Use HSMs with hsm_mgmt_tool-Key Management Service(KMS)-阿里云帮助中心

The hsm_mgmt_tool command-line tool lets CO users manage HSM instances and HSM users, and lets CU users share keys and get and set key attributes.

Important

Before you run hsm_mgmt_tool commands, you must start hsm_mgmt_tool and log in to an HSM instance. Ensure that you log in with the correct user type. For details, see HSM User Permission Table.

Download the installation package

Download the HSM instance management tool.
- CentOS
  - Method 1: Download the HSM instance management tool.
  - Method 2: Run the following command to download the HSM instance management tool. This operation requires your ECS instance to have public network access.
```
wget -O hsm-client-v2.03.15.10-1.x86_64.rpm 'https://yundun-hsm4.oss-ap-southeast-1.aliyuncs.com/hsm-client-v2.03.15.10-1.x86_64.rpm'
```
  - Method 3: On the VSMs page, find the target HSM instance and click the icon in the Specification column.
  - Method 4: On the Activate Cluster page, click Download the HSM instance management tool.
- Debian
  Visit hsm-client-2.03.15.10-20240710_1.x86_64.deb to download the HSM instance management tool.
Run the following command to install the client and its configuration file to the /opt/hsm directory.
- CentOS
```
sudo yum install -y hsm-client-v2.03.15.10-1.x86_64.rpm
```
- Debian
```
sudo dpkg -i hsm-client-2.03.15.10-20240710_1.x86_64.deb
```

Modify the configuration file

Modify the servers parameter in the /opt/hsm/etc/hsm_mgmt_tool.cfg configuration file.

Change name and hostname to the private IP address of the primary HSM.
Change owner_cert_path to the file path of issuerCA.crt.

Sample hsm_mgmt_tool.cfg file

{

"servers": [

{

"name" : "172.16.XX.XX",

"hostname" : "172.16.XX.XX",

"port" : 2225,

"certificate": "/opt/hsm/etc/client.crt",

"pkey": "/opt/hsm/etc/client.key",

"CAfile": "",

"CApath": "/opt/hsm/etc/certs",

"ssl_ciphers": "",

"server_ssl" : "yes",

"enable" : "yes",

"owner_cert_path":"<issuerCA.crt file path>"

}],

"scard": {

"enable": "no",

"port": 2225,

"ssl": "no",

"ssl_ciphers": "",

"certificate": "cert-sc",

"pkey": "pkey-sc"

}

Start and quit the tool

Start the hsm_mgmt_tool command-line tool.

/opt/hsm/bin/hsm_mgmt_tool /opt/hsm/etc/hsm_mgmt_tool.cfg

Quit the hsm_mgmt_tool command-line tool.

cloudmgmt> quit

Get help

Run the following command to list all hsm_mgmt_tool commands.

cloudmgmt> help

Run the following command to get the syntax for a specific hsm_mgmt_tool command.

cloudmgmt> help <command-name>

Command reference

The hsm_mgmt_tool provides the following commands:

Command	Description	User type
changePswd	Changes a user's password on an HSM instance. All users can change their own password. A CO user can change any user's password.	CO user
createUser	Creates users of all types on an HSM instance.	CO user
deleteUser	Deletes users of all types from an HSM instance.	CO user
findAllKeys	Gets the keys owned by or shared with a user. It also returns a hash of the key ownership and data for all keys on each HSM instance.	CO user, AU user
getAttribute	Gets the value of an attribute of an HSM key and writes it to a file or standard output (stdout).	CU user
getCert	Gets the certificate of a specific HSM instance and saves it in a specified format.	All users
getCertReq	Gets the certificate request of a specific HSM instance and saves it in a specified format.	All users
getHSMInfo	Gets information about the device on which an HSM instance runs.	All users. No login required.
getKeyInfo	Gets a key's owner, shared users, and quorum authentication status.	CU user
info	Gets information about an HSM instance, including its IP address, hostname, port, and the current user.	All users. No login required.
listAttributes	Lists the attributes of an HSM key and the constants that represent them.	All users. No login required.
listUsers	Gets the users in each HSM instance, along with their user type, ID, and other attributes.	All users. No login required.
loginHSM and logoutHSM	Logs into and out of an HSM instance.	All users
server	Enters and exits the server mode for an HSM instance.	All users
setAttribute	Changes a key's label and modifies its attributes for encryption, decryption, wrapping, and unwrapping.	CU user
quit	Quits hsm_mgmt_tool.	All users. No login required.
shareKey	Shares an existing key with other users.	CU user
storeCert	Stores the HSM owner certificate and the owner-signed certificate.	PRECO user or CO user