- Using Amazon CloudHSM with CloudHSM Windows Client installed and configured.
- Created CSR for a Code Signing certificate with
Cavium Key Storage Provider.
- Submitted CSR for signing to CA
- Accepted signed certificate with
Now I have a certificate on one server that is linked to the private key on our Amazon CloudHSM.
I need this same certificate on another server. I have installed and configured Windows CloudHSM client on the other server and am able to use the Cavium HSM command line utilities to connect to the HSM and see the keys for the certificate I created earlier from the other server.
I have tried importing the certificate (without private key) into this server's certificate store (success) and then linking the certificate with the private key on the HSM using
certutil.exe -repairstore but I am unable to get it to work.
>certutil -csp "Cavium Key Storage Provider" -repairstore my 1 my "Personal" ================ Certificate 1 ================ Serial Number: 82af82b36ca545710000000655668982 Issuer: CN=Entrust Code Signing CA - OVCS1, OU=(c) 2015 Entrust, Inc. - for authorized use only, OU=See http://www.entrust.net/legal-terms, O=Entrust, Inc., C=US NotBefore: 2/12/2019 11:12 AM NotAfter: 3/3/2020 11:42 AM Subject: CN=A Company, O=An organization, L=Los Angeles, S=California, C=US Non-root Certificate Cert Hash(sha1): f63e9db72dece2e7950c8ac878ae96388b8875c7 SDK Version: 2.03 No key provider information Cannot find the certificate and private key for decryption. CertUtil: -repairstore command FAILED: 0x80092004 (-2146885628 CRYPT_E_NOT_FOUND) CertUtil: Cannot find object or property.
In the certificate store, there is no key provider information because I just imported the certificate without the private key.
So, how do I import the certificate in a way that it is linked to the Cavium Key Storage Provider or how do I set the certificate's key provider after importing so that I can link it with
certutil -repairstore to the private key on the HSM?
And if that's the wrong path, my ultimate question is: How do I install an HSM backed certificate on a second server?