able to use Microsoft SignTool with your CloudHSM-backed certificate by referencing the SHA-1 hash of your certificate.

This configuration allows your code signing certificate to see its private key stored in the CloudHSM cluster, enabling secure signing operations where the private key never leaves the HSM.
Sources
Signing executables with Microsoft SignTool.exe using AWS CloudHSM-backed certificates | AWS Security Blog
AWS CloudHSM Client SDK 5 configuration examples - AWS CloudHSM
Associate an AWS CloudHSM key with a certificate - AWS CloudHSM

answered 15 days ago
  • Akram Mahmoud
    15 days ago

    I called configure-cli.exe as specified above & followed the steps but got

    Cfm2LoginHSM failed:-40000040 Failed to represent keypairs in Cavium Key Storage Provider

    Error when tried to run import_key -from HSM -all

    Is there a way to check connectivity between my local machine & CloudHSM? ... I am connected already with a VPN

    Or that error because if an issue in my user privileges? ... already I set the password by n3fips_password command for a Crypto User.

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content