Importing Certificate signed using CloudHSM key on Linux into a Windows instance using the CloudHSM KSP

Yes, it is possible to import an existing certificate that was signed using a CloudHSM key on Linux into a Windows instance using the CloudHSM KSP. Here's how you can do it:

1. First, you need to import the certificate into the Windows certificate store. You can do this using the Windows Certificate Import Wizard or by using the certutil command-line tool.

2. Once the certificate is in the Windows certificate store, you need to associate it with the private key in the CloudHSM. This is where the CloudHSM Key Storage Provider (KSP) comes into play.

3. Use the import_key.exe utility, which is included in CloudHSM version 3.0 and higher, to import the key's metadata into the local certificate store and associate it with the certificate.

4. To use import_key.exe, you'll need to know the Unique Container Name and Serial Number of the certificate. You can find these using a utility like certutil.

5. Run the import_key.exe utility to associate the AWS CloudHSM private key with the certificate. The command will look something like this:

   import_key.exe --cavium-pkcs11 --token-label <HSM user name> --token-pin <HSM user password> --key-label <key label> --cert-label <certificate label>

6. After associating the key, update the certificate store using certutil to ensure the changes are reflected.

Once you've completed these steps, you should be able to use the imported certificate with signtool.exe for code signing on your Windows instance, just as you were using it with jarsigner on Linux.

Remember, the key itself remains securely stored in the CloudHSM, while the certificate and the association between the certificate and the key are managed by the Windows certificate store and the CloudHSM KSP.
Sources
Associate an AWS CloudHSM key with a certificate - AWS CloudHSM
Use Microsoft SignTool with Client SDK 5 to sign files - AWS CloudHSM