I have a DMS system(alfresco) that needs to sign approx 50.000 valid signatures a year. The signing certificate needs to be acquired from one of the affiliated sub-CA's. So according to the Adobe CDS certificate policy, are they obligating me to use a hardware HSM or usb Token? I want to use SoftHSM instead. It is free & opensource (but no hardware).

Is this possible?

  • How did you resolve this problem ? I'm thinking buying a Digital Certificate for HSM and trying to install in SoftHSM.. Did you try it? – Manuel Pardo Aug 26 at 15:04

The CDS Certificate Policy (available here) specifies in section 6.1.1

Subscriber key pairs must be generated in a manner that ensures that the private key is not known by anybody other than the Subscriber or a Subscriber’s authorized representative. Subscriber key pairs must be generated in a medium that prevents exportation or duplication and that meets or exceed FIPS 140-1 Level 2 certification standards.

SoftHSM is not FIPS 140-1 Level 2 compliant. As far as I know, level 2 and upper requires a hardware cryptographic module.

Note that the AATL program (successor of CDS) has similar requirements but it provides a larger set of Certification Authority which could provide you either a physical signature certificate or a signature SaaS solution.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.