- openssl version is 3.5 or later on every gateway node.
- The deployed product image is the HSM-enabled build.
- STOA_ENCRYPTION_KEY is identical on every gateway node and the management console.
- The HSM is reachable and csadm listfirmware shows a5 ML ... INIT_OK.
- A Cryptographic User exists (privilege bit 0x02 , group covering the key group) and its initial PIN has been changed to a formal strong PIN.
- cs_pkcs11_R3.cfg is in place and CS_PKCS11_R3_CFG is set on the console node and every gateway node.
- pkcs11-tool -L lists the token CryptoServer PKCS11 Token.
- slot_label equals the token CKA label (not SLOT_0000).
- The .so is pre-installed or uploaded for delivery, and pkcs11_module_path matches the actual path on disk.
- STOA_HSM_CKM_ML_DSA_65 uses the 64-bit sign-extended value.
- Certificates are created and bound to the correct cluster_id.
- tls_listen_addr is configured on every gateway node.
- The HSM connection test returns ok:true from both the console and a gateway node.
- curl -vk --tlsv1.3 shows id-ml-dsa-65 and X25519MLKEM768.
- The MBK is created and held in split custody according to the organization's key escrow policy.
- PINs and recovery credentials are stored according to organizational policy and appear in no configuration file or log.
