Getting connection error when trying to connect to CloudHSM through cloudhsm-cli

The error you're encountering suggests there's a connection issue between your CloudHSM CLI and the HSM cluster. Here are some steps to troubleshoot and potentially resolve this issue:

1. Verify the HSM IP address: Ensure that the IP address specified in your CloudHSM client configuration file is correct and points to an active HSM in your cluster. The configuration file is typically located at /opt/cloudhsm/etc/cloudhsm-client.cfg.

2. Check network connectivity: Make sure there are no network issues preventing communication between your client and the HSM. Verify that the necessary ports (especially 2223) are open in your security groups and network ACLs.

3. Validate the customerCA.crt: Although you mentioned it's set up properly, double-check that the certificate is in the correct location and has the proper permissions.

4. Restart the CloudHSM client: Try stopping and restarting the CloudHSM client daemon. This can sometimes resolve connection issues.

5. Check HSM status: Verify that your HSM cluster is indeed active and initialized as you mentioned. Sometimes the cluster state might change unexpectedly.

6. Review client version compatibility: Ensure that your CloudHSM CLI version is compatible with your HSM cluster version.

7. Check system time: Ensure that your system time is correctly synchronized. Time discrepancies can cause handshake failures.

8. Examine CloudHSM client logs: Look for additional error messages or clues in the CloudHSM client logs.

If these steps don't resolve the issue, you may need to contact AWS support for further assistance. They can help diagnose any potential problems with your HSM cluster or network configuration that might be preventing the CloudHSM CLI from connecting successfully.
Sources
Cannot connect to cloudhsm using openssl | AWS re:Post

Based on the error logs, it appears you're experiencing an E2E (End-to-End) handshake failure when trying to connect to CloudHSM. Here are some steps to troubleshoot:

1. Verify Certificate Setup:

   • Ensure customerCA.crt is in the correct location: /opt/cloudhsm/etc/customerCA.crt
   • Check certificate permissions: ls -l /opt/cloudhsm/etc/customerCA.crt

2. Check Network Connectivity:

   • Verify the HSM IP is reachable: ping <hsm-ip>
   • Check if port 2223 is accessible: telnet <hsm-ip> 2223
   • Verify no firewall rules are blocking the connection

3. Validate Cluster State:

   • Use AWS Console or AWS CLI to confirm the HSM is truly active
   • Check cluster health: aws cloudhsmv2 describe-clusters

4. Check Configuration:

   • Verify the configuration file: /opt/cloudhsm/etc/cloudhsm-cli.cfg
   • Ensure it contains the correct HSM IP and port

5. Common Solutions:

   • Try restarting the CloudHSM client service:

     sudo service cloudhsm-client stop
     sudo service cloudhsm-client start

• Verify you're using compatible versions of the client and CLI
• Check if the HSM needs to be reactivated

If these steps don't resolve the issue, please check the CloudHSM client logs for additional error messages:

bash
sudo tail -f /opt/cloudhsm/run/cloudhsm_client.log