Hệ thống IBM Cloud HSM IBM Cloud HSM ក្រុមហ៊ុន IBM Cloud HSM

vm$ ssh admin@hsm


[cloudflare-hsm.softlayer.com] lunash:>partition create -partition KeylessSSL


          Type 'proceed' to create the partition, or

          'quit' to quit now.

          > proceed

'partition create' successful.


Command Result : 0 (Success)

[cloudflare-hsm.softlayer.com] lunash:>client assignpartition -client cloudflare-vm.softlayer.com -partition KeylessSSL


'client assignPartition' successful.


Command Result : 0 (Success)

vm$ lunacm

LunaCM v7.1.0-379. Copyright (c) 2006-2017 SafeNet.


    Available HSMs:


    Slot Id ->              0

    Label ->

    Serial Number ->        XXXXXXXXXXXXX

    Model ->                LunaSA 7.0.0

    Firmware Version ->     7.0.1

    Configuration ->        Luna User Partition With SO (PW) Signing With Cloning Mode

    Slot Description ->     Net Token Slot


    Current Slot Id: 0


lunacm:>partition init -label KeylessSSL -domain cloudflare


  Enter password for Partition SO: ********


  Re-enter password for Partition SO: ********


  You are about to initialize the partition.

  All contents of the partition will be destroyed.


  Are you sure you wish to continue?


  Type 'proceed' to continue, or 'quit' to quit now ->proceed


Command Result : No Error

vm$ cmu generatekeypair -keyType=RSA -modulusBits=2048 -publicExponent=65537 -sign=1 -verify=1 -labelpublic=myrsakey -labelprivate=myrsakey -keygenmech=1  -id=a000

Please enter password for token in slot 0 : ********


# cmu generatekeypair -keyType=ECDSA -curvetype=3 -sign=1 -verify=1 -labelpublic=myecdsakey -labelprivate=myecdsakey -id=a001

Please enter password for token in slot 0 : ********


# cmu list

Please enter password for token in slot 0 : ********

handle=61   label=myecdsakey

handle=60   label=myecdsakey

handle=48   label=myrsakey

handle=45   label=myrsakey

# cmu requestCertificate -c="US" -o="Example, Inc." -cn="ibm-cloudhsm.example.com" -s="California" -l="San Francisco" -publichandle=45 -privatehandle=48 -outputfile="rsa.csr" -sha256withrsa

Please enter password for token in slot 0 : ********

Using "CKM_SHA256_RSA_PKCS" Mechanism


# cmu requestCertificate -c="US" -o="Example, Inc." -cn="ibm-cloudhsm.example.com" -s="California" -l="San Francisco" -publichandle=60 -privatehandle=61 -outputfile="ecdsa.csr" -sha256withecdsa

Please enter password for token in slot 0 : ********

Using "CKM_ECDSA_SHA256" Mechanism

private_key_stores:

  - dir: /etc/keyless/keys

- uri: pkcs11:token=KeylessSSL;object=myrsakeyid=a000??module-path=/usr/safenet/lunaclient/lib/libCryptoki2_64.so&pin-value=password&max-sessions=1

- uri: pkcs11:token=KeylessSSL;object=myecdsakeyid=a001??module-path=/usr/safenet/lunaclient/lib/libCryptoki2_64.so&pin-value=password&max-sessions=1

sudo systemctl restart gokeyless.service

sudo systemctl status gokeyless.service -l

{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/ssl/","name":"SSL/TLS"}},{"@type":"ListItem","position":3,"item":{"@id":"/ssl/keyless-ssl/","name":"Keyless SSL"}},{"@type":"ListItem","position":4,"item":{"@id":"/ssl/keyless-ssl/hardware-security-modules/","name":"Hardware security modules"}},{"@type":"ListItem","position":5,"item":{"@id":"/ssl/keyless-ssl/hardware-security-modules/ibm-cloud-hsm/","name":"IBM Cloud HSM"}}]}