Configure the cloudhsm-client
To configure the CloudHSM client cloudhsm-client, do the following:
- SSH into the SignServer instance.
- Copy your issuing certificate (the one that you used to sign the cluster's certificate) to the following location on the client instance:
/home/ec2-userand you may also move or copy it to this location.
Stop the cloudhsm-client
# sudo stop cloudhsm-client or # sudo service cloudhsm-client stop
Use the following command to update the configuration files for the AWS CloudHSM client and command line tools, specifying the IP address of the HSM in your cluster.
If you don't know the HSM's IP address, view your cluster in the AWS CloudHSM console.
# sudo /opt/cloudhsm/bin/configure -a <IP address> Updating server config in /opt/cloudhsm/etc/cloudhsm_client.cfg Updating server config in /opt/cloudhsm/etc/cloudhsm_mgmt_util.cfg
Start the CloudHSM client:
# sudo start cloudhsm-client or # sudo service cloudhsm-client start
- Ensure the cloudhsm_mgmt_util configuration file is up to date. We need to do this to ensure cloudhsm_mgmt_util is aware of all the HSM instances in the cluster.
# sudo /opt/cloudhsm/bin/configure -m
- Connect to the HSM instances, enable end-to-end encryption, and log in to the HSM instances. Enabling end-to-end encryption encrypts the communication between cloudhsm_mgmt_util and the HSM to prevent interception of sensitive information such as passwords:
# /opt/cloudhsm/bin/cloudhsm_mgmt_util /opt/cloudhsm/etc/cloudhsm_mgmt_util.cfg aws-cloudhsm> enable_e2e