Installing the PKCS #11 Library - AWS CloudHSM

Installing the PKCS #11 Library

This topic provides PKCS #11 library installation instruction for Client SDK 5 and Client SDK 3. For more information about the Client SDK or PKCS #11 library, see Using the Client SDK and PKCS #11 Library.

Client SDK 3 Install

The PKCS #11 library requires the AWS CloudHSM client.

If you haven't installed and configured the AWS CloudHSM client, do that now by following the steps at Install the Client (Linux). After you install and configure the client, use the following command to start it.

Amazon Linux
$ sudo start cloudhsm-client
Amazon Linux 2
$ sudo service cloudhsm-client start
CentOS 7
$ sudo service cloudhsm-client start
CentOS 8
$ sudo service cloudhsm-client start
RHEL 7
$ sudo service cloudhsm-client start
RHEL 8
$ sudo service cloudhsm-client start
Ubuntu 16.04 LTS
$ sudo service cloudhsm-client start
Ubuntu 18.04 LTS
$ sudo service cloudhsm-client start

The following command downloads and installs the PKCS #11 library.

Amazon Linux
$ wget https://s3.amazonaws.com/cloudhsmv2-software/CloudHsmClient/EL6/cloudhsm-client-pkcs11-latest.el6.x86_64.rpm
$ sudo yum install ./cloudhsm-client-pkcs11-latest.el6.x86_64.rpm
Amazon Linux 2
$ wget https://s3.amazonaws.com/cloudhsmv2-software/CloudHsmClient/EL7/cloudhsm-client-pkcs11-latest.el7.x86_64.rpm
$ sudo yum install ./cloudhsm-client-pkcs11-latest.el7.x86_64.rpm
CentOS 7
$ wget https://s3.amazonaws.com/cloudhsmv2-software/CloudHsmClient/EL7/cloudhsm-client-pkcs11-latest.el7.x86_64.rpm
$ sudo yum install ./cloudhsm-client-pkcs11-latest.el7.x86_64.rpm
CentOS 8
$ wget https://s3.amazonaws.com/cloudhsmv2-software/CloudHsmClient/EL8/cloudhsm-client-pkcs11-latest.el8.x86_64.rpm
$ sudo yum install ./cloudhsm-client-pkcs11-latest.el8.x86_64.rpm
RHEL 7
$ wget https://s3.amazonaws.com/cloudhsmv2-software/CloudHsmClient/EL7/cloudhsm-client-pkcs11-latest.el7.x86_64.rpm
$ sudo yum install ./cloudhsm-client-pkcs11-latest.el7.x86_64.rpm
RHEL 8
$ wget https://s3.amazonaws.com/cloudhsmv2-software/CloudHsmClient/EL8/cloudhsm-client-pkcs11-latest.el8.x86_64.rpm
$ sudo yum install ./cloudhsm-client-pkcs11-latest.el8.x86_64.rpm
Ubuntu 16.04 LTS
$ wget https://s3.amazonaws.com/cloudhsmv2-software/CloudHsmClient/Xenial/cloudhsm-client-pkcs11_latest_amd64.deb
$ sudo apt install ./cloudhsm-client-pkcs11_latest_amd64.deb
Ubuntu 18.04 LTS
$ wget https://s3.amazonaws.com/cloudhsmv2-software/CloudHsmClient/Bionic/cloudhsm-client-pkcs11_latest_u18.04_amd64.deb
$ sudo apt install ./cloudhsm-client-pkcs11_latest_u18.04_amd64.deb
  • If the EC2 instance on which you installed the PKCS #11 library has no other components from Client SDK 3 installed, you must bootstrap Client SDK 3. You only have to do this once on each instance with a component from Client SDK 3.

    For more information about bootstrapping, see Connecting to the Cluster.

  • You can find the PKCS #11 library files in the following locations:

    Linux binaries, configuration scripts, certificates, and log files:

    /opt/cloudhsm/lib

Client SDK 5 Install

With Client SDK 5, you are not required to install or run a client daemon.

To run a single HSM cluster with Client SDK 5, you must first manage client key durability settings by setting disable_key_availability_check to True. For more information, see Key Synchronization and Client SDK 5 Configure Tool.

For more information about the PKCS #11 library in Client SDK 5, see PKCS #11 Library.

Note

Client SDK 5 does not offer parity support with Client SDK 3. Look for call outs throughout this portion of the guide to identify what Client SDK 5 supports. For more information, see .

  • Download and install the PKCS #11 library.

    Amazon Linux
    $ wget https://s3.amazonaws.com/cloudhsmv2-software/CloudHsmClient/EL6/cloudhsm-pkcs11-latest.el6.x86_64.rpm
    $ sudo yum install ./cloudhsm-pkcs11-latest.el6.x86_64.rpm
    Amazon Linux 2
    $ wget https://s3.amazonaws.com/cloudhsmv2-software/CloudHsmClient/EL7/cloudhsm-pkcs11-latest.el7.x86_64.rpm
    $ sudo yum install ./cloudhsm-pkcs11-latest.el7.x86_64.rpm
    CentOS 7.8+
    $ wget https://s3.amazonaws.com/cloudhsmv2-software/CloudHsmClient/EL7/cloudhsm-pkcs11-latest.el7.x86_64.rpm
    $ sudo yum install ./cloudhsm-pkcs11-latest.el7.x86_64.rpm
    CentOS 8.3+
    $ wget https://s3.amazonaws.com/cloudhsmv2-software/CloudHsmClient/EL8/cloudhsm-pkcs11-latest.el8.x86_64.rpm
    $ sudo yum install ./cloudhsm-pkcs11-latest.el8.x86_64.rpm
    RHEL 7.8+
    $ wget https://s3.amazonaws.com/cloudhsmv2-software/CloudHsmClient/EL7/cloudhsm-pkcs11-latest.el7.x86_64.rpm
    $ sudo yum install ./cloudhsm-pkcs11-latest.el7.x86_64.rpm
    RHEL 8.3+
    $ wget https://s3.amazonaws.com/cloudhsmv2-software/CloudHsmClient/EL8/cloudhsm-pkcs11-latest.el8.x86_64.rpm
    $ sudo yum install ./cloudhsm-pkcs11-latest.el8.x86_64.rpm
    Ubuntu 18.04 LTS
    $ wget https://s3.amazonaws.com/cloudhsmv2-software/CloudHsmClient/Bionic/cloudhsm-pkcs11_latest_u18.04_amd64.deb
    $ sudo apt install ./cloudhsm-pkcs11_latest_u18.04_amd64.deb
    Windows Server 2016
    1. Download PKCS #11 Library for Client SDK 5.

    2. Run the PKCS #11 library installer (AWSCloudHSMPKCS11-latest.msi) with Windows administrative privilege.

    Windows Server 2019
    1. Download PKCS #11 Library for Client SDK 5.

    2. Run the PKCS #11 library installer (AWSCloudHSMPKCS11-latest.msi) with Windows administrative privilege.

  • You must bootstrap Client SDK 5. For more information about bootstrapping, see Bootstrapping the Client SDK.

  • You can find the PKCS #11 library files in the following locations:

    Linux binaries, configuration scripts, and log files:

    /opt/cloudhsm/lib

    Windows binaries:

    C:\ProgramFiles\Amazon\CloudHSM

    Windows configuration scripts and log files:

    C:\ProgramData\Amazon\CloudHSM