Migration from cloudhsm sdk3 to sdk5 for JCE

When migrating from AWS CloudHSM Client SDK 3 to Client SDK 5 for JCE, there are several important changes to consider.

For your configuration file issue, the error suggests that your cloudhsm-jce.cfg file doesn't match the required format for Client SDK 5. The configuration file should follow a specific structure. The "a" parameter in your configuration appears incorrect - this should likely be an HSM IP address parameter with a proper name.

Here are the key steps for migrating from Client SDK 3 to Client SDK 5 for JCE:

1. Prepare for breaking changes:

• The provider class has changed from CaviumProvider (SDK 3) to CloudHsmProvider (SDK 5)
• The provider name has changed from Cavium to CloudHSM
• Login mechanisms have changed - SDK 3 used LoginManager while SDK 5 implements AuthProvider
• Key generation parameters have changed from Cavium[Key-type]AlgorithmParameterSpec to KeyAttributesMap
• Key referencing has changed from handles to labels, using KeyStoreWithAttributes to find keys
• Cipher unwrap operations have different parameter specifications

2. Migration process:

• Uninstall the JCE provider and Client Daemon for Client SDK 3
• Install the Client SDK 5 JCE provider
• Bootstrap the Client SDK 5 JCE provider with the new configuration format
• Test your application in a development environment and update code to resolve breaking changes

Note that certain platforms (Amazon Linux, Ubuntu 16.04, Ubuntu 18.04, CentOS 6, CentOS 8, and RHEL 6) are not supported with Client SDK 5. If you're currently using one of these platforms, you'll need to choose a different platform when migrating.

I recommend testing your application thoroughly after migration to ensure all cryptographic operations work as expected.
Sources
Migrate your JCE provider from AWS CloudHSM Client SDK 3 to Client SDK 5 - AWS CloudHSM
Migrating from AWS CloudHSM Client SDK 3 to Client SDK 5 - AWS CloudHSM