安装和配置 AWS CloudHSM 客户端 (Linux)

要与 AWS CloudHSM 集群中的 HSM 进行交互，您需要适用于 Linux 的 AWS CloudHSM 客户端软件。您应在之前创建的 Linux EC2 客户端实例上安装该软件。如果您使用的是 Windows，也可以安装客户端。有关更多信息，请参阅 安装和配置 AWS CloudHSM 客户端 (Windows)。

安装 AWS CloudHSM 客户端和命令行工具

连接到您的客户端实例并运行以下命令来下载和安装 AWS CloudHSM 客户端和命令行工具。

Amazon Linux

wget https://s3.amazonaws.com/cloudhsmv2-software/CloudHsmClient/EL6/cloudhsm-client-latest.el6.x86_64.rpm

sudo yum install ./cloudhsm-client-latest.el6.x86_64.rpm

Amazon Linux 2

wget https://s3.amazonaws.com/cloudhsmv2-software/CloudHsmClient/EL7/cloudhsm-client-latest.el7.x86_64.rpm

sudo yum install ./cloudhsm-client-latest.el7.x86_64.rpm

CentOS 7

sudo yum install wget

wget https://s3.amazonaws.com/cloudhsmv2-software/CloudHsmClient/EL7/cloudhsm-client-latest.el7.x86_64.rpm

sudo yum install ./cloudhsm-client-latest.el7.x86_64.rpm

CentOS 8

sudo yum install wget

wget https://s3.amazonaws.com/cloudhsmv2-software/CloudHsmClient/EL8/cloudhsm-client-latest.el8.x86_64.rpm

sudo yum install ./cloudhsm-client-latest.el8.x86_64.rpm

RHEL 7

sudo yum install wget

wget https://s3.amazonaws.com/cloudhsmv2-software/CloudHsmClient/EL7/cloudhsm-client-latest.el7.x86_64.rpm

sudo yum install ./cloudhsm-client-latest.el7.x86_64.rpm

RHEL 8

sudo yum install wget

wget https://s3.amazonaws.com/cloudhsmv2-software/CloudHsmClient/EL8/cloudhsm-client-latest.el8.x86_64.rpm

sudo yum install ./cloudhsm-client-latest.el8.x86_64.rpm

Ubuntu 16.04 LTS

wget https://s3.amazonaws.com/cloudhsmv2-software/CloudHsmClient/Xenial/cloudhsm-client_latest_amd64.deb

sudo apt install ./cloudhsm-client_latest_amd64.deb

Ubuntu 18.04 LTS

wget https://s3.amazonaws.com/cloudhsmv2-software/CloudHsmClient/Bionic/cloudhsm-client_latest_u18.04_amd64.deb

sudo apt install ./cloudhsm-client_latest_u18.04_amd64.deb

编辑客户端配置

必须先编辑 AWS CloudHSM 客户端配置，然后才能使用客户端连接到集群。

编辑客户端配置

1. 如果在 cloudhsm_mgmt_util 上安装客户端软件开发工具包 3，请完成以下步骤以确保集群中的所有节点都已同步。

   1. 运行 configure -a <IP of one of the HSMs>。

   2. 重新启动客户端服务。

   3. 运行 config -m。

2. 将您的颁发证书 — 用于签署集群证书的证书 — 复制到客户端实例上的以下位置：/opt/cloudhsm/etc/customerCA.crt。您需要在客户端实例上具有实例根用户权限才能将您的证书复制到该位置。

3. 使用以下 configure 命令更新 AWS CloudHSM 客户端和命令行工具的配置文件，指定集群中 HSM 的 IP 地址。要获取 HSM 的 IP 地址，请在AWS CloudHSM 控制台中查看您的集群，或者运行describe-clusters AWS CLI 命令。在命令输出中，HSM 的 IP 地址为 EniIp 字段的值。如果您有多个 HSM，请选择其中任一 HSM 的 IP 地址；选择哪个 HSM 并不重要。

   sudo /opt/cloudhsm/bin/configure -a <IP address>
   	
   Updating server config in /opt/cloudhsm/etc/cloudhsm_client.cfg
   Updating server config in /opt/cloudhsm/etc/cloudhsm_mgmt_util.cfg
   
   

4. 转到 激活集群。