AWS CloudHSM

Use AWS CloudHSM to hold a DigiCert OV or EV code signing private key. Generate the key on the HSM with CloudHSM CLI (Client SDK 5), create a CSR with the OpenSSL CloudHSM engine, order from GeoCerts with Install on HSM, then associate the issued certificate with that key.

Prerequisites

  • Working CloudHSM cluster with at least one HSM
  • AWS CloudHSM Client SDK 5 on the signing host, including CloudHSM CLI and the OpenSSL Dynamic Engine
  • A Crypto User (CU) on the HSM
  • Cluster connected (cloudhsm-cli interactive session or equivalent)

Cluster setup: AWS CloudHSM User Guide.

1. Generate an RSA key pair

Start CloudHSM CLI, log in as the CU, then generate a persistent RSA key with sign enabled. Use 3072 or 4096 bits (3072 minimum for current public code signing).

/opt/cloudhsm/bin/cloudhsm-cli interactive

login --username <cu-username> --role crypto-user

key generate-asymmetric-pair rsa \
  --public-exponent 65537 \
  --modulus-size-bits 3072 \
  --public-label MyCodeSignPub \
  --private-label MyCodeSignKey \
  --private-attributes sign=true extractable=false

Confirm attributes (sign=true on the private key). If sign is false, generate a new pair—you cannot flip it later for CSR/signing.

key list --filter attr.label=MyCodeSignKey

2. Create a CSR with OpenSSL

Export a reference PEM (pointer to the HSM key—not the private key material), then run openssl req with the CloudHSM engine.

key generate-file \
  --encoding reference-pem \
  --path /home/user/MyCodeSignKey.pem \
  --filter attr.label=MyCodeSignKey

openssl req -engine /opt/cloudhsm/lib/libcloudhsm_openssl.so \
  -new \
  -key /home/user/MyCodeSignKey.pem \
  -out /home/user/MyCodeSignCert.csr \
  -subj "/CN=Your Organization Name"

On OpenSSL 3.x you may need to load the engine from an openssl.cnf (see AWS re:Post) or use the CloudHSM provider instead of the legacy engine.

EKU in the CSR is optional. CloudHSM often cannot put Extended Key Usage on the CSR. DigiCert adds the Code Signing EKU (1.3.6.1.5.5.7.3.3) when it issues OV or EV code signing.

3. Order from GeoCerts

  1. Log in to CertCommand → New Certificate.
  2. Choose OV Code Signing or EV Code Signing.
  3. Select Install on HSM so DigiCert does not ship a token or provision KeyLocker.
  4. Paste the CSR. Complete validation and any HSM attestation email.

EV identity checks can take extra business days.

4. Download the issued certificate

In CertCommand, open the order → Download Certificate Files. Use PEM (.crt / .pem) or PKCS #7 (.p7b). PEM is usually easier to consume with OpenSSL and CloudHSM tooling. Include the intermediate chain if you import a chain separately.

5. Use the certificate with the HSM key

The private key never leaves CloudHSM. Signing tools must use PKCS #11, JCE, or the OpenSSL engine/provider against that key label.

Keep the issued certificate file next to your PKCS #11 / OpenSSL config so the tool can present the leaf + chain. The public key in the certificate must match MyCodeSignKey.

On reissue or renewal, generate the new CSR from the same private key unless you intend to rotate keys.

Sign

Microsoft SignTool (Windows + PKCS #11 / KSP)

If the CloudHSM KSP or PKCS #11 provider is installed on Windows:

signtool sign /fd SHA256 /td SHA256 /tr http://timestamp.digicert.com /n "Your Organization Name" /v yourApp.exe

See Windows (SignTool).

jarsigner (PKCS #11)

jarsigner -keystore NONE -storetype PKCS11 \
  -providerClass sun.security.pkcs11.SunPKCS11 \
  -providerArg pkcs11.cfg \
  -tsa http://timestamp.digicert.com \
  -signedjar SignedApp.jar UnsignedApp.jar MyCodeSignKey

See Java (jarsigner).

Notes

  • Never export the private key from CloudHSM.
  • RSA 3072 or 4096 (or ECC P-256+) for public CS / EV.
  • DigiCert supplies the Code Signing EKU even if the CSR omitted it.
  • AWS cluster and CU setup is out of scope here—use the AWS CloudHSM User Guide.

← Back to Cloud HSM