search

aws-samples / aws-cloudhsm-jce-examples

Sample applications demonstrating how to use the CloudHSM JCE
MIT No Attribution
36 stars 56 forks source link

How to sync AWS Cloud HSM keystore file across application on different aws instances? #65

Open arjunballa opened 1 year ago

arjunballa commented 1 year ago

Requirement: We have an application running on more than one instance in a cluster that uses key pairs, certificates, and symmetric keys which are preloaded in AWS Cloud HSM.

What is the best way to provide the local keystore file which is created when generating key pairs to all the machines in the cluster?

Keys are created on a different instance which is exclusively used on key management only.

When a new key pair is added, that keypair + certificate needs to be available on all application instances.

Generate keypair with a certificate with store file

keytool -genkeypair -alias alias1  -keystore /home/user/my_cloudhsm/my-cloudhsm.store "CN=alias1.example.com, OU=Research, O=Acme, L=XYZ, ST=CA, C=US" -storetype CLOUDHSM  -storepass password -keyalg rsa -keysize 2048 -sigalg sha512withrsa -validity 360  -dname  -J-classpath '-J/opt/cloudhsm/java/*' -J-Djava.library.path=/opt/cloudhsm/lib