Known Limitations and Considerations

1

HSM-managed handshake signing has a deployment prerequisite

Using an HSM-resident private key as the TLS handshake key requires the OpenSSL 3.x pkcs11 provider on the node (loading a pkcs11: URI as a key through OSSL_STORE). Without it, the SNI handshake for HSM-source certificates fails and degrades to HTTP 502. The node does not crash, and software-key certificates and other SNIs are unaffected. Prerequisite: install and configure the OpenSSL pkcs11 provider (it must be self-contained in the deployment package for offline environments). Software-key ML-DSA-65 certificates are not subject to this limitation and are fully operational end to end, so validate post-quantum HTTPS on the software key path first in a new environment.

2

The Utimaco .so is not self-contained

Delivery covers only the .so; cs_pkcs11_R3.cfg and CS_PKCS11_R3_CFG must be provided by the node side, pre-installed or injected by the deployment system.

3

Single architecture

Client library delivery currently assumes linux-x86-64.

4

Client compatibility

A post-quantum handshake requires the client to support ML-DSA (OpenSSL 3.5 or later, or equivalent). For public-facing services that must remain compatible with existing clients, also provide classic RSA/ECDSA certificates and let SNI/negotiation select automatically.

5

Credential hygiene

All PINs, device addresses and key labels in this guide are placeholders. In production they must be replaced with real strong credentials and stored only encrypted through the management console.