To integrate the HSM cryptographic engine with the safe key storage, configuration of the Certificate Issuing System (CIS) is necessary. Add the following lines to the /opt/cm/server/config/cis.conf configuration file. Then, restart the CIS service to make the changes to become effective.
cis.crypto.device.5.name = Utimaco HSM (RSA) cis.crypto.device.5.type = PKCS11
;cis.crypto.device.5.label = insert Label cis.crypto.device.5.slotid = insert Slot ID
cis.crypto.device.5.library = /etc/utimaco/libcs_pkcs11_R2
cis.crypto.device.5.algorithm = RSA cis.crypto.device.5.algorithmOID = 1.2.840.113549.1.1.1
cis.crypto.device.5.keysize = 1024 2048 4096 8192 16384 cis.crypto.device.5.rsaPubExp = 65537
;cis.crypto.device.5.pinPad = false cis.crypto.device.5.pin = 123456
cis.crypto.device.5.hashInCis = false
cis.crypto.device.6.name = Utimaco HSM (ECDSA)
cis.crypto.device.6.type = PKCS11 ;cis.crypto.device.6.label = insert Label cis.crypto.device.6.slotid = insert Slot ID
cis.crypto.device.6.library = /etc/utimaco/libcs_pkcs11_R2 cis.crypto.device.6.algorithm = EC cis.crypto.device.6.algorithmOID = EC
cis.crypto.device.6.parameter = secp192r1, secp224r1 secp256r1, secp384r1, secp521r1
cis.crypto.device.6.rsaPubExp = 65537 ;cis.crypto.device.6.pinPad = false cis.crypto.device.6.pin
= 123456 cis.crypto.device.6.hashInCis = false