My CA is stored on a Nitrokey HSM2 which requires m-of-n authentication, using other HSM2. In order to protect from device failure or loss, I would like to: be able to use the CA with a secondary CA HSM, identical to the first one give my colleagues the ability to use PKIAAS with their own person…

The “Add Token” adds a HSM to the Trust Center, e.g. to store trust center keys. This has nothing to do with the personal token used to authenticate in the portal. Personal token for authentication must be either added in self-registration or by enrolling a person in the trust center (“CA / Enroll …

So, I did add an authentication token to the trustcenter, and associated with the appropriate CA. Then, I went to the new subject, clicked “Subject / Manage roles”. I selected all roles and clicked “save” then “apply”. After logout, I tried to loggin with this new key, and still have the same erro…

What do mean by “So, I did add an authentication token to the trust center, and associated with the appropriate CA.” ? If you mean by “authentication token” the token that contains the authentication key for Public Key Authentication towards the trust center HSM, then that does not play a role in t…

Loggin into the portal What do mean by “So, I did add an authentication token to the trust center, and associated with the appropriate CA.” ? I mean I expect any of the other key custodians to be able to connect to PKIAAS with their own HSM, so that they can use the CA without me, as long as the …

It should work, if user 3 has the role Certification Officer and the HSM is unlocked. Did user 3 do a fresh login after granting the role ? I will check here if there is a bug.

Just checked it, works like designed. Maybe the HSM lost the authentication state ? We are often seeing this on Windows. When the HSM token is connected to the portal and you insert an additional token, then Windows Plug&Play mechanism touches the session between the HSM token and the portal. This…

Did user 3 do a fresh login after granting the role ? Yes, this happens after a fresh login. I did more tests, attaching the CA HSM as “HSM 0” and the personnal HSMs as “HSM 1” in ocf, so that the CA device would not be affected by unplugging personnal HSMs. Didn’t work. I thought maybe it coul…

The certificates on the HSM and in the portal are DER encoded. You need to use “-inform der” to read those in OpenSSL. Just to understand what you are trying to do: You have two HSMs for the CA, both initialized with the same DKEK Key Domain, so that key material can be share between the devices. …

The certificates on the HSM and in the portal are DER encoded. You need to use “-inform der” to read those in OpenSSL It looks like the output is not correct then. I clicked “Export Certificate” in Smart Card Shell (as per the screenshot below) and got a file with a .pem extension, containing the…

Sorry, got it wrong: The certificate you created is in the portal only and can be downloaded in DER format. The Smart Card Shell supports PEM Format, but the certificate you are seeing is not the X.509 certificate from the portal, but the CVC certificate for public key attestation. That format is no…

Nitrokey Support

Avoid single point of failure with PKIAAS

Nitrokeys HSM

sc-hsm March 14, 2025, 8:42am 19

We are still working on it.

User experience with Nitrokey HSM2 for a root CA