mode51software / vaultplugin-hsmpki Goto Github PK

The Vault HSM PKI plugin overlays the modifications to the builtin PKI plugin that enable support for certificate signing using a Hardware Security Module via PKCS#11.

Home Page: https://www.vaultproject.io/docs/plugin-portal

License: Mozilla Public License 2.0

Makefile 0.49% Shell 0.22% Go 98.95% HCL 0.33%

hardware-security-module hsm pki vault-plugin vault-plugins

vaultplugin-hsmpki's People

Contributors

Stargazers

Watchers

Forkers

quinndiggity ehrhardt v1sion evitch invizus hasnainvirk

vaultplugin-hsmpki's Issues

Add GenerateRoot GenerateIntermediate SignIntermediate paths

https://www.vaultproject.io/api-docs/secret/pki#generate-root

backend test cases connection broken

Connection failure also needs tidying

Add SignVerbatim path

Delete path should flush cached key metadata

key label, type and size

Replace hard coded key types in CA generation

CA key label retrieval from storage not properly loaded if not set in conf

Missing INSTALL.md

Implement better detection of whether in metadata mode or actual startup

https://groups.google.com/g/vault-tool/c/z6iaU_B159A/m/mJxly7qCCQAJ

hashicorp/vault#8090

TestSetSignedIntermediate doesn't load the data

Do a connection check on each HSM path call

Add CRL Rotate and Tidy paths

https://www.vaultproject.io/api-docs/secret/pki#tidy

Needs hsmcrl_util buildCRL wiring

Add Sign Self Issued path

Add back in support for RSA keys in Generate Root

Hard coded to EC currently

Replace key_alias with key_label

For consistency with conf file, and in ref to CKA_LABEL

CKR_ATTRIBUTE_VALUE_INVALID while generating keys with AWS CloudHSM

Hi @mode51software, great work on the plugin btw!!
Was trying to use the plugin to generate keys on the AWS cloudHSM, but I'm getting a CKR_ATTRIBUTE_VALUE_INVALID during the key creation.

> vault write hsm-pki/root/generate/internal common_name="Root CA" ttl=87600h
Error writing data to hsm-pki/root/generate/internal: Error making API request.

URL: PUT http://127.0.0.1:8200/v1/hsm-pki/root/generate/internal
Code: 400. Errors:

* pkcs11: 0x13: CKR_ATTRIBUTE_VALUE_INVALID

plugin config:

lib = "/opt/cloudhsm/lib/libcloudhsm_pkcs11.so"
slot_id = 1
pin = "vault_user:xxxxxx"
key_label = "vault"
connect_timeout_s = 10
read_timeout_s = 5

By its documentation, CloudHSM does not support all attributes https://docs.aws.amazon.com/cloudhsm/latest/userguide/pkcs11-attributes.html, https://docs.aws.amazon.com/cloudhsm/latest/userguide/ki-pkcs11-sdk.html, but I'm able to generate the keys using the pkcs11-tool, even though there is a similar warning, but the keys are created.

> pkcs11-tool --module /opt/cloudhsm/lib/libcloudhsm_pkcs11.so --login --pin "vault_user:xxxxx" --keypairgen --key-type rsa:2048  --label 'test7'
Using slot 0 with a present token (0x1)
Key pair generated:
Private Key Object; RSA
  label:      test7
  Usage:      decrypt, sign
C_GetAttributeValue failed with error CKR_ATTRIBUTE_TYPE_INVALID : 0x00000012
, unwrap
Public Key Object; RSA 2048 bits
  label:      test7
  Usage:      encrypt, verify, wrap

Any idea what could be?