freeipa

#9865 Support storing LWCA private keys on an HSM
Closed: fixed by rcritten. Opened by rcritten.

Closed: fixed
Reopen Issue

Cloned from https://issues.redhat.com/browse/IDM-1568

LWCA private keys currently generated by PKI are stored in the CA NSS database. Custodia handles syncing keys between CAs.

If PKI can generate a private key on an HSM, or some other mechanism, then we need to disable Custodia because the key will be synced using other means. This should be ok since on HSM installs custodia is already disabled.

PKI has the capability to generate a LWCA private key on the HSM by specifying the token name along with a colon as the prefix, e.g. mytoken:lwca.

We need to abstract that to not require users to remember to use the token name when generating a LWCA.

master:

  • 3b5caf9dbd31117a88421c639c325f58bee5c93c Include the HSM token name when creating LWCAs
  • b94848ccff807951bacfa42886ec91342094e85e Temp commit

ipa-4-12:

  • 12dd94e61a245ac8645789423aa9fc47b3cc14d0 Include the HSM token name when creating LWCAs

Metadata Update from @rcritten:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata

hsm

None
None
Normal
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.