Cloud HSM daemon not starting

Question

Hello , AWS newbie here.

I've followed this guide:
https://docs.aws.amazon.com/cloudhsm/latest/userguide/configure-sdk-3.html
Done all steps in "Getting started" (excluding optional ones).

Managed to create a CU (Crypto User) via CloudHSM CLI from an EC2 instance.

But I'd like to use the KMU (Key Management Utility) , having found SDK 3 and 5 and not compatible, I've uninstalled CloudHSM CLI and installed CloudHSM Client.

I've placed the `customerCA.crt` file in `/opt/cloudhsm/etc` and configured IP of HSM with `sudo /opt/cloudhsm/bin/configure -a `

Now when I do `sudo systemctl start cloudhsm-client` it doesnt start.
I check `sudo systemctl status cloudhsm-client` and it shows exited with code 127.

How do I solve this ? Any help is greatly appreciated !

Answer

Hi,

In most cases when the client daemon does not want to start, it is generally due to a permissions error in the /opt/cloudhsm/etc directory. Therefore, can you check the permissions using the following command:

```
$ ls -l /opt/cloudhsm/etc/
```

All of the files in that directory should be at least 644, and the "certs" directory should be 755. The files in the "certs" directory should also be 644. What’s important is that “Others” must have read permissions because the hsmuser is not a part of the root group.

**Note**: The "client.crt" and "client.key" files can be 755 or 644, as long as "Others" has read permissions.

A working example of the correct permissions looks like this:

drwxr-xr-x. 2 root root   42 Oct 26 15:37 certs
-rwxr-xr-x. 1 root root 1342 Oct  8 16:17 client.crt
-rwxr-xr-x. 1 root root 1704 Oct  8 16:17 client.key
-rw-r--r--. 1 root root 1145 Oct 26 15:45 cloudhsm_client.cfg
-rw-r--r--. 1 root root 1140 Oct  8 16:17 cloudhsm_client.cfg.old
-rw-r--r--. 1 root root 1255 Oct 26 15:46 cloudhsm_mgmt_util.cfg
-rw-r--r--. 1 root root  719 Oct 26 15:45 cloudhsm_mgmt_util.cfg.old
-rw-r--r--. 1 root root  600 Oct  8 16:17 cloudhsm_mgmt_util.cfg.old.1
-rw-r--r--. 1 root root 1265 Oct 26 15:37 customerCA.crt

To change the permissions of the file, you can use chmod. For example, this command changes the permissions on the "cloudhsm_client.cfg" file to 644 (-rw-r--r--).

```
$ sudo chmod 644 /opt/cloudhsm/etc/cloudhsm_client.cfg
```

Alternatively, you can also attempt to use the following command to check/change the file system permissions under /opt/cloudhsm:

```
sudo chmod go+rX -R /opt/cloudhsm
```

Once this is done, please attempt to start the daemon again.

If you can confirm that the permissions as shown above is indeed correct, we would then require details that are non-public information. Please open a support case with AWS using the following link so that we can perform a deep dive into your issue:

[https://console.aws.amazon.com/support/home#/case/create]()

Cloud HSM daemon not starting

Relevant content