PAM

HSM Support

CoreLink supports PKCS#11 v2.40-compatible HSMs for storing CA private keys and KMS master keys. Tested with SafeNet Luna and Thales Luna Network HSM. The PKCS#11 provider is configured per-tenant; key generation and cryptographic operations execute inside the HSM boundary -- private key material never leaves the device.

HSM slots are addressed by label, and PIN authentication is handled via environment-injected secrets.

HSM Support screenshot

Key Configuration

  • PKCS#11 library path
  • Slot label
  • PIN source (env var reference)
  • Supported key algorithms (RSA-2048/4096, EC P-256/P-384)
All documentation Question about this? Talk to us