Support for YubiHSM2

[maraino]

Description

Add support to be able to sign x509 and SSH certificates using keys in a YubiHSM2. If possible we should use a PKCS#11 interface to interoperability with other HSMs.

The initial scope is to add YubiHSM2/PKCS#11 as a CA KMS, not to add support for the CLI yet, that will be part of a different project.

[symgryph]

I would be happy to help with debugging I have a yubihsm that we could use

[maraino]

Hi @symgryph: Adding support for it, is currently in our backlog, but we haven't yet planned a time frame to work on this.

[hamannju]

I'm currently in the process of deploying the step-ca in our environment. I would very much like the possibility of moving the CA private keys into the YubiHSM2 and would gladly help you with testing.

[gclawes]

NitroKey HSM 2 is another similar device using PKCS#11: https://shop.nitrokey.com/shop/product/nk-hsm-2-nitrokey-hsm-2-7

[maraino]

@gclawes: We're probably going to start implementing support for YubiHSM2 in early 2021. Do you have a NitroKey HSM2? Would you be open to doing some testing when it's done?

[symgryph]

i have a yubikey hsm 2 and would be happy to help beta test Thomas J Munn

…

On Dec 28, 2020, at 17:46, Mariano Cano ***@***.***> wrote:  @gclawes: We're probably going to start implementing support for YubiHSM2 in early 2021. Do you have a NitroKey HSM2? Would you be open to doing some testing when it's done? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or unsubscribe.

[gclawes]

@maraino yes, I have one.

Edit: I'd be willing to test as well.

[maraino]

I'm happy to announce that initial support for YubiHSM2 (and other PKCS#11 modules) has been pushed to #457.

Full testing is still pending and the way pkcs uris are currently managed can change at any time.

[maraino]

@gclawes @symgryph @hamannju The PR is now ready for review, feel free to test your HSMs with it.
To configure step-ca with yubihsm2, just follow the instructions in this comment #457 (comment)