Failing to connect to HSM instance from EC2 instance: Error: "Failed to initialize E2E with the HSM. TLS negotiation failed. Internal error: error:0A000086:SSL routines:(unknown function):certificate

Question

When connecting to the HSM instance from my EC2 instance (in the same subnet) using cloudhsm-client, I get the following error. I was expecting running `sudo /opt/cloudhsm/bin/configure-cli -a ` would fetch the right certificates from the HSM instance but it did not. I copied the the HSM cluster CA certificate using `aws cloudhsmv2 describe-clusters --region   --query "Clusters[0].Certificates.ClusterCertificate" --output text > /opt/cloudhsm/etc/customerCA.crt`. 
```
Error: "Failed to initialize E2E with the HSM. TLS negotiation failed. Internal error: error:0A000086:SSL routines:(unknown function):certificate verify failed:ssl/statem/statem_clnt.c:1890:."
```

To verify the certificate, I tried connecting using openssl but that failed with the following error:
```
[ec2-user@my-ec2-instance ~]$ openssl s_client -connect :2223   -CAfile /opt/cloudhsm/etc/customerCA.crt   -verify_return_error | tail
depth=0 C = US, ST = Virginia, L = Herndon, O = AWS, OU = AWS Cryptography, CN = CloudHSM, emailAddress = 
verify error:num=18:self signed certificate
139709163591584:error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure:s3_pkt.c:1493:SSL alert number 40
139709163591584:error:140790E5:SSL routines:ssl23_write:ssl handshake failure:s23_lib.c:177:
    Session-ID-ctx:
    Master-Key: 0D5B19181CC11B87B5FF063F3D43C7DE156BED50B732F934F3E869F5E3687EE7E655113EB8BF4D343A9E12BF6D046F43
    Key-Arg   : None
    Krb5 Principal: None
    PSK identity: None
    PSK identity hint: None
    Start Time: 1747801412
    Timeout   : 300 (sec)
    Verify return code: 18 (self signed certificate)
---
[ec2-user@my-ec2-instance ~]$
```

re:Post Agent · Answer

It appears you're experiencing issues connecting to your AWS CloudHSM instance from your EC2 instance. The error messages suggest there are problems with the SSL/TLS certificate verification. Here are some steps to troubleshoot and potentially resolve this issue:

1. Certificate Verification: The error indicates a self-signed certificate issue. Ensure that you have the correct and up-to-date cluster CA certificate. The method you used to obtain the certificate (using the AWS CLI) is correct, but double-check that the certificate content is valid and complete.

2. Certificate Placement: Verify that the certificate file (customerCA.crt) is in the correct location (/opt/cloudhsm/etc/) and has the proper permissions. The CloudHSM client should be able to read this file.

3. CloudHSM Client Configuration: Make sure your CloudHSM client is properly configured. Check the configuration file (typically located at /opt/cloudhsm/etc/cloudhsm-client.cfg) to ensure it has the correct HSM IP address and other necessary settings.

4. Network and Security Group Settings: Confirm that your EC2 instance's security group allows outbound traffic to the HSM on the required ports (usually 2223 for CloudHSM). Also, ensure that the HSM's security group allows inbound traffic from your EC2 instance.

5. CloudHSM Client Version: Ensure you're using the latest version of the CloudHSM client. Outdated versions might have compatibility issues with newer HSM firmware.

6. EC2 Instance Time Sync: Verify that your EC2 instance's time is correctly synchronized. Time discrepancies can cause SSL/TLS negotiation failures.

7. Additional Configuration Files: Check if there are any missing or misconfigured files such as cloudhsm-client.cfg, cloudhsm-client.crt, or cloudhsm-client.key in the /opt/cloudhsm/etc/ directory.

If these steps don't resolve the issue, you may need to regenerate the client certificate and key. You can do this by running:

```
sudo /opt/cloudhsm/bin/configure-cli -a <hsm_ip>
```

This command should fetch the correct certificates from the HSM instance and set up the necessary files.

If you continue to experience issues after trying these steps, it would be advisable to contact AWS support for further assistance. They can provide more specific guidance based on your exact setup and configuration.  
**Sources**  
[Cannot connect to cloudhsm using openssl | AWS re:Post](https://repost.aws/questions/QUZivgIGyAQCu_lWucLM1RCA/cannot-connect-to-cloudhsm-using-openssl)  
[ERROR 2026 (HY000): TLS/SSL error: unable to get local issuer certificate | AWS re:Post](https://repost.aws/questions/QUVXiX7BieRhaB8VuuStGQzA/error-2026-hy000-tls-ssl-error-unable-to-get-local-issuer-certificate)

Failing to connect to HSM instance from EC2 instance: Error: "Failed to initialize E2E with the HSM. TLS negotiation failed. Internal error: error:0A000086:SSL routines:(unknown function):certificate

Add your answer

Relevant content