A hardware security module (HSM) is a dedicated, tamper-resistant device or cloud service that generates, stores and uses cryptographic keys inside a protected boundary. Applications send data to the HSM to be signed or decrypted, and the private key never leaves the hardware.
Why it matters
A private key that sits in a file on a web server can be copied by anyone who compromises that server. An HSM turns key theft into a much harder problem, because an attacker who breaks in can still ask the device to sign things but cannot walk away with the key. Certificate authorities keep their root and issuing keys in HSMs, and many compliance regimes expect it for high-value keys. Cloud providers sell managed versions that you call over an API.
Example
Many HSMs and cloud key services are reached through the PKCS#11 standard. A certificate signing request can be created with the key generated inside the device:
openssl req -new -engine pkcs11 -keyform engine \
-key "pkcs11:object=web-key" -out web.csrThe .csr leaves the device, but the key it was built from does not. Check your HSM vendor's documentation for the exact engine or provider syntax.
Common mistakes
- Treating an HSM as a backup. If the device is lost and the key was non-exportable, it is gone unless you planned key wrapping or a clustered pair.
- Forgetting the HSM is a single point of failure for signing, so TLS handshakes can stall if it goes down.
- Assuming it fixes weak access control. Whoever can call the API can still misuse the key.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.