Hello Nitrokey,
Your devices look interesting…
I am looking for a solution to store an private key on an external device (“HSM”) to be used as part of a code signing procedure we are implementing.
Most preferable the solution can work as part of a software build chain for automatic signing of java archives.
Right now we have the issue that the private key used for signing is accessible for everyone that has access to the build servers.
This is bad, so the solution we are looking for should be able to protect the private key.
Java keystores won’t solve that as long as you have the password as you are able export everything with that password.
Being less known with all api’s around smart cards, the question is: are your smart-card api’s accessible from Java for the purpose of signing?
Awaiting your answer and best regards,
Bram Doornbos
