HSM (Hardware Security Module)

A hardware security module (HSM) is a dedicated, tamper-resistant device or cloud service that generates, stores and uses cryptographic keys inside a protected boundary. Applications send data to the HSM to be signed or decrypted, and the private key never leaves the hardware.

Why it matters

A private key that sits in a file on a web server can be copied by anyone who compromises that server. An HSM turns key theft into a much harder problem, because an attacker who breaks in can still ask the device to sign things but cannot walk away with the key. Certificate authorities keep their root and issuing keys in HSMs, and many compliance regimes expect it for high-value keys. Cloud providers sell managed versions that you call over an API.

Example

Many HSMs and cloud key services are reached through the PKCS#11 standard. A certificate signing request can be created with the key generated inside the device:

openssl req -new -engine pkcs11 -keyform engine \
  -key "pkcs11:object=web-key" -out web.csr

The .csr leaves the device, but the key it was built from does not. Check your HSM vendor's documentation for the exact engine or provider syntax.

Common mistakes

• Treating an HSM as a backup. If the device is lost and the key was non-exportable, it is gone unless you planned key wrapping or a clustered pair.
• Forgetting the HSM is a single point of failure for signing, so TLS handshakes can stall if it goes down.
• Assuming it fixes weak access control. Whoever can call the API can still misuse the key.

Related

• Key pair
• Certificate signing request
• Code signing certificate
• टूल: SSL checker

यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.