Using AWS CloudHSM with F5 BIG-IP

A hardware security module (HSM) is a computing device that processes cryptographic operations and provides secure storage for cryptographic keys. HSM devices are sold by many vendors for installation in customer data centers and are also made available by most public cloud providers. For example, Amazon Web Services (AWS) provides HSM devices under the AWS CloudHSM brand.

BIG-IP can access HSM devices over the network using a Public Key Cryptography Standard (PKCS) #11 Client SDK provided by the HSM vendor.

With the release of TMOS version 17.5.1, BIG-IP now supports the latest AWS CloudHSM hardware security module (HSM) type, hsm2m.medium, and the latest AWS CloudHSM Client SDK, version 5.

Note: By the end of 2025, AWS will remove support for hsm1.medium and Client SDK 3.

Let's take a look at the steps required to configure BIG-IP to work with AWS CloudHSM using the AWS CloudHSM Client SDK version 5.

 

Software Installation

AWS makes the CloudHSM Client SDK available on its website. It can be downloaded directly to a BIG-IP using the following command in the bash shell:

curl -O https://s3.amazonaws.com/cloudhsmv2-software/CloudHsmClient/EL7/cloudhsm-pkcs11-latest.el7.x86_64.rpm 

Then install the software like so:

rpm -ivh cloudhsm-pkcs11-latest.el7.x86_64.rpm

Note: Unlike Client SDK 3, there is no client daemon that needs to be installed and set to run at boot.

 

Prerequisites

Four items need to be provided by the CloudHSM administrator to configure the BIG-IP instance:

1. The IP address of one of the HSM devices in the CloudHSM cluster.
2. The CloudHSM "issuing certificate" created during cluster initialization (normally has the filename customerCA.crt)
3. The username and password for a Crypto User account the BIG-IP will use to authenticate to the CloudHSM cluster. Don't forget to put a colon ":" between the username and password in the tmsh command below.
4. The VPC Security Group created for the CloudHSM cluster. (The name starts with "

   cloudhsm-cluster-") The BIG-IP must have this security group in its EC2 config.

 

Software Configuration

On the BIG-IP, copy the CloudHSM issuing certificate to this filename:

/opt/cloudhsm/etc/customerCA.crt

Bootstrap the Client SDK on the BIG-IP using the following bash commands:

/opt/cloudhsm/bin/configure-pkcs11 -a <HSM IP address>

tmsh create sys crypto fips external-hsm vendor auto pkcs11-lib-path /opt/cloudhsm/lib/libcloudhsm_pkcs11.so

tmsh create sys crypto fips nethsm-partition auto password "<username>:<password>"

bigstart start pkcs11d

 

Test access to the HSM from the BIG-IP

Use this tmsh command to verify access to the CloudHSM cluster:

tmsh run sys crypto nethsm-test

Output of a successful test:

[Info]: Begin
Testing on the partition with label: auto                            
[Info]: Pass
[Sanity]: Begin
[Sanity]: Pass
[RSA2K]: Begin
[RSA2K]: Pass
[RSA4K]: Begin
[RSA4K]: Pass
[ECDSA_PRIME256v1_SHA256]: Begin
[ECDSA_PRIME256v1_SHA256]: Pass
[ECDSA_PRIME256v1_SHA384]: Begin
[ECDSA_PRIME256v1_SHA384]: Pass
[ECDSA_PRIME256v1_SHA512]: Begin
[ECDSA_PRIME256v1_SHA512]: Pass
[ECDSA_SECP384R1_SHA256]: Begin
[ECDSA_SECP384R1_SHA256]: Pass
[ECDSA_SECP384R1_SHA384]: Begin
[ECDSA_SECP384R1_SHA384]: Pass
[ECDSA_SECP384R1_SHA512]: Begin
[ECDSA_SECP384R1_SHA512]: Pass
Test Done(F=0)!

 

Logfiles for troubleshooting

Logfiles for the CloudHSM Client SDK can be found in:

/opt/cloudhsm/run

Log messages for PKCS can be found in the LTM log with the following bash command:

grep -i pkcs /var/log/ltm

 

Additional Resources:

• Setting up the Network HSM module on BIG-IP
• Getting Started with AWS CloudHSM