为 KMU (Linux) 安装和配置 AWS CloudHSM 客户端

要使用 key_mgmt_util (HSM) 与 AWS CloudHSM 集群中的硬件安全模块 () 进行交互，你需要适用于 Linu KMU x 的客户端软件。 AWS CloudHSM 您应该将其安装在之前创建的 Linux EC2 客户端实例上。如果您使用的是 Windows，也可以安装客户端。有关更多信息，请参阅 安装和配置适用于 KMU (Windows) 的 AWS CloudHSM 客户端。

第 1 步。安装 AWS CloudHSM 客户端和命令行工具

连接到您的客户端实例并运行以下命令来下载和安装 AWS CloudHSM 客户端和命令行工具。

Amazon Linux

wget https://s3.amazonaws.com/cloudhsmv2-software/CloudHsmClient/EL6/cloudhsm-client-latest.el6.x86_64.rpm

sudo yum install ./cloudhsm-client-latest.el6.x86_64.rpm

Amazon Linux 2

wget https://s3.amazonaws.com/cloudhsmv2-software/CloudHsmClient/EL7/cloudhsm-client-latest.el7.x86_64.rpm

sudo yum install ./cloudhsm-client-latest.el7.x86_64.rpm

CentOS 7

sudo yum install wget

wget https://s3.amazonaws.com/cloudhsmv2-software/CloudHsmClient/EL7/cloudhsm-client-latest.el7.x86_64.rpm

sudo yum install ./cloudhsm-client-latest.el7.x86_64.rpm

CentOS 8

sudo yum install wget

wget https://s3.amazonaws.com/cloudhsmv2-software/CloudHsmClient/EL8/cloudhsm-client-latest.el8.x86_64.rpm

sudo yum install ./cloudhsm-client-latest.el8.x86_64.rpm

RHEL 7

sudo yum install wget

wget https://s3.amazonaws.com/cloudhsmv2-software/CloudHsmClient/EL7/cloudhsm-client-latest.el7.x86_64.rpm

sudo yum install ./cloudhsm-client-latest.el7.x86_64.rpm

RHEL 8

sudo yum install wget

wget https://s3.amazonaws.com/cloudhsmv2-software/CloudHsmClient/EL8/cloudhsm-client-latest.el8.x86_64.rpm

sudo yum install ./cloudhsm-client-latest.el8.x86_64.rpm

Ubuntu 16.04 LTS

wget https://s3.amazonaws.com/cloudhsmv2-software/CloudHsmClient/Xenial/cloudhsm-client_latest_amd64.deb

sudo apt install ./cloudhsm-client_latest_amd64.deb

Ubuntu 18.04 LTS

wget https://s3.amazonaws.com/cloudhsmv2-software/CloudHsmClient/Bionic/cloudhsm-client_latest_u18.04_amd64.deb

sudo apt install ./cloudhsm-client_latest_u18.04_amd64.deb

第 2 步。编辑客户端配置

必须先编辑 AWS CloudHSM 客户端配置，然后才能使用客户端连接到您的集群。

编辑客户端配置

1. 将您的颁发证书 — 用于签署集群证书的证书 — 复制到客户端实例上的以下位置：/opt/cloudhsm/etc/customerCA.crt。您需要在客户端实例上具有实例根用户权限才能将您的证书复制到该位置。

2. 使用以下 configure 命令更新 AWS CloudHSM 客户端和命令行工具的配置文件，指定集群HSM中的 IP 地址。要获取HSM的 IP 地址，请在AWS CloudHSM 控制台中查看您的集群，或者运行describe-clusters AWS CLI 命令。在命令的输出中，HSM的 IP 地址是该EniIp字段的值。如果您有多个HSM，请为其中任何一个 IP 地址选择HSMs；哪一个 IP 地址都没关系。

   sudo /opt/cloudhsm/bin/configure -a <IP address>
   	
   Updating server config in /opt/cloudhsm/etc/cloudhsm_client.cfg
   Updating server config in /opt/cloudhsm/etc/cloudhsm_mgmt_util.cfg
   
   

3. 转到 在中激活集群 AWS CloudHSM。