Downloads for AWS CloudHSM Client SDK

Downloads

In March 2021, AWS CloudHSM released Client SDK version 5.0.0, which introduces an all-new Client SDK with different requirements, capabilities, and platform support.

Client SDK 5 is fully supported for production environments, and offers the same components and level of support as Client SDK 3, with the exception of support for CNG and KSP providers. For more information, see Client SDK component comparison.

Note

For information on what platforms are supported by each Client SDK, refer to Client SDK 5 supported platforms and Client SDK 3 supported platforms.

Latest release

This section includes the latest version of the Client SDK.

Client SDK 5 release: Version 5.12.0

Amazon Linux 2

Download version 5.12.0 software for Amazon Linux 2 on x86_64 architecture:

• PKCS #11 library _{(SHA256 checksum 383baed4a861391eb0923c0d9cf451851c6dd02d7d6a9e9cc3638c60bf300ef2)}

• OpenSSL Dynamic Engine _{(SHA256 checksum f7aba68787a4c975f3e9f4ead28c2c28adc787ca0babebc070a928d226ff330a)}

• JCE provider _{(SHA256 checksum 1f75f1a5d428b18ce2dc6ce8e17923009895c2545e2d04d76dafd6da914c0b4e)}

  • Javadocs for AWS CloudHSM _{(SHA256 checksum 7158bc80e3b5b0915d83c39d4c060060a43a79cc407b1f783383b9e20bc5ff43)}

• CloudHSM CLI _{(SHA256 checksum 4c27fae1ef5fd1642c04514ec84ad4cab78f59a32eb3fce59b51805c44b25295)}

Download version 5.12.0 software for Amazon Linux 2 on ARM64 architecture:

• PKCS #11 library _{(SHA256 checksum c28a1f27e23e6ab1550dab6a353c6c9338a391a84d57f4ac99a1a3a9810c753f)}

• OpenSSL Dynamic Engine _{(SHA256 checksum 7d2e864c31c13f55443c1b1d04589fbdd4558fe103954de4384691e2c429a872)}

• JCE provider _{(SHA256 checksum e9a35eb87b2f257c47fb083d286deb835da45858b2d89759ca7d5bb4ef747b4b)}

  • Javadocs for AWS CloudHSM _{(SHA256 checksum 7158bc80e3b5b0915d83c39d4c060060a43a79cc407b1f783383b9e20bc5ff43)}

• CloudHSM CLI _{(SHA256 checksum 28b6f918912b5c63bf10018824b642a805b309c21947a1d0ebbdc44647e80554)}

Amazon Linux 2023

Download version 5.12.0 software for Amazon Linux 2023 on x86_64 architecture:

• PKCS #11 library _{(SHA256 checksum 02801365cba449c5238a4e5ad3df1ddf7edd00ade976f47e956e885286503f3f)}

• OpenSSL Dynamic Engine _{(SHA256 checksum 0abed69a7c6acaafdaabdcc5fab7d56611ffd94f5480cade6f8beace9aeae056)}

• JCE provider _{(SHA256 checksum 3d5d9a903d3a216eca40f92dbb0b4030b7a86ad7ceee8d62241c97a6e1881e25)}

  • Javadocs for AWS CloudHSM _{(SHA256 checksum 7158bc80e3b5b0915d83c39d4c060060a43a79cc407b1f783383b9e20bc5ff43)}

• CloudHSM CLI _{(SHA256 checksum f96671d882b862033bba0b3633448dc6a26e45a25063e29b79a5cd4b7fc4945c)}

Download version 5.12.0 software for Amazon Linux 2023 on ARM64 architecture:

• PKCS #11 library _{(SHA256 checksum 53d05006b46bda8e9c1dd76e8307a780bfe0a67b10a9a87723c97f94e29f5b8e)}

• OpenSSL Dynamic Engine _{(SHA256 checksum ec1cca8e01b3303ff9473eeef6b33dc85b6affac7a47387b098905f9f2fc85ba)}

• JCE provider _{(SHA256 checksum c828ae56f46233215b9f35798b5859ebdac962af442acbc457081c3baaa44f11)}

  • Javadocs for AWS CloudHSM _{(SHA256 checksum 7158bc80e3b5b0915d83c39d4c060060a43a79cc407b1f783383b9e20bc5ff43)}

• CloudHSM CLI _{(SHA256 checksum ddd5dcd68d01f4fafaf13dc0b4ddcf98e3731ed51bdd51f85535b29353644a9f)}

CentOS 7 (7.8+)

Download version 5.12.0 software for CentOS 7 on x86_64 architecture:

• PKCS #11 library _{(SHA256 checksum 383baed4a861391eb0923c0d9cf451851c6dd02d7d6a9e9cc3638c60bf300ef2)}

• OpenSSL Dynamic Engine _{(SHA256 checksum f7aba68787a4c975f3e9f4ead28c2c28adc787ca0babebc070a928d226ff330a)}

• JCE provider _{(SHA256 checksum 1f75f1a5d428b18ce2dc6ce8e17923009895c2545e2d04d76dafd6da914c0b4e)}

  • Javadocs for AWS CloudHSM _{(SHA256 checksum 7158bc80e3b5b0915d83c39d4c060060a43a79cc407b1f783383b9e20bc5ff43)}

• CloudHSM CLI _{(SHA256 checksum 4c27fae1ef5fd1642c04514ec84ad4cab78f59a32eb3fce59b51805c44b25295)}

RHEL 7 (7.8+)

Download version 5.12.0 software for RHEL 7 on x86_64 architecture:

• PKCS #11 library _{(SHA256 checksum 383baed4a861391eb0923c0d9cf451851c6dd02d7d6a9e9cc3638c60bf300ef2)}

• OpenSSL Dynamic Engine _{(SHA256 checksum f7aba68787a4c975f3e9f4ead28c2c28adc787ca0babebc070a928d226ff330a)}

• JCE provider _{(SHA256 checksum 1f75f1a5d428b18ce2dc6ce8e17923009895c2545e2d04d76dafd6da914c0b4e)}

  • Javadocs for AWS CloudHSM _{(SHA256 checksum 7158bc80e3b5b0915d83c39d4c060060a43a79cc407b1f783383b9e20bc5ff43)}

• CloudHSM CLI _{(SHA256 checksum 4c27fae1ef5fd1642c04514ec84ad4cab78f59a32eb3fce59b51805c44b25295)}

RHEL 8 (8.3+)

Download version 5.12.0 software for RHEL 8 on x86_64 architecture:

• PKCS #11 library _{(SHA256 checksum 6e51e95122fd0991278888287f0c408808b26fb5f1196c46168477b9090fc478)}

• OpenSSL Dynamic Engine _{(SHA256 checksum 1f1d52ff7af6c537d8cfeb5973c691a9d90a518accd685ff9b66cd78daf98928)}

• JCE provider _{(SHA256 checksum 156944607de987d6b39bd8a2d21ccd294c01377a9e35f9f15f8b0f4c8bb90033)}

  • Javadocs for AWS CloudHSM _{(SHA256 checksum 7158bc80e3b5b0915d83c39d4c060060a43a79cc407b1f783383b9e20bc5ff43)}

• CloudHSM CLI _{(SHA256 checksum 351e802f79dd2d0b5f7d23bb74c146be05e5169b603c9aace24189094a45a35d)}

RHEL 9 (9.2+)

Download version 5.12.0 software for RHEL 9 on x86_64 architecture:

• PKCS #11 library _{(SHA256 checksum d1b2f4ac7e6e0c18e788512e7726bc68b571d99a1442ce2f2e80f4b0f9956266)}

• OpenSSL Dynamic Engine _{(SHA256 checksum cf86a3f17cd6c51969d4ce80c1e3ea6513b995611be7e2e72e5e5233c71d6add)}

• JCE provider _{(SHA256 checksum ae89e256eb89ec6b4fa0f001e7a4e1d8f1c08530423e81aa74d69a17b25d9a99)}

  • Javadocs for AWS CloudHSM _{(SHA256 checksum 7158bc80e3b5b0915d83c39d4c060060a43a79cc407b1f783383b9e20bc5ff43)}

• CloudHSM CLI _{(SHA256 checksum dfe6fe5d890c33b2f5d38f906ade113b06c8c05f3427a327744c454e7302f1a5)}

Download version 5.12.0 software for RHEL 9 on ARM64 architecture:

• PKCS #11 library _{(SHA256 checksum cad72a6ab2232b4c38b90d7c62147520b975d646773dd90d7be897fa0a537d2d)}

• OpenSSL Dynamic Engine _{(SHA256 checksum ad751f756530a2317c3c64380ea3a07865b13e1874fab0e61ac530b21487c7fb)}

• JCE provider _{(SHA256 checksum d204e69acfbb90996fb08ae3573607b65630b1124fb379e078c002d55ac07766)}

  • Javadocs for AWS CloudHSM _{(SHA256 checksum 7158bc80e3b5b0915d83c39d4c060060a43a79cc407b1f783383b9e20bc5ff43)}

• CloudHSM CLI _{(SHA256 checksum c0f412cc59bafd235e046cdc1a0c5d330f2d72f7d6434672e9522f86bc945090)}

Ubuntu 20.04 LTS

Download version 5.12.0 software for Ubuntu 20.04 LTS on x86_64 architecture:

• PKCS #11 library _{(SHA256 checksum d37b1f872eb2b1ab34303d5b8b803daa925902b645c57c6e15a28bb6321e0f42)}

• OpenSSL Dynamic Engine _{(SHA256 checksum cdc6e737652556b57d26d8816b2bc9820128cb3919360660b6f7fe65f9d39e3f)}

• JCE provider _{(SHA256 checksum f567a08344414a4776e1c5a9715657476925ca32695c4c2dd84a4f3fc5dc1615)}

  • Javadocs for AWS CloudHSM _{(SHA256 checksum 7158bc80e3b5b0915d83c39d4c060060a43a79cc407b1f783383b9e20bc5ff43)}

• CloudHSM CLI _{(SHA256 checksum f2ee5ad01c5018fc3670f602228fd71087228cd3923bf5b9bc73e4d7084dac6c)}

Ubuntu 22.04 LTS

Download version 5.12.0 software for Ubuntu 22.04 LTS on x86_64 architecture:

• PKCS #11 library _{(SHA256 checksum 0e78928acd7a1662e4b07b15d5c3ccb88714ff89e47b991c8ab6e4c2229ee5aa)}

• OpenSSL Dynamic Engine _{(SHA256 checksum 4f3168745edc5592234891a7b1d82b179a4947e87c72fade1be3bad58b7ed1a3)}

• JCE provider _{(SHA256 checksum d4c3655cdc2b00d1ab5ceafac94dfbc5c5244ed20e10fdd9db9f4e741e013733)}

  • Javadocs for AWS CloudHSM _{(SHA256 checksum 7158bc80e3b5b0915d83c39d4c060060a43a79cc407b1f783383b9e20bc5ff43)}

• CloudHSM CLI _{(SHA256 checksum d00bbacb6f2e57bd92d832a2bd11cadede972f8e82cc402ec0684b9c6b23123c)}

Download version 5.12.0 software for Ubuntu 22.04 LTS on ARM64 architecture:

• PKCS #11 library _{(SHA256 checksum 0c1121535c523acb864215338292bab32acee438357878b5fc0b6d268713b86f)}

• OpenSSL Dynamic Engine _{(SHA256 checksum dc7a219302021570bc8c36674d2bd33165557bb2f9a0af8fdf114f1b85a70d84)}

• JCE provider _{(SHA256 checksum af3834a10081f1e4e7894275c8b9c7b7649b8de3b6f0aeb0781a3358183a9046)}

  • Javadocs for AWS CloudHSM _{(SHA256 checksum 7158bc80e3b5b0915d83c39d4c060060a43a79cc407b1f783383b9e20bc5ff43)}

• CloudHSM CLI _{(SHA256 checksum baa253ac62c2fbcc5712561e0fb0feb25461efc3ce68cf86d4c7bf0af0f14a34)}

Windows Server 2016

Download version 5.12.0 software for Windows Server 2016 on x86_64 architecture:

• PKCS #11 library _{(SHA256 checksum 11c3255fcc90b47810cfe4b2f71d56a006d295efccdd90f0d3f2dec5d2bab893)}

• JCE provider _{(SHA256 checksum 09001458196590f54352c0c8986f442003bfc2db71bac6392ce512899d386806)}

  • Javadocs for AWS CloudHSM _{(SHA256 checksum 7158bc80e3b5b0915d83c39d4c060060a43a79cc407b1f783383b9e20bc5ff43)}

• CloudHSM CLI _{(SHA256 checksum b446ad1387fe406dcc0a12b6de86fa98e9db4a18f9829b745efb87750c6e31ea)}

Windows Server 2019

Download version 5.12.0 software for Windows Server 2019 on x86_64 architecture:

• PKCS #11 library _{(SHA256 checksum 11c3255fcc90b47810cfe4b2f71d56a006d295efccdd90f0d3f2dec5d2bab893)}

• JCE provider _{(SHA256 checksum 09001458196590f54352c0c8986f442003bfc2db71bac6392ce512899d386806)}

  • Javadocs for AWS CloudHSM _{(SHA256 checksum 7158bc80e3b5b0915d83c39d4c060060a43a79cc407b1f783383b9e20bc5ff43)}

• CloudHSM CLI _{(SHA256 checksum b446ad1387fe406dcc0a12b6de86fa98e9db4a18f9829b745efb87750c6e31ea)}

Client SDK 5.12.0 adds ARM support to several platforms and performance improvements for all SDKs. New features have been added to the CloudHSM CLI and JCE provider.

Platform support

• Added support for Amazon Linux 2023 on ARM64 architecture for all SDKs.

• Added support for Red Hat Enterprise Linux 9 (9.2+) on ARM64 architecture for all SDKs.

• Added support for Ubuntu 22.04 LTS on ARM64 architecture for all SDKs.

CloudHSM CLI

• Added the following command:

  • key replicate

• Added support for connecting to multiple clusters. For more information, see Connecting to multiple clusters with CLI.

JCE provider

• Added KeyReferenceSpec for retrieving keys using KeyStoreWithAttributes.

• Added getKeys for retrieving multiple keys at once using KeyStoreWithAttributes.

Performance improvements

• Performance improvements for the AES CBC NoPadding operation for all SDKs.

Previous Client SDK releases

This section lists previous Client SDK releases.

Version 5.11.0

Amazon Linux 2

Download version 5.11.0 software for Amazon Linux 2 on x86_64 architecture:

• PKCS #11 library _{(SHA256 checksum 9fc0cd7cf003a7cb7e42dbd19671d58a97fc3b3d871d284dc6ae7fd226598772)}

• OpenSSL Dynamic Engine _{(SHA256 checksum 1df6669c971440d446890b0fbeb74125a423df7b14e7ac4577347be7ef176572)}

• JCE provider _{(SHA256 checksum 148a3f1de55a68e3bb525fb2994645333a52c2e9e46946dd8d90fcbc90ab64fd)}

  • Javadocs for AWS CloudHSM _{(SHA256 checksum fb469ae53b516338f3326b402b15b7b84912801a8c25a28cd31a5da0631cd3c5)}

• CloudHSM CLI _{(SHA256 checksum a68f4a56d4c539cfcc8a1e56e19b5ff385bb24936ea5f349255b4e9bfbee9aab)}

Download version 5.11.0 software for Amazon Linux 2 on ARM64 architecture:

• PKCS #11 library _{(SHA256 checksum 5ac16449ec149c9b5e7776865803245ab17d0f1ad56df80173840c5e8d257b19)}

• OpenSSL Dynamic Engine _{(SHA256 checksum 28c2eb7f3f60172b0186e5c25f71bb7341537058a71f288673936766048083c1)}

• JCE provider _{(SHA256 checksum 06c9d9d281c12b1d2bd9a7b601d6317e46cedf175706bbfa3e4dcaed6ba05448)}

  • Javadocs for AWS CloudHSM _{(SHA256 checksum fb469ae53b516338f3326b402b15b7b84912801a8c25a28cd31a5da0631cd3c5)}

• CloudHSM CLI _{(SHA256 checksum 218982bb17aa751969a7866b0a9ff27e7aa5007a07817627d9cc1f7d60a78160)}

Amazon Linux 2023

Download version 5.11.0 software for Amazon Linux 2023 on x86_64 architecture:

• PKCS #11 library _{(SHA256 checksum 55310ab333d18bcfabdc4b74115b040386b4508934bdff93e1d054c4c4a6f9ea)}

• OpenSSL Dynamic Engine _{(SHA256 checksum f3d4934dc872a9b5212a180b9814ca2af3eca01ee228a8725563f1770add0dce)}

• JCE provider _{(SHA256 checksum 757d3abb515aeb08f4b1c83970ee0979399efee00ee78c9a9dbec05f4ed9768d)}

  • Javadocs for AWS CloudHSM _{(SHA256 checksum fb469ae53b516338f3326b402b15b7b84912801a8c25a28cd31a5da0631cd3c5)}

• CloudHSM CLI _{(SHA256 checksum 22af8f0501ff9a45a9e0683a408a63771c2c06c66abf5478d310d6d32e013555)}

CentOS 7 (7.8+)

Download version 5.11.0 software for CentOS 7 on x86_64 architecture:

• PKCS #11 library _{(SHA256 checksum 9fc0cd7cf003a7cb7e42dbd19671d58a97fc3b3d871d284dc6ae7fd226598772)}

• OpenSSL Dynamic Engine _{(SHA256 checksum 1df6669c971440d446890b0fbeb74125a423df7b14e7ac4577347be7ef176572)}

• JCE provider _{(SHA256 checksum 148a3f1de55a68e3bb525fb2994645333a52c2e9e46946dd8d90fcbc90ab64fd)}

  • Javadocs for AWS CloudHSM _{(SHA256 checksum fb469ae53b516338f3326b402b15b7b84912801a8c25a28cd31a5da0631cd3c5)}

• CloudHSM CLI _{(SHA256 checksum a68f4a56d4c539cfcc8a1e56e19b5ff385bb24936ea5f349255b4e9bfbee9aab)}

RHEL 7 (7.8+)

Download version 5.11.0 software for RHEL 7 on x86_64 architecture:

• PKCS #11 library _{(SHA256 checksum 9fc0cd7cf003a7cb7e42dbd19671d58a97fc3b3d871d284dc6ae7fd226598772)}

• OpenSSL Dynamic Engine _{(SHA256 checksum 1df6669c971440d446890b0fbeb74125a423df7b14e7ac4577347be7ef176572)}

• JCE provider _{(SHA256 checksum 148a3f1de55a68e3bb525fb2994645333a52c2e9e46946dd8d90fcbc90ab64fd)}

  • Javadocs for AWS CloudHSM _{(SHA256 checksum fb469ae53b516338f3326b402b15b7b84912801a8c25a28cd31a5da0631cd3c5)}

• CloudHSM CLI _{(SHA256 checksum a68f4a56d4c539cfcc8a1e56e19b5ff385bb24936ea5f349255b4e9bfbee9aab)}

RHEL 8 (8.3+)

Download version 5.11.0 software for RHEL 8 on x86_64 architecture:

• PKCS #11 library _{(SHA256 checksum b95b9f588656fb14fd08bb66ce0e0da807b96daa38348dec07a508c9bef7403a)}

• OpenSSL Dynamic Engine _{(SHA256 checksum 7bb437b91a52e863b2b00ff7f427ce22522026daf757be873ee031ec6ffffd88)}

• JCE provider _{(SHA256 checksum e0db887e05eb535314f4d99f21da12d87d35ebb8baf9726f4ce8f01d9df0ea01)}

  • Javadocs for AWS CloudHSM _{(SHA256 checksum fb469ae53b516338f3326b402b15b7b84912801a8c25a28cd31a5da0631cd3c5)}

• CloudHSM CLI _{(SHA256 checksum 8485b5a6d679767ca9b4f611718159a643cf3e85090a8e4d20fe53c3707e25c3)}

RHEL 9 (9.2+)

Download version 5.11.0 software for RHEL 9 on x86_64 architecture:

• PKCS #11 library _{(SHA256 checksum 87b56a20accf67df53a203b7f115655b2acfaec4516682d4976d9475b10bec8e)}

• OpenSSL Dynamic Engine _{(SHA256 checksum 83a6b58572e985df937beede4b10e867b0ac6050ace8010dc8d535be365d2747)}

• JCE provider _{(SHA256 checksum ee95213d02d913250478d0793d6dd578e5c54d765e635c7468a49bdff4c2a6f3)}

  • Javadocs for AWS CloudHSM _{(SHA256 checksum fb469ae53b516338f3326b402b15b7b84912801a8c25a28cd31a5da0631cd3c5)}

• CloudHSM CLI _{(SHA256 checksum 7e168ed3bef8e9c5110645e9960680e9a57f7b94e16aec71422e3c67ebc58fb5)}

Ubuntu 20.04 LTS

Download version 5.11.0 software for Ubuntu 20.04 LTS on x86_64 architecture:

• PKCS #11 library _{(SHA256 checksum abc3a339d1fe5850db65620804e9a910f8b4f913624ef9b7189f2f0df1825c01)}

• OpenSSL Dynamic Engine _{(SHA256 checksum 075fc3f9974d552f27ad67fa92c8abff31b756b9add875b8cd4957e6801583a4)}

• JCE provider _{(SHA256 checksum 5de45c519133a0dae8da3ac01809db7974be25c14c15eb773fc5c972c0178c13)}

  • Javadocs for AWS CloudHSM _{(SHA256 checksum fb469ae53b516338f3326b402b15b7b84912801a8c25a28cd31a5da0631cd3c5)}

• CloudHSM CLI _{(SHA256 checksum 83e0e4505a063792c19feb3d4cfd032b9089091916168d92b0f51a967a007734)}

Ubuntu 22.04 LTS

Download version 5.11.0 software for Ubuntu 22.04 LTS on x86_64 architecture:

• PKCS #11 library _{(SHA256 checksum b8f20be125c8530b2a7bd945956e9c04296fba5634af408b40be4e03bdbad72a)}

• OpenSSL Dynamic Engine _{(SHA256 checksum d728c156eb4ee5c67159e57d6b092785800baa5fb61c14d64f460a8b8f53a778)}

• JCE provider _{(SHA256 checksum 44e943b8cd1176ad666e249342687744a280c6222df58b5a9f084c932f628284)}

  • Javadocs for AWS CloudHSM _{(SHA256 checksum fb469ae53b516338f3326b402b15b7b84912801a8c25a28cd31a5da0631cd3c5)}

• CloudHSM CLI _{(SHA256 checksum 8ccf5389d459611be813e42d7f9d040090f94f3fe88f9d110bcfb25e9619e4a7)}

Windows Server 2016

Download version 5.11.0 software for Windows Server 2016 on x86_64 architecture:

• PKCS #11 library _{(SHA256 checksum aa4bce5be15bbe0978b7205c619bb91c55a8e0f1f4636be311f24878f7709e07)}

• JCE provider _{(SHA256 checksum 004cdb9ecb4a4d72458084997de7f562fb76a4e2f0567009f1dfafa7b2bded47)}

  • Javadocs for AWS CloudHSM _{(SHA256 checksum fb469ae53b516338f3326b402b15b7b84912801a8c25a28cd31a5da0631cd3c5)}

• CloudHSM CLI _{(SHA256 checksum 679795db759fda4823232142297a281e21a7d6f32cb5ddd6ac4c479866fa33b7)}

Windows Server 2019

Download version 5.11.0 software for Windows Server 2019 on x86_64 architecture:

• PKCS #11 library _{(SHA256 checksum aa4bce5be15bbe0978b7205c619bb91c55a8e0f1f4636be311f24878f7709e07)}

• JCE provider _{(SHA256 checksum 004cdb9ecb4a4d72458084997de7f562fb76a4e2f0567009f1dfafa7b2bded47)}

  • Javadocs for AWS CloudHSM _{(SHA256 checksum fb469ae53b516338f3326b402b15b7b84912801a8c25a28cd31a5da0631cd3c5)}

• CloudHSM CLI _{(SHA256 checksum 679795db759fda4823232142297a281e21a7d6f32cb5ddd6ac4c479866fa33b7)}

Client SDK 5.11.0 adds new features, improves stability, and includes bug fixes for all SDKs.

Platform support

• Added support for Amazon Linux 2023 and RHEL 9 (9.2+) for all SDKs.

• Removed support for Ubuntu 18.04 LTS due to its recent end of life.

• Removed support for Amazon Linux due to its recent end of life.

CloudHSM CLI

• Added the following commands:

  • crypto sign

  • crypto verify

  • key import pem

  • key unwrap

  • key wrap

• key generate-file now supports export of public keys.

OpenSSL Dynamic Engine

• The AWS CloudHSM OpenSSL Dynamic Engine is now supported on platforms that come installed with an OpenSSL library version of 3.x. This includes Amazon Linux 2023, RHEL 9 (9.2+), and Ubuntu 22.04.

JCE

• Added support for JDK 17 and JDK 21.

• Added support for AES keys to be used for HMAC operations.

• Added the new key attribute ID.

• Introduced a new DataExceptionCause variant for key exhaustion: DataExceptionCause.KEY_EXHAUSTED.

Bug fixes/Improvements

• Increased the max length for the label attribute from 126 to 127 characters.

• Fixed a bug which prevented unwrapping of EC keys with the RsaOaep mechanism.

• Resolved a known issue for the getKey operation in the JCE provider. Refer to Issue: Client SDK 5 memory leak with getKey operations for details.

• Improved logging in all SDKs for Triple DES keys that have hit their maximum encryption block limit, per FIPS 140-2.

• Added known issues for the OpenSSL Dynamic Engine. See Known issues for the OpenSSL Dynamic Engine for details.

Version 5.10.0

Amazon Linux

Download version 5.10.0 software for Amazon Linux on x86_64 architecture:

• PKCS #11 library _{(SHA256 checksum d63adf3e96c19c2d894b2defcbadd916dbb0398993050b1358bd93a36aa5acab)}

• OpenSSL Dynamic Engine _{(SHA256 checksum 4daa3e591ffd5f7ce8ef3759c41deaa38867f5e5d21f15927aea83afb1678ac5)}

• JCE provider _{(SHA256 checksum 6c1ac94d3080f1c609d9dafbcb14480911beef3a488c4ed6f2b11b377da9b477)}

  • Javadocs for AWS CloudHSM _{(SHA256 checksum dcbb870c6bd58c6770ba7a2b616c6103a5efb3bdeab831ce8f9c82cc09a9870f)}

• CloudHSM CLI _{(SHA256 checksum c12617fcd7990ba53e96f477979b410e3a5f17842ca7a912861b8b820809b5b5)}

Amazon Linux 2

Download version 5.10.0 software for Amazon Linux 2 on x86_64 architecture:

• PKCS #11 library _{(SHA256 checksum fc47e705e57a0bfd433f7b46c9477a70df5c442a8ad9c2969bcef38e328e4933)}

• OpenSSL Dynamic Engine _{(SHA256 checksum 0aca262df6780995c9b884fcb8765bbd64acaf21b2286ec4d05a9a90edb3d4cb)}

• JCE provider _{(SHA256 checksum b5be7f73c4bcffc5da6f89f324e6b3db5b091610464c8bd38dbddfff0484b2c2)}

  • Javadocs for AWS CloudHSM _{(SHA256 checksum dcbb870c6bd58c6770ba7a2b616c6103a5efb3bdeab831ce8f9c82cc09a9870f)}

• CloudHSM CLI _{(SHA256 checksum e8cf09966890b88a61e695dc034874a445093300359d5d6a86b5a546803920bb)}

Download version 5.10.0 software for Amazon Linux 2 on ARM64 architecture:

• PKCS #11 library _{(SHA256 checksum 5d8dfd835f1ed5a7f5a4fcc8ecf81cfa29883aca7e2985de69b5db723ab663db)}

• OpenSSL Dynamic Engine _{(SHA256 checksum 91fb8efe2646bf0dbd9087554baa09554714e9d56e9bfd5c0dc3023a9f485574)}

• JCE provider _{(SHA256 checksum 99f6e55c37fdf00085a816d46835aeff54470797b3b71f4d28a70dc79c9caf44)}

  • Javadocs for AWS CloudHSM _{(SHA256 checksum dcbb870c6bd58c6770ba7a2b616c6103a5efb3bdeab831ce8f9c82cc09a9870f)}

• CloudHSM CLI _{(SHA256 checksum 4a88ba9b4cf0dd5573f3dd88ab9dc257e4c486069cb529c5d554979ee2dd83af)}

CentOS 7 (7.8+)

Download version 5.10.0 software for CentOS 7 on x86_64 architecture:

• PKCS #11 library _{(SHA256 checksum fc47e705e57a0bfd433f7b46c9477a70df5c442a8ad9c2969bcef38e328e4933)}

• OpenSSL Dynamic Engine _{(SHA256 checksum 0aca262df6780995c9b884fcb8765bbd64acaf21b2286ec4d05a9a90edb3d4cb)}

• JCE provider _{(SHA256 checksum b5be7f73c4bcffc5da6f89f324e6b3db5b091610464c8bd38dbddfff0484b2c2)}

  • Javadocs for AWS CloudHSM _{(SHA256 checksum dcbb870c6bd58c6770ba7a2b616c6103a5efb3bdeab831ce8f9c82cc09a9870f)}

• CloudHSM CLI _{(SHA256 checksum e8cf09966890b88a61e695dc034874a445093300359d5d6a86b5a546803920bb)}

RHEL 7 (7.8+)

Download version 5.10.0 software for RHEL 7 on x86_64 architecture:

• PKCS #11 library _{(SHA256 checksum fc47e705e57a0bfd433f7b46c9477a70df5c442a8ad9c2969bcef38e328e4933)}

• OpenSSL Dynamic Engine _{(SHA256 checksum 0aca262df6780995c9b884fcb8765bbd64acaf21b2286ec4d05a9a90edb3d4cb)}

• JCE provider _{(SHA256 checksum b5be7f73c4bcffc5da6f89f324e6b3db5b091610464c8bd38dbddfff0484b2c2)}

  • Javadocs for AWS CloudHSM _{(SHA256 checksum dcbb870c6bd58c6770ba7a2b616c6103a5efb3bdeab831ce8f9c82cc09a9870f)}

• CloudHSM CLI _{(SHA256 checksum e8cf09966890b88a61e695dc034874a445093300359d5d6a86b5a546803920bb)}

RHEL 8 (8.3+)

Download version 5.10.0 software for RHEL 8 on x86_64 architecture:

• PKCS #11 library _{(SHA256 checksum 96afb7042a148ddc7a60ab6235b49e176d0460d1c2957bd76ca3d8406ac1cb03)}

• OpenSSL Dynamic Engine _{(SHA256 checksum 2caad2bffea8aef73c91ad422d09772ef830fe7f80a7be19020e6a107eadfbe8)}

• JCE provider _{(SHA256 checksum 3543551f08fbe3900821ea2d4ea148b4e86e2334bc94d7ffef6f3b831457cd71)}

  • Javadocs for AWS CloudHSM _{(SHA256 checksum dcbb870c6bd58c6770ba7a2b616c6103a5efb3bdeab831ce8f9c82cc09a9870f)}

• CloudHSM CLI _{(SHA256 checksum 812eccaadfc490f13bcd0b0a835ef58f3a3d4344ad7e0a237de476dd24509525)}

Ubuntu 18.04 LTS

Download version 5.10.0 software for Ubuntu 18.04 LTS on x86_64 architecture:

• PKCS #11 library _{(SHA256 checksum be4c61766b8b46e1f6c14c3dcf90aaab9f38240fcd9c68b4009704276c5f6f4a)}

• OpenSSL Dynamic Engine _{(SHA256 checksum 64bd8af827b6dc3786e8ad28858cbc4ef6a0fd42164a0945f427eddcf5f02858)}

• JCE provider _{(SHA256 checksum 9fcbdf08e93641468588b608173f26f18781bbc029ed95b2e086da29a968cc00)}

  • Javadocs for AWS CloudHSM _{(SHA256 checksum dcbb870c6bd58c6770ba7a2b616c6103a5efb3bdeab831ce8f9c82cc09a9870f)}

• CloudHSM CLI _{(SHA256 checksum 13808bddddb7eedeb2b8486d23a9976c7fa8d9220149a6b9400626bcaff3b513)}

Note

Due to the recent end of life for Ubuntu 18.04 LTS, AWS CloudHSM will no longer be able to support this platform with the next release.

Ubuntu 20.04 LTS

Download version 5.10.0 software for Ubuntu 20.04 LTS on x86_64 architecture:

• PKCS #11 library _{(SHA256 checksum 99ae96504580ff85ed4958a582903a847f666bdaafafbe887a5a76db58f24500)}

• OpenSSL Dynamic Engine _{(SHA256 checksum 13e3f6fe086acf9617b163f66e3941f973daa583fb9322d16c396aa29fc3611d)}

• JCE provider _{(SHA256 checksum 44562cebd9af1aa965840cd9bcb237e518d24c715b3c8bca1405c9c1871835e2)}

  • Javadocs for AWS CloudHSM _{(SHA256 checksum dcbb870c6bd58c6770ba7a2b616c6103a5efb3bdeab831ce8f9c82cc09a9870f)}

• CloudHSM CLI _{(SHA256 checksum ab71b4ec531c5e6d05c91539c7edc1c07e6c748052ebf6200f148cb6812538c5)}

Ubuntu 22.04 LTS

Download version 5.10.0 software for Ubuntu 22.04 LTS on x86_64 architecture:

• PKCS #11 library _{(SHA256 checksum ee331a44fbe4936ec98a3ae55d58e67ed38e8bbff0a4f4ce8b1bd8239b75877b)}

• Support for OpenSSL Dynamic Engine is not yet available for this platform.

• JCE provider _{(SHA256 checksum 9e44d14dd33624f6fe36711633013e47e4a93f4d4635e08900546113ded56e3d)}

  • Javadocs for AWS CloudHSM _{(SHA256 checksum dcbb870c6bd58c6770ba7a2b616c6103a5efb3bdeab831ce8f9c82cc09a9870f)}

• CloudHSM CLI _{(SHA256 checksum 2df361546848cd3f8965b1007dca42a0c959eb10d9e3f4995e8e1c852406751d)}

Windows Server 2016

Download version 5.10.0 software for Windows Server 2016 on x86_64 architecture:

• PKCS #11 library _{(SHA256 checksum 7aae9bfd99a6dd0f4d376c227c206c01847f83a9efd774d1063d76cc6fdaa89f)}

• JCE provider _{(SHA256 checksum 1c58fd651e51be2ba59051a87aceca0452990b29837b8a7efabcd510ccbf8c1f)}

  • Javadocs for AWS CloudHSM _{(SHA256 checksum dcbb870c6bd58c6770ba7a2b616c6103a5efb3bdeab831ce8f9c82cc09a9870f)}

• CloudHSM CLI _{(SHA256 checksum f745a2236c9eb9f6f128313eddc35795bd5e47fdf67332bedeb2554201b61a24)}

Windows Server 2019

Download version 5.10.0 software for Windows Server 2019 on x86_64 architecture:

• PKCS #11 library _{(SHA256 checksum 7aae9bfd99a6dd0f4d376c227c206c01847f83a9efd774d1063d76cc6fdaa89f)}

• JCE provider _{(SHA256 checksum 1c58fd651e51be2ba59051a87aceca0452990b29837b8a7efabcd510ccbf8c1f)}

  • Javadocs for AWS CloudHSM _{(SHA256 checksum dcbb870c6bd58c6770ba7a2b616c6103a5efb3bdeab831ce8f9c82cc09a9870f)}

• CloudHSM CLI _{(SHA256 checksum f745a2236c9eb9f6f128313eddc35795bd5e47fdf67332bedeb2554201b61a24)}

Client SDK 5.10.0 improves stability and includes bug fixes for all SDKs.

CloudHSM CLI

• Added new commands that allow customers to manage keys using CloudHSM CLI, including:

  • Create symmetric keys and asymmetric key pairs

  • Share and unshare keys

  • List and filter keys using key attributes

  • Set key attributes

  • Generate key reference files

  • Delete keys

• Improved error logging.

• Added support for multi-line unicode commands in interactive mode.

Bug fixes/Improvements

• Improved performance for importing, unwrapping, deriving, and creating sessions keys for all SDKs.

• Fixed a bug in the JCE Provider that prevented temp files to be removed on exit.

• Fixed a bug that caused a connection error under certain conditions after HSMs in the cluster are replaced.

• Modified JCE getVersion output format to handle large minor version numbers and include patch number.

Platform support

• Added support for Ubuntu 22.04 with JCE, PKCS #11, and CloudHSM CLI (support for OpenSSL Dynamic Engine is not yet available).

Version 5.9.0

Amazon Linux

Download version 5.9.0 software for Amazon Linux on x86_64 architecture:

• PKCS #11 library _{(SHA256 checksum 4f368be41f006b751ac41b14e1435c27841f60bbde0f032ec02a359fea637dcf)}

• OpenSSL Dynamic Engine _{(SHA256 checksum 81af0d34683825cd6ff844ccacf9c8f4842a4ba76e3875a89121d09a286b4490)}

• JCE provider _{(SHA256 checksum e8e5bc09d8e0b3cb24f30ab420fe08902a19073012335ac94382ec55fcc45abd)}

  • Javadocs for AWS CloudHSM _{(SHA256 checksum 6343427177180c8f61eec0341e827fbba29420ed2033c0e4b4803d49a3df7763)}

• CloudHSM CLI _{(SHA256 checksum 17284144b45043204ce012fe8b62b1973f10068950abedbd9c2c6172ed0979c6)}

Amazon Linux 2

Download version 5.9.0 software for Amazon Linux 2 on x86_64 architecture:

• PKCS #11 library _{(SHA256 checksum e5affca37abc4ff76369237649830feb32fccd3fa05199cc2021230137093c56)}

• OpenSSL Dynamic Engine _{(SHA256 checksum 848a2e31550bbc2b0223468877baa2a8cda3131ef8537856b31db226d55c4170)}

• JCE provider _{(SHA256 checksum 884f483ef3e9c7def92e3ff01b226e5cbf276d96dcb2f6f56009516f19d41dc0)}

  • Javadocs for AWS CloudHSM _{(SHA256 checksum 6343427177180c8f61eec0341e827fbba29420ed2033c0e4b4803d49a3df7763)}

• CloudHSM CLI _{(SHA256 checksum 2e62d5a27cff46d9fb47d656afeccd9dbfb5413bfd2267dd3c8fb7960fef7f26)}

Download version 5.9.0 software for Amazon Linux 2 on ARM64 architecture:

• PKCS #11 library _{(SHA256 checksum 4337dca5a08c5194b1118fa197bb4a4f7988df4e1b961e6f2e367295ba99d61d)}

• OpenSSL Dynamic Engine _{(SHA256 checksum 4f08689934e877662a7ce64554fb04eb4b2c213b936018609ff187d100e34a85)}

• JCE provider _{(SHA256 checksum b337b80271a2d308949d5911971fe6ad35df4e34876a481fcac347f1d897fe39)}

  • Javadocs for AWS CloudHSM _{(SHA256 checksum 6343427177180c8f61eec0341e827fbba29420ed2033c0e4b4803d49a3df7763)}

• CloudHSM CLI _{(SHA256 checksum a4d466e6b5f74dcd283ba32c9dd87441941d5e5a05936b7c2b4cc7ef85eb1071)}

CentOS 7 (7.8+)

Download version 5.9.0 software for CentOS 7 on x86_64 architecture:

• PKCS #11 library _{(SHA256 checksum e5affca37abc4ff76369237649830feb32fccd3fa05199cc2021230137093c56)}

• OpenSSL Dynamic Engine _{(SHA256 checksum 848a2e31550bbc2b0223468877baa2a8cda3131ef8537856b31db226d55c4170)}

• JCE provider _{(SHA256 checksum 884f483ef3e9c7def92e3ff01b226e5cbf276d96dcb2f6f56009516f19d41dc0)}

  • Javadocs for AWS CloudHSM _{(SHA256 checksum 6343427177180c8f61eec0341e827fbba29420ed2033c0e4b4803d49a3df7763)}

• CloudHSM CLI _{(SHA256 checksum 2e62d5a27cff46d9fb47d656afeccd9dbfb5413bfd2267dd3c8fb7960fef7f26)}

RHEL 7 (7.8+)

Download version 5.9.0 software for RHEL 7 on x86_64 architecture:

• PKCS #11 library _{(SHA256 checksum e5affca37abc4ff76369237649830feb32fccd3fa05199cc2021230137093c56)}

• OpenSSL Dynamic Engine _{(SHA256 checksum 848a2e31550bbc2b0223468877baa2a8cda3131ef8537856b31db226d55c4170)}

• JCE provider _{(SHA256 checksum 884f483ef3e9c7def92e3ff01b226e5cbf276d96dcb2f6f56009516f19d41dc0)}

  • Javadocs for AWS CloudHSM _{(SHA256 checksum 6343427177180c8f61eec0341e827fbba29420ed2033c0e4b4803d49a3df7763)}

• CloudHSM CLI _{(SHA256 checksum 2e62d5a27cff46d9fb47d656afeccd9dbfb5413bfd2267dd3c8fb7960fef7f26)}

RHEL 8 (8.3+)

Download version 5.9.0 software for RHEL 8 on x86_64 architecture:

• PKCS #11 library _{(SHA256 checksum 081887f6ea1d9df9d1e409b2b5bde83e965c42229acbeb1f950c8fe478361edc)}

• OpenSSL Dynamic Engine _{(SHA256 checksum 6b0500a42fd57c39f076f14e5079f80145b6ebd2c441395761eb04600c07bda5)}

• JCE provider _{(SHA256 checksum 2bc7ac26b259af92a65fbd5a30d5eb2a92ce0e70efe41feb53bf82f168aa90bb)}

  • Javadocs for AWS CloudHSM _{(SHA256 checksum 6343427177180c8f61eec0341e827fbba29420ed2033c0e4b4803d49a3df7763)}

• CloudHSM CLI _{(SHA256 checksum 79ecbe9b4c5316ccf447d8c59b76b5ac2cc854bd79cd50c1f29197aa8cb080db)}

Ubuntu 18.04 LTS

Download version 5.9.0 software for Ubuntu 18.04 LTS on x86_64 architecture:

• PKCS #11 library _{(SHA256 checksum bc6d2227edd7b5a83fed32741fbacbb1756d5df89ebb3435d96f0609a180db65)}

• OpenSSL Dynamic Engine _{(SHA256 checksum 2d6a26434fa6faf337f1dfb42de033220fa405a82d4540e279639a03b3ee6e9d)}

• JCE provider _{(SHA256 checksum e12aef122f490e9026452ce31c25625b1accb9a5866b3d470488f10f047f1873)}

  • Javadocs for AWS CloudHSM _{(SHA256 checksum 6343427177180c8f61eec0341e827fbba29420ed2033c0e4b4803d49a3df7763)}

• CloudHSM CLI _{(SHA256 checksum f0bcabe594db3e8ff86cc0f65c2a10858d34452eb6b9fc33d7aac05c0f5f4f30)}

Ubuntu 20.04 LTS

Download version 5.9.0 software for Ubuntu 20.04 LTS on x86_64 architecture:

• PKCS #11 library _{(SHA256 checksum 15dde8182f432de9e7d369b05e384e1f2d80dcca85db3b16ecc26cdef1a34bb9)}

• OpenSSL Dynamic Engine _{(SHA256 checksum c8ba94a999038af87d4905b7c1feb4cc87e20d1776a32ef6f6d11ee000b5a896)}

• JCE provider _{(SHA256 checksum de33cd3e8130a06d9da5207079533aac8276a1319ac435a3737b4f65bd8fb972)}

  • Javadocs for AWS CloudHSM _{(SHA256 checksum 6343427177180c8f61eec0341e827fbba29420ed2033c0e4b4803d49a3df7763)}

• CloudHSM CLI _{(SHA256 checksum cfa31535ad9a99a5113496c06fbace38e9593491aca9bb031a18b51075973e68)}

Windows Server 2016

Download version 5.9.0 software for Windows Server 2016 on x86_64 architecture:

• PKCS #11 library _{(SHA256 checksum ab5380805b0e17dd89dbbefd3fbda8b54da3c140f82e9f3d021850c31837bbe3)}

• JCE provider _{(SHA256 checksum f0941d7a20193818133de8a742d3b848ea19abaf25f5a71ac65949ce5a37c533)}

  • Javadocs for AWS CloudHSM _{(SHA256 checksum 6343427177180c8f61eec0341e827fbba29420ed2033c0e4b4803d49a3df7763)}

• CloudHSM CLI _{(SHA256 checksum 131530ffe5caff963d483f440d06dcfb41dc11b0f8d78f1dd07bb07f76aeb6d2)}

Windows Server 2019

Download version 5.9.0 software for Windows Server 2019 on x86_64 architecture:

• PKCS #11 library _{(SHA256 checksum ab5380805b0e17dd89dbbefd3fbda8b54da3c140f82e9f3d021850c31837bbe3)}

• JCE provider _{(SHA256 checksum f0941d7a20193818133de8a742d3b848ea19abaf25f5a71ac65949ce5a37c533)}

  • Javadocs for AWS CloudHSM _{(SHA256 checksum 6343427177180c8f61eec0341e827fbba29420ed2033c0e4b4803d49a3df7763)}

• CloudHSM CLI _{(SHA256 checksum 131530ffe5caff963d483f440d06dcfb41dc11b0f8d78f1dd07bb07f76aeb6d2)}

Client SDK 5.9.0 improves stability and includes bug fixes for all SDKs. An optimization has been made for all SDKs to inform applications of operation failure immediately when an HSM is determined unavailable. This release includes performance enhancements for JCE.

JCE provider

• Enhanced performance

• Fixed a known issue for session pool exhaustion

Version 3.4.4

To upgrade Client SDK 3 on Linux platforms, you must use a batch command that upgrades the client daemon and all the libraries at the same time. For more information about upgrade, see Client SDK 3 Upgrade.

To download the software, choose the tab for your preferred operating system, then choose the link to each software package.

Amazon Linux

Download the version 3.4.4 software for Amazon Linux:

• AWS CloudHSM Client _{(SHA256 checksum 900de424d70f41e661aa636f256a6a79cc43bea6b0fe6eb95c2aaa63e5289505)}

• PKCS #11 library _{(SHA256 checksum a3f93f084d59fee5d7c859292bc02cb7e7f15fb06e971171ebf9b52bbd229c30)}

• OpenSSL Dynamic Engine _{(SHA256 checksum 8db07b9843d49016b0b6fec46d39881d94e426fcaae1cee2747be14af9313bb0)}

• JCE provider _{(SHA256 checksum 360617c55bf4caa8e6e78ede079ca68cf9ef11473e7918154c22ba908a219843)}

• AWS CloudHSM Management Utility _{(SHA256 checksum c9961ffe38921131bd6f3702e10d73588e68b8ab10fbb241723e676f4fa8c4fa)}

Amazon Linux 2

Download the version 3.4.4 software for Amazon Linux 2:

• AWS CloudHSM Client _{(SHA256 checksum 7d61d835ae38c6ce121d102b516527f342a76ac31733768097d5cab8bc482610)}

• PKCS #11 library _{(SHA256 checksum 2099f324ff625e1a46d96c1d5084263ca1d650424d7465ead43fe767d6687f36)}

• OpenSSL Dynamic Engine _{(SHA256 checksum 6d8e81ad1208652904fe4b6abc4f174e866303f2302a6551c3fbef617337e663)}

• JCE provider _{(SHA256 checksum 70e3cdce143c45a76e155ffb5969841e0153e011f59eb9f2c6e6be0707030abf)}

• AWS CloudHSM Management Utility _{(SHA256 checksum 5a702fe5e50dc6055daa723df71a0874317c9ff5844eea30104587a61097ecf4)}

CentOS 6

AWS CloudHSM does not support CentOS 6 with Client SDK Version 3.4.4.

Use Version 3.2.1 for CentOS 6 or choose a supported platform.

CentOS 7 (7.8+)

Download the version 3.4.4 software for CentOS 7:

• AWS CloudHSM Client _{(SHA256 checksum 7d61d835ae38c6ce121d102b516527f342a76ac31733768097d5cab8bc482610)}

• PKCS #11 library _{(SHA256 checksum 2099f324ff625e1a46d96c1d5084263ca1d650424d7465ead43fe767d6687f36)}

• OpenSSL Dynamic Engine _{(SHA256 checksum 6d8e81ad1208652904fe4b6abc4f174e866303f2302a6551c3fbef617337e663)}

• JCE provider _{(SHA256 checksum 70e3cdce143c45a76e155ffb5969841e0153e011f59eb9f2c6e6be0707030abf)}

• AWS CloudHSM Management Utility _{(SHA256 checksum 5a702fe5e50dc6055daa723df71a0874317c9ff5844eea30104587a61097ecf4)}

CentOS 8

Download the version 3.4.4 software for CentOS 8:

• AWS CloudHSM Client _{(SHA256 checksum 81639c9ec83e501709c4117ba9d98b23dea7838a206ed244c9c6cc0d65130f8c)}

• PKCS #11 library _{(SHA256 checksum 9a15daa87b8616cf03a6bf6b375f53451ef448dbc54bf2c27fbc2be7823fc633)}

• JCE provider _{(SHA256 checksum 2b1c4208992903cf7bcc669c1392c59a64fbfc82e010c626ffa58d0cb8e9126b)}

• AWS CloudHSM Management Utility _{(SHA256 checksum 3adbecc802e0854c23aa4b8d80540d1748903c8dba93b6c8042fb7885051c360)}

Note

Due to the recent End of Life of CentOS 8, we will no longer be able to support this platform with next release.

RHEL 6

AWS CloudHSM does not support RedHat Enterprise Linux 6 with Client SDK Version 3.4.4.

Use Version 3.2.1 for RedHat Enterprise Linux 6 or choose a supported platform.

RHEL 7 (7.8+)

Download the version 3.4.4 software for RedHat Enterprise Linux 7:

• AWS CloudHSM Client _{(SHA256 checksum 7d61d835ae38c6ce121d102b516527f342a76ac31733768097d5cab8bc482610)}

• PKCS #11 library _{(SHA256 checksum 2099f324ff625e1a46d96c1d5084263ca1d650424d7465ead43fe767d6687f36)}

• OpenSSL Dynamic Engine _{(SHA256 checksum 6d8e81ad1208652904fe4b6abc4f174e866303f2302a6551c3fbef617337e663)}

• JCE provider _{(SHA256 checksum 70e3cdce143c45a76e155ffb5969841e0153e011f59eb9f2c6e6be0707030abf)}

• AWS CloudHSM Management Utility _{(SHA256 checksum 5a702fe5e50dc6055daa723df71a0874317c9ff5844eea30104587a61097ecf4)}

RHEL 8 (8.3+)

Download the version 3.4.4 software for RedHat Enterprise Linux 8:

• AWS CloudHSM Client _{(SHA256 checksum 81639c9ec83e501709c4117ba9d98b23dea7838a206ed244c9c6cc0d65130f8c)}

• PKCS #11 library _{(SHA256 checksum 9a15daa87b8616cf03a6bf6b375f53451ef448dbc54bf2c27fbc2be7823fc633)}

• JCE provider _{(SHA256 checksum 2b1c4208992903cf7bcc669c1392c59a64fbfc82e010c626ffa58d0cb8e9126b)}

• AWS CloudHSM Management Utility _{(SHA256 checksum 3adbecc802e0854c23aa4b8d80540d1748903c8dba93b6c8042fb7885051c360)}

Ubuntu 16.04 LTS

Download the version 3.4.4 software for Ubuntu 16.04 LTS:

• AWS CloudHSM Client _{(SHA256 checksum 317c92c2e0b5d60afab1beb947f053d13ddaacb994cccc2c2b898e997ece29b9)}

• PKCS #11 library _{(SHA256 checksum 91451c420c51488a022569fd32f052a3b988a2883ea4c2ac952acb61a2fea37c)}

• OpenSSL Dynamic Engine _{(SHA256 checksum 4098771ad0e38df9bf14d50520ca49b9395f819f0387e2bc3b0e61abb5888e66)}

• JCE provider _{(SHA256 checksum e136ff183271c2f9590a9fccb8261a7eb809506686b070e3854df1b8686c6641)}

• AWS CloudHSM Management Utility _{(SHA256 checksum cbf24a4032f393a913a9898b1b27036392104e8e05d911cab84049b2bcca2541)}

Note

Due to the impending EOL of Ubuntu 16.04, we intend to drop support for this platform with the next release.

Ubuntu 18.04 LTS

Download the version 3.4.4 software for Ubuntu 18.04 LTS:

• AWS CloudHSM Client _{(SHA256 checksum cf57d5e0e95efbf032aac8887aebd59ac8cc80e97c69e7c39fdad40873374fe8)}

• PKCS #11 library _{(SHA256 checksum 428f8bdad7925db5401112f707942ee8f3ca554f4ab53fa92237996e69144d2f)}

• JCE provider _{(SHA256 checksum 1ff17b8f7688e84f7f0bfc96383564dca598a1cab2f2c52c888d0361682f2b9e)}

• AWS CloudHSM Management Utility _{(SHA256 checksum afe253046146ed6177c520b681efc680dac1048c4a95b3d8ad0f305e79bbe93e)}

Windows Server

AWS CloudHSM supports 64-bit versions of Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, and Windows Server 2019. The AWS CloudHSM 3.4.4 client software for Windows Server includes the required CNG and KSP providers. For details, see Install and Configure the AWS CloudHSM Client (Windows). Download the latest version (3.4.4) software for Windows Server:

• AWS CloudHSM for Windows Server _{(SHA256 checksum d51a7db588e9121d8f0b0351606bd986e1c4de6547f2c8235200dc8a5ffbe53e)}

• AWS CloudHSM Management Utility _{(SHA256 checksum 0c12d7da9086735cdf189535937a8e036163009c5018dcaf2ee9cdbb6bd4c06f)}

Version 3.4.4 adds updates to JCE provider.

AWS CloudHSM Client Software

• Updated the version for consistency.

PKCS #11 library

• Updated the version for consistency.

OpenSSL Dynamic Engine

• Updated the version for consistency.

JCE provider

• Update log4j to version 2.17.1.

Windows (CNG and KSP providers)

• Updated the version for consistency.

Deprecated releases

Versions 5.8.0 and earlier are deprecated. We do not recommend using deprecated releases in production workloads. We do not provide backwards compatible updates for deprecated releases, nor do we host deprecated releases for download. If you experience production impact while using deprecated releases, you must upgrade to obtain software fixes.

Deprecated Client SDK 5 releases

This section lists deprecated Client SDK 5 releases.

Version 5.8.0

Version 5.8.0 introduces quorum authentication for CloudHSM CLI, SSL/TLS offload with JSSE, multi-slot support for PKCS #11, multi-cluster/multi-user support for JCE, key extraction with JCE, supported keyFactory for JCE, new retry configurations for non-terminal return codes, and includes improved stability and bug fixes for all SDKs.

PKCS #11 library

• Added support for multi-slot configuration.

JCE provider

• Added configuration based key extraction.

• Added support for multi-cluster and multi-user configurations.

• Added support for SSL and TLS offload with JSSE.

• Added unwrap support for AES/CBC/NoPadding.

• Added new types of key factories: SecretKeyFactory and KeyFactory.

CloudHSM CLI

• Added support for quorum authentication

Version 5.7.0

Version 5.7.0 introduces CloudHSM CLI and includes a new cipher-based message authentication code (CMAC) algorithm. This release adds ARM architecture on Amazon Linux 2. JCE provider Javadocs are now available for AWS CloudHSM.

PKCS #11 library

• Improved stability and bug fixes.

• Now supported on ARM architecture with Amazon Linux 2.

• Algorithms

  • CKM_AES_CMAC (sign and verify)

OpenSSL Dynamic Engine

• Improved stability and bug fixes.

• Now supported on ARM architecture with Amazon Linux 2.

JCE provider

• Improved stability and bug fixes.

• Algorithms

  • AESCMAC

Version 5.6.0

Version 5.6.0 includes new mechanism support for PKCS #11 library and JCE provider. Additionally, version 5.6 supports Ubuntu 20.04.

PKCS #11 library

• Improved stability and bug fixes.

• Mechanisms

  • CKM_RSA_X_509, for encrypt, decrypt, sign, and verify modes

OpenSSL Dynamic Engine

• Improved stability and bug fixes.

JCE provider

• Improved stability and bug fixes.

• Ciphers

  • RSA/ECB/NoPadding, for encrypt and decrypt modes

Supported keys

• EC with curves secp224r1 and secp521r1

Platform support

• Added support for Ubuntu 20.04.

Version 5.5.0

Version 5.5.0 adds support for OpenJDK 11, Keytool and Jarsigner integration, and additional mechanisms to the JCE provider. Resolves a known issue regarding a KeyGenerator class incorrectly interpreting key size parameter as number of bytes instead of bits.

PKCS #11 library

• Improved stability and bug fixes.

OpenSSL Dynamic Engine

• Improved stability and bug fixes.

JCE provider

• Support for the Keytool and Jarsigner utilities

• Support for OpenJDK 11 on all platforms

• Ciphers

  • AES/CBC/NoPadding Encrypt and Decrypt mode

  • AES/ECB/PKCS5Padding Encrypt and Decrypt mode

  • AES/CTR/NoPadding Encrypt and Decrypt mode

  • AES/GCM/NoPadding Wrap and Unwrap mode

  • DESede/ECB/PKCS5Padding Encrypt and Decrypt mode

  • DESede/CBC/NoPadding Encrypt and Decrypt mode

  • AESWrap/ECB/NoPadding Wrap and Unwrap mode

  • AESWrap/ECB/PKCS5Padding Wrap and Unwrap mode

  • AESWrap/ECB/ZeroPadding Wrap and Unwrap mode

  • RSA/ECB/PKCS1Padding Wrap and Unwrap mode

  • RSA/ECB/OAEPPadding Wrap and Unwrap mode

  • RSA/ECB/OAEPWithSHA-1ANDMGF1Padding Wrap and Unwrap mode

  • RSA/ECB/OAEPWithSHA-224ANDMGF1Padding Wrap and Unwrap mode

  • RSA/ECB/OAEPWithSHA-256ANDMGF1Padding Wrap and Unwrap mode

  • RSA/ECB/OAEPWithSHA-384ANDMGF1Padding Wrap and Unwrap mode

  • RSA/ECB/OAEPWithSHA-512ANDMGF1Padding Wrap and Unwrap mode

  • RSAAESWrap/ECB/OAEPPadding Wrap and Unwrap mode

  • RSAAESWrap/ECB/OAEPWithSHA-1ANDMGF1Padding Wrap and Unwrap mode

  • RSAAESWrap/ECB/OAEPWithSHA-224ANDMGF1Padding Wrap and Unwrap mode

  • RSAAESWrap/ECB/OAEPWithSHA-256ANDMGF1Padding Wrap and Unwrap mode

  • RSAAESWrap/ECB/OAEPWithSHA-384ANDMGF1Padding Wrap and Unwrap mode

  • RSAAESWrap/ECB/OAEPWithSHA-512ANDMGF1Padding Wrap and Unwrap mode

• KeyFactory and SecretKeyFactory

  • RSA – 2048-bit to 4096-bit RSA keys, in increments of 256 bits

  • AES – 128, 192, and 256-bit AES keys

  • EC key pairs for NIST curves secp256r1 (P-256), secp384r1 (P-384), and secp256k1

  • DESede (3DES)

  • GenericSecret

  • HMAC – with SHA1, SHA224, SHA256, SHA384, SHA512 hash support

• Sign/Verify

  • RSASSA-PSS

  • SHA1withRSA/PSS

  • SHA224withRSA/PSS

  • SHA256withRSA/PSS

  • SHA384withRSA/PSS

  • SHA512withRSA/PSS

  • SHA1withRSAandMGF1

  • SHA224withRSAandMGF1

  • SHA256withRSAandMGF1

  • SHA384withRSAandMGF1

  • SHA512withRSAandMGF1

Version 5.4.2

Version 5.4.2 includes improved stability and bug fixes for all SDKs. This is also the last release for the CentOS 8 platform. For more information, see the CentOS website.

PKCS #11 library

• Improved stability and bug fixes.

OpenSSL Dynamic Engine

• Improved stability and bug fixes.

JCE provider

• Improved stability and bug fixes.

Version 5.4.1

Version 5.4.1 resolves a known issue with the PKCS #11 library. This is also the last release for the CentOS 8 platform. For more information, see the CentOS website.

PKCS #11 library

• Improved stability and bug fixes.

OpenSSL Dynamic Engine

• Improved stability and bug fixes.

JCE provider

• Improved stability and bug fixes.

Version 5.4.0

Version 5.4.0 adds initial support for the JCE provider for all platforms. The JCE provider is compatible with OpenJDK 8.

PKCS #11 library

• Improved stability and bug fixes.

OpenSSL Dynamic Engine

• Improved stability and bug fixes.

JCE provider

• Key types

  • RSA – 2048-bit to 4096-bit RSA keys, in increments of 256 bits.

  • AES – 128, 192, and 256-bit AES keys.

  • ECC key pairs for NIST curves secp256r1 (P-256), secp384r1 (P-384), and secp256k1.

  • DESede (3DES)

  • HMAC – with SHA1, SHA224, SHA256, SHA384, SHA512 hash support.

• Ciphers (encrypt and decrypt only)

  • AES/GCM/NoPadding

  • AES/ECB/NoPadding

  • AES/CBC/PKCS5Padding

  • DESede/ECB/NoPadding

  • DESede/CBC/PKCS5Padding

  • AES/CTR/NoPadding

  • RSA/ECB/PKCS1Padding

  • RSA/ECB/OAEPPadding

  • RSA/ECB/OAEPWithSHA-1ANDMGF1Padding

  • RSA/ECB/OAEPWithSHA-224ANDMGF1Padding

  • RSA/ECB/OAEPWithSHA-256ANDMGF1Padding

  • RSA/ECB/OAEPWithSHA-384ANDMGF1Padding

  • RSA/ECB/OAEPWithSHA-512ANDMGF1Padding

• Digests

  • SHA-1

  • SHA-224

  • SHA-256

  • SHA-384

  • SHA-512

• Sign/Verify

  • NONEwithRSA

  • SHA1withRSA

  • SHA224withRSA

  • SHA256withRSA

  • SHA384withRSA

  • SHA512withRSA

  • NONEwithECDSA

  • SHA1withECDSA

  • SHA224withECDSA

  • SHA256withECDSA

  • SHA384withECDSA

  • SHA512withECDSA

• Integration with the Java KeyStore

Version 5.3.0

PKCS #11 library

• Improved stability and bug fixes.

OpenSSL Dynamic Engine

• Add support for ECDSA sign/verify with curves P-256, P-384, and secp256k1.

• Add support for the platforms: Amazon Linux, Amazon Linux 2, Centos 7.8+, RHEL 7 (7.8+).

• Add support for OpenSSL version 1.0.2.

• Improved stability and bug fixes.

JCE provider

• Key types

  • RSA – 2048-bit to 4096-bit RSA keys, in increments of 256 bits.

  • AES – 128, 192, and 256-bit AES keys.

  • EC key pairs for NIST curves secp256r1 (P-256), secp384r1 (P-384), and secp256k1.

  • DESede (3DES)

  • HMAC – with SHA1, SHA224, SHA256, SHA384, SHA512 hash support.

• Ciphers (encrypt and decrypt only)

  • AES/GCM/NoPadding

  • AES/ECB/NoPadding

  • AES/CBC/PKCS5Padding

  • DESede/ECB/NoPadding

  • DESede/CBC/PKCS5Padding

  • AES/CTR/NoPadding

  • RSA/ECB/PKCS1Padding

  • RSA/ECB/OAEPPadding

  • RSA/ECB/OAEPWithSHA-1ANDMGF1Padding

  • RSA/ECB/OAEPWithSHA-224ANDMGF1Padding

  • RSA/ECB/OAEPWithSHA-256ANDMGF1Padding

  • RSA/ECB/OAEPWithSHA-384ANDMGF1Padding

  • RSA/ECB/OAEPWithSHA-512ANDMGF1Padding

• Digests

  • SHA-1

  • SHA-224

  • SHA-256

  • SHA-384

  • SHA-512

• Sign/Verify

  • NONEwithRSA

  • SHA1withRSA

  • SHA224withRSA

  • SHA256withRSA

  • SHA384withRSA

  • SHA512withRSA

  • NONEwithECDSA

  • SHA1withECDSA

  • SHA224withECDSA

  • SHA256withECDSA

  • SHA384withECDSA

  • SHA512withECDSA

• Integration with the Java KeyStore

Version 5.2.1

PKCS #11 library

• Improved stability and bug fixes.

OpenSSL Dynamic Engine

• Improved stability and bug fixes.

Version 5.2.0

Version 5.2.0 adds support additional key types and mechanisms to the PKCS #11 library.

PKCS #11 library

Key Types

• ECDSA– P-224, P-256, P-384, P-521 and secp256k1 curves

• Triple DES (3DES)

Mechanisms

• CKM_EC_KEY_PAIR_GEN

• CKM_DES3_KEY_GEN

• CKM_DES3_CBC

• CKM_DES3_CBC_PAD

• CKM_DES3_ECB

• CKM_ECDSA

• CKM_ECDSA_SHA1

• CKM_ECDSA_SHA224

• CKM_ECDSA_SHA256

• CKM_ECDSA_SHA384

• CKM_ECDSA_SHA512

• CKM_RSA_PKCS for Encrypt/Decrypt

OpenSSL Dynamic Engine

• Improved stability and bug fixes.

Version 5.1.0

Version 5.1.0 adds support for additional mechanisms to the PKCS #11 library.

PKCS #11 library

Mechanisms

• CKM_RSA_PKCS for Wrap/Unwrap

• CKM_RSA_PKCS_PSS

• CKM_SHA1_RSA_PKCS_PSS

• CKM_SHA224_RSA_PKCS_PSS

• CKM_SHA256_RSA_PKCS_PSS

• CKM_SHA384_RSA_PKCS_PSS

• CKM_SHA512_RSA_PKCS_PSS

• CKM_AES_ECB

• CKM_AES_CTR

• CKM_AES_CBC

• CKM_AES_CBC_PAD

• CKM_SP800_108_COUNTER_KDF

• CKM_GENERIC_SECRET_KEY_GEN

• CKM_SHA_1_HMAC

• CKM_SHA224_HMAC

• CKM_SHA256_HMAC

• CKM_SHA384_HMAC

• CKM_SHA512_HMAC

• CKM_RSA_PKCS_OAEP Wrap/Unwrap only

• CKM_RSA_AES_KEY_WRAP

• CKM_CLOUDHSM_AES_KEY_WRAP_NO_PAD

• CKM_CLOUDHSM_AES_KEY_WRAP_PKCS5_PAD

• CKM_CLOUDHSM_AES_KEY_WRAP_ZERO_PAD

API Operations

• C_CreateObject

• C_DeriveKey

• C_WrapKey

• C_UnWrapKey

OpenSSL Dynamic Engine

• Improved stability and bug fixes.

Version 5.0.1

Version 5.0.1 adds initial support for OpenSSL Dynamic Engine.

PKCS #11 library

• Improved stability and bug fixes.

OpenSSL Dynamic Engine

• Initial release of OpenSSL Dynamic Engine.

• This release offers introductory support for key types and OpenSSL APIs:

  • RSA key generation for 2048, 3072, and 4096-bit keys

  • OpenSSL APIs:

    • RSA Sign using RSA PKCS with SHA1/224/256/384/512 & RSA PSS

    • RSA Key Generation

  For more information, see OpenSSL Dynamic Engine.

• Platforms supported: CentOS 8.3+, Red Hat Enterprise Linux (RHEL) 8.3+, and Ubuntu 18.04 LTS

  • Requires: OpenSSL 1.1.1

  For more information, see Supported Platforms.

• Support for SSL/TLS Offload on CentOS 8.3+, Red Hat Enterprise Linux (RHEL) 8.3, and Ubuntu 18.04 LTS, including NGINX 1.19 (for select cipher suites).

  For more information, see Using SSL/TLS Offload on Linux.

Version 5.0.0

Version 5.0.0 is the first release.

PKCS #11 library

• This is the initial release.

Introductory PKCS #11 library support in client SDK version 5.0.0

This section details support for key types, mechanisms, API operations and attributes Client SDK version 5.0.0.

Key Types:

• AES– 128, 192, and 256-bit AES keys

• RSA– 2048-bit to 4096-bit RSA keys, in increments of 256 bits

Mechanisms:

• CKM_AES_GCM

• CKM_AES_KEY_GEN

• CKM_CLOUDHSM_AES_GCM

• CKM_RSA_PKCS

• CKM_RSA_X9_31_KEY_PAIR_GEN

• CKM_SHA1

• CKM_SHA1_RSA_PKCS

• CKM_SHA224

• CKM_SHA224_RSA_PKCS

• CKM_SHA256

• CKM_SHA256_RSA_PKCS

• CKM_SHA384

• CKM_SHA384_RSA_PKCS

• CKM_SHA512

• CKM_SHA512_RSA_PKCS

Show moreShow less

API Operations:

• C_CloseAllSessions

• C_CloseSession

• C_Decrypt

• C_DecryptFinal

• C_DecryptInit

• C_DecryptUpdate

• C_DestroyObject

• C_Digest

• C_DigestFinal

• C_DigestInit

• C_DigestUpdate

• C_Encrypt

• C_EncryptFinal

• C_EncryptInit

• C_EncryptUpdate

• C_Finalize

• C_FindObjects

• C_FindObjectsFinal

• C_FindObjectsInit

• C_GenerateKey

• C_GenerateKeyPair

• C_GenerateRandom

• C_GetAttributeValue

• C_GetFunctionList

• C_GetInfo

• C_GetMechanismInfo

• C_GetMechanismList

• C_GetSessionInfo

• C_GetSlotInfo

• C_GetSlotList

• C_GetTokenInfo

• C_Initialize

• C_Login

• C_Logout

• C_OpenSession

• C_Sign

• C_SignFinal

• C_SignInit

• C_SignUpdate

• C_Verify

• C_VerifyFinal

• C_VerifyInit

• C_VerifyUpdate

Show moreShow less

Attributes:

• GenerateKeyPair

  • All RSA Key attributes

• GenerateKey

  • All AES Key attributes

• GetAttributeValue

  • All RSA Key attributes

  • All AES Key attributes

Samples:

• Generate keys (AES, RSA, EC)

• List key attributes

• Encrypt and decrypt data with AES GCM

• Sign and verify data with RSA

Deprecated Client SDK 3 releases

This section lists deprecated Client SDK 3 releases.

Version 3.4.3

Version 3.4.3 adds updates to JCE provider.

AWS CloudHSM Client Software

• Updated the version for consistency.

PKCS #11 library

• Updated the version for consistency.

OpenSSL Dynamic Engine

• Updated the version for consistency.

JCE provider

• Update log4j to version 2.17.0.

Windows (CNG and KSP providers)

• Updated the version for consistency.

Version 3.4.2

Version 3.4.2 adds updates to JCE provider.

AWS CloudHSM Client Software

• Updated the version for consistency.

PKCS #11 library

• Updated the version for consistency.

OpenSSL Dynamic Engine

• Updated the version for consistency.

JCE provider

• Update log4j to version 2.16.0.

Windows (CNG and KSP providers)

• Updated the version for consistency.

Version 3.4.1

Version 3.4.1 adds updates to JCE provider.

AWS CloudHSM Client Software

• Updated the version for consistency.

PKCS #11 library

• Updated the version for consistency.

OpenSSL Dynamic Engine

• Updated the version for consistency.

JCE provider

• Update log4j to version 2.15.0.

Windows (CNG and KSP providers)

• Updated the version for consistency.

Version 3.4.0

Version 3.4.0 adds updates to all components.

AWS CloudHSM Client Software

• Improved stability and bug fixes.

PKCS #11 library

• Improved stability and bug fixes.

OpenSSL Dynamic Engine

• Improved stability and bug fixes.

JCE provider

• Improved stability and bug fixes.

Windows (CNG and KSP providers)

• Improved stability and bug fixes.

Version 3.3.2

Version 3.3.2 resolves an issue with the client_info script.

AWS CloudHSM Client Software

• Updated the version for consistency.

PKCS #11 library

• Updated the version for consistency.

OpenSSL Dynamic Engine

• Updated the version for consistency.

JCE provider

• Updated the version for consistency.

Windows (CNG and KSP providers)

• Updated the version for consistency.

Version 3.3.1

Version 3.3.1 adds updates to all components.

AWS CloudHSM Client Software

• Improved stability and bug fixes.

PKCS #11 library

• Improved stability and bug fixes.

OpenSSL Dynamic Engine

• Improved stability and bug fixes.

JCE provider

• Improved stability and bug fixes.

Windows (CNG and KSP providers)

• Improved stability and bug fixes.

Version 3.3.0

Version 3.3.0 adds two-factor authentication (2FA) and other improvements.

AWS CloudHSM Client Software

• Added 2FA authentication for crypto officers (CO). For more information, see Managing Two-Factor Authentication for Crypto Officers.

• Removed platform support for RedHat Enterprise Linux 6 and CentOS 6. For more information, see Linux Support.

• Added a standalone version of CMU for use with Client SDK 5 or Client SDK 3. This is the same version of CMU included with the client daemon of version 3.3.0, and now you can download CMU without downloading the client daemon.

PKCS #11 library

• Improved stability and bug fixes.

• Removed platform support for RedHat Enterprise Linux 6 and CentOS 6. For more information, see Linux Support.

OpenSSL Dynamic Engine

• Updated the version for consistency

• Removed platform support for RedHat Enterprise Linux 6 and CentOS 6. For more information, see Linux Support.

JCE provider

• Improved stability and bug fixes.

• Removed platform support for RedHat Enterprise Linux 6 and CentOS 6. For more information, see Linux Support.

Windows (CNG and KSP providers)

• Updated the version for consistency

Version 3.2.1

Version 3.2.1 adds a compliance analysis between the AWS CloudHSM implementation of the PKCS #11 library and the PKCS #11 standard, new platforms, and other improvements.

AWS CloudHSM Client Software

• Add platform support for CentOS 8, RHEL 8, and Ubuntu 18.04 LTS. For more information, see Client SDK 5 supported platforms.

PKCS #11 library

• PKCS #11 library compliance report for client SDK 3.2.1

• Add platform support for CentOS 8, RHEL 8, and Ubuntu 18.04 LTS. For more information, see Client SDK 5 supported platforms.

OpenSSL Dynamic Engine

• No support for CentOS 8, RHEL 8, and Ubuntu 18.04 LTS. For more information, see Known issues for the OpenSSL Dynamic Engine.

JCE provider

• Add platform support for CentOS 8, RHEL 8, and Ubuntu 18.04 LTS. For more information, see Client SDK 5 supported platforms.

Windows (CNG and KSP providers)

• Improved stability and bug fixes.

Version 3.2.0

Version 3.2.0 adds support for masking passwords and other improvements.

AWS CloudHSM Client Software

• Adds support for hiding your password when using command-line tools. For more information, see loginHSM and logoutHSM (cloudhsm_mgmt_util) and loginHSM and logoutHSM (key_mgmt_util).

PKCS #11 library

• Adds support for hashing large data in software for some PKCS #11 mechanisms that were previously unsupported. For more information, see Supported Mechanisms.

OpenSSL Dynamic Engine

• Improved stability and bug fixes.

JCE provider

• Updated the version for consistency.

Windows (CNG and KSP providers)

• Improved stability and bug fixes.

Version 3.1.2

Version 3.1.2 adds updates to JCE provider.

AWS CloudHSM Client Software

• Updated the version for consistency

PKCS #11 library

• Updated the version for consistency

OpenSSL Dynamic Engine

• Updated the version for consistency

JCE provider

• Update log4j to version 2.13.3

Windows (CNG and KSP providers)

• Updated the version for consistency

Version 3.1.1

AWS CloudHSM Client Software

• Updated the version for consistency.

PKCS #11 Library

• Updated the version for consistency.

OpenSSL Dynamic Engine

• Updated the version for consistency.

JCE provider

• Bug fixes and performance improvements.

Windows (CNG, KSP)

• Updated the version for consistency.

Version 3.1.0

Version 3.1.0 adds standards-compliant AES key wrapping.

AWS CloudHSM Client Software

• A new requirement for upgrade: the version of your client must match the version of any software libraries you are using. To upgrade, you must use a batch command that upgrades the client and all the libraries at the same time. For more information, see Client SDK 3 Upgrade.

• Key_mgmt_util (KMU) includes the following updates:

  • Added two new AES key wrap methods – standards-compliant AES key wrap with zero padding and AES key wrap with no padding. For more information, see wrapKey and unwrapKey.

  • Disabled ability to specify custom IV when wrapping a key using AES_KEY_WRAP_PAD_PKCS5. For more information, see AES Key Wrapping.

PKCS #11 Library

• Added two new AES key wrap methods - standards-compliant AES key wrap with zero padding and AES key wrap with no padding. For more information, see AES Key Wrapping.

• You can configure salt length for RSA-PSS signatures. To learn how to use this feature, see Configurable salt length for RSA-PSS signatures on GitHub.

OpenSSL Dynamic Engine

• BREAKING CHANGE: TLS 1.0 and 1.2 cipher suites with SHA1 are not available in OpenSSL Engine 3.1.0. This issue will be resolved shortly.

• If you intend to install the OpenSSL Dynamic Engine library on RHEL 6 or CentOS 6, see a known issue about the default OpenSSL version installed on those operating systems.

• Improved stability and bug fixes

JCE provider

• BREAKING CHANGE: To address an issue with Java Cryptography Extension (JCE) compliance, AES wrap and unwrap now properly use the AESWrap algorithm instead of the AES algorithm. This means Cipher.WRAP_MODE and Cipher.UNWRAP_MODE no longer succeed for AES/ECB and AES/CBC mechanisms.

  To upgrade to client version 3.1.0, you must update your code. If you have existing wrapped keys, you must pay particular attention to the mechanism you use to unwrap and how IV defaults have changed. If you wrapped keys with client version 3.0.0 or earlier, then in 3.1.1 you must use AESWrap/ECB/PKCS5Padding to unwrap your existing keys. For more information, see AES Key Wrapping.

• You can list multiple keys with the same label from the JCE provider. To learn how to iterate through all available keys, see Find all keys on GitHub.

• You can set more restrictive values for attributes during key creation, including specifying different labels for public and private keys. For more information, see Supported Java Attributes.

Windows (CNG, KSP)

• Improved stability and bug fixes.

End-of-life releases

AWS CloudHSM announces end of life for releases no longer compatible with the service. To preserve the safety of your application, we reserve the right to actively refuse connections from end-of-life releases.

• Currently no versions of the client SDK are end-of-life releases.