aws-samples / aws-samples/aws-cloudhsm-jce-examples

How to sync AWS Cloud HSM keystore file across application on different aws instances?

Open
#65 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
46
Forks
70
Avg merge
52m
Merged PRs (30d)
4

Description

**Requirement:**
We have an application running on more than one instance in a cluster that uses key pairs, certificates, and symmetric keys which are preloaded in AWS Cloud HSM.

What is the best way to provide the local keystore file which is created when generating key pairs to all the machines in the cluster?

Keys are created on a different instance which is exclusively used on key management only.

When a new key pair is added, that keypair + certificate needs to be available on all application instances.

**Generate keypair with a certificate with store file**
```
keytool -genkeypair -alias alias1 -keystore /home/user/my_cloudhsm/my-cloudhsm.store "CN=alias1.example.com, OU=Research, O=Acme, L=XYZ, ST=CA, C=US" -storetype CLOUDHSM -storepass password -keyalg rsa -keysize 2048 -sigalg sha512withrsa -validity 360 -dname -J-classpath '-J/opt/cloudhsm/java/*' -J-Djava.library.path=/opt/cloudhsm/lib
```

Contributor guide

Open the contributing guide

Research direction

Start by examining the AWS CloudHSM JCE keystore behavior and the shown keytool command, focusing on how the local my-cloudhsm.store file is created and consumed. Determine what supported approach would make a newly generated key pair and certificate available to every application instance, and document the resulting completion criteria.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, java
Domain
cloud, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.