I've never done this before. But here are some suggestive pointers. These points are NOT concrete steps to get it working. From the documentation for the new AWS CloudHSM (not classic) offering:
- Setup CloudHSM and generate private key using the CLI utility.
- Install and configure the CloudHSM OpenSSL library.
- Check if engine works
openssl engine -t cloudhsm
- Configure Nginx. Since Nginx 1.7.9, you can specify an engine for the private keys
The value engine:name:id can be specified instead of the file (1.7.9), which loads a secret key with a specified id from the OpenSSL engine name.
So your nginx config would look something like this
I'm not quite sure what the name would be or the keyID. I'll read-up a bit
and edit this answer if I find something.
Note: Also, per documentation, you might have to set the
cloudhsm if you want to enable SSL acceleration (doing the crypto in the HSM).
May I ask why you wouldn't want to offload your SSL at the Load Balancers using AWS ACM? That's the easiest way to do it and it's secure if you trust AWS to be secure.
edit: I read a bit and I'm more or less certain that the
Key Handle in CloudHSM parlance - the 6-digit numeric Identifier - is the
keyid here. I also think
user name is the
name part. So your Nginx config could be:
# something that looks like:
edit2: Nginx compilation is not necessary. We just have to make sure that the openssl engine is loadable. Once configured, this is what it looks like when verifying:
[root@ip-172-31-14-127 ~]# export n3fips_password=user_cu:Wzs8sukUp7FkVs4xQU
[root@ip-172-31-14-127 ~]# openssl engine -t cloudhsm
(cloudhsm) CloudHSM hardware engine support
SDK Version: 2.03
[ available ]
edit3: Good news! According to this forum post, Amazon is working on better documentation for Nginx integration with CloudHSM.
edit4: AWS has updated their documentation to include instructions for Apache and Nginx. I seem to have got it slightly right! ;) So, apparently, you download a "fake private key" and use it in your Nginx config. The rest of the instructions hold well.
Regardless of which method you choose, you then export a private key
handle from the HSMs and save it to a file. The file doesn't contain
the actual private key. It contains a reference to the handle of the
private key that is stored on the HSMs. The file's contents are known
as a fake PEM format private key. Your web server software uses the
fake PEM format private key file, along with the AWS CloudHSM software
library for OpenSSL, to offload SSL or TLS processing to the HSMs in
Documentation here: https://docs.aws.amazon.com/cloudhsm/latest/userguide/ssl-offload.html
I haven't tested this yet. Will post an update once I do.