Cannot connect to cloudhsm using openssl

Question

I'm trying to connect to my HSM using openssl. When I try I get this:

```
$ openssl engine -t cloudhsm
(cloudhsm) CloudHSM OpenSSL Engine
2025-04-09T00:34:01.318Z ERROR [5801] ThreadId(3) [cloudhsm_provider::hsm1::hsm_connection::error][][] Handshake failed. Message: HSM returned an error during E2E handshake.
2025-04-09T00:34:01.318Z ERROR [5801] ThreadId(3) [cloudhsm_provider::hsm1::connection::connection_pool][][] Failed to connect to HSM 10.0.10.113:2223 with internal error: HSM is disconnected
2025-04-09T00:34:01.318Z ERROR [5801] ThreadId(3) [cloudhsm_provider::hsm1::connection::connection_pool][][] Not enough HSMs are created successfully. Required 1, created 0.
Failed to initialize OpenSSL engine, Internal Error: HSM is disconnected
2025-04-09T00:34:01.319Z ERROR [5801] ThreadId(3) [cloudhsm_openssl_engine::bind::binding_function][][] init_engine failed, returning 0
     [ unavailable ]
```

I have set the `CLOUDHSM_PIN` environment variable, I checked `cloudhsm-dyn.cfg`, `customerCA.crt` exists and is correct.

I know the networking and TLS are working because I'm able to connect with `cloudhsm-cli` and create keys.

I just need to create a CSR with `openssl` but I can't, because I can't get the dynamic engine working.

koehn · Accepted Answer

It turned out that the `cloudhsm-dyn.cfg` and `cloudhsm-pkcs11.cfg` files were missing the `client_cert_hsm_tls_path` and `client_key_hsm_tls_path` properties. I copied them from `cloudhsm-cli.cfg` and they started working.

re:Post Agent · Answer

It appears that you're experiencing a connection issue between OpenSSL and your AWS CloudHSM cluster. The error message suggests that the OpenSSL engine is unable to establish a connection with the HSM. Here are some steps you can take to troubleshoot and potentially resolve this issue:

1. Check the IP address: Ensure that the IP address specified in your CloudHSM client configuration file is correct and points to an active, reachable HSM in your cluster. The configuration file is typically located at `/opt/cloudhsm/etc/cloudhsm-client.cfg`. If the IP address is incorrect or the HSM is no longer available, update the configuration with a valid IP address of an active HSM in your cluster.

2. Verify client configuration: Double-check that your CloudHSM client is properly configured. This includes ensuring that the `cloudhsm-client` daemon is running and that the client can communicate with the HSM cluster.

3. Check HSM status: Verify that your HSM cluster is active and that there is at least one HSM available. You can do this using the AWS CloudHSM console or the AWS CLI.

4. Restart the client: Try stopping and restarting the CloudHSM client daemon. This can sometimes resolve connection issues.

5. Check OpenSSL version compatibility: Ensure that your OpenSSL version is compatible with the AWS CloudHSM OpenSSL Dynamic Engine. Some older versions of OpenSSL may not be supported.

6. Verify engine location: Confirm that the CloudHSM OpenSSL engine shared library is correctly installed at `/opt/cloudhsm/lib/libcloudhsm_openssl.so`.

7. Review logs: Check the CloudHSM client logs for any additional error messages or clues about the connection failure.

If you've verified all these points and are still experiencing issues, you may need to contact AWS support for further assistance. They can help diagnose any potential problems with your HSM cluster or network configuration that might be preventing the OpenSSL engine from connecting successfully.  
**Sources**  
[Lost connection to the AWS CloudHSM cluster - AWS CloudHSM](https://docs.aws.amazon.com/cloudhsm/latest/userguide/troubleshooting-lost-connection.html)  
[Use the OpenSSL Dynamic Engine for AWS CloudHSM Client SDK 3 - AWS CloudHSM](https://docs.aws.amazon.com/cloudhsm/latest/userguide/openssl3-use-library.html)  
[AWS CloudHSM error seen during key availability check - AWS CloudHSM](https://docs.aws.amazon.com/cloudhsm/latest/userguide/troubleshoot-key-availability-check.html)

Cannot connect to cloudhsm using openssl

Add your answer

Relevant content