Can I generate a CSR using HSM? If Yes, then Please guide us. It would be very helpful.

Following are our system details:

  • We have HSM(SafeNet) Simulator to test developement application.
  • we are using Cryptoki.dll with Desktop based application to perform crypto operation.

Now we want to know whether HSM can generate CSR or Not? If yes, then how?

migrated from security.stackexchange.com Oct 29 '18 at 13:28

This question came from our site for information security professionals.

  • 1
    The process might depend on your specific HSM. See also stackoverflow.com How to generate certificate if private key is in HSM?. – Steffen Ullrich Oct 9 '18 at 5:31
  • @SteffenUllrich Thanks for your reply. I have checked your mentioned link, But they are using openssl with HSM to generate CSR. I am interested to know can HSM generate CSR? In My I want to generate using HSM. I am using Safenet HSM. – Sandip Patidar Oct 9 '18 at 5:44
  • 1
    A HSM is a hardware which protects a private key and provides an interface to interact with it for signing etc. You need some software to interact with the hardware in order to create a CSR. OpenSSL is with the appropriate engine one of the software which can interact with the hardware. And searching for safenet hsm create csr provides various hits including documentation about integration with OpenSSL. – Steffen Ullrich Oct 9 '18 at 5:50
  • 1
    If I'm not mistaken Cryptoki is a library/API, not some standalone software. Maybe you could provide all the details needed (which HSM, which software to interface with it...) in your question instead of providing it in small pieces in the comments? Or did you just bought an HSM without any up-front ideas what you are doing and now try to figure out how to use it and without looking at any documentation you got? – Steffen Ullrich Oct 9 '18 at 6:25
  • @SteffenUllrich Thanks for all suggest. I am able to manage CSR from HSM. See my solution, I hope this will also help you. – Sandip Patidar Oct 11 '18 at 16:43

You are using a 'dll', therefore on Windows.

Your SafeNet HSM will come with client software which you install on the server that requires access to the device. Once installed and configured correctly, it shows up as a Microsoft CryptoAPI Key Storage Provider.

This new provider shows up in the list of possible cryptographic providers (in addition to the software modules) when you attempt to request a certificate.

In addition, Gemalto (SafeNet) provide software to interact with the HSM directly via PKCS#11 and therefore accessible to non-CAPI applications (such as OpenSSL) as well as .jar files for access from Java applications.

  • Thanks for reply. I am agree with your suggested points. In our case we are not following OpenSSL. Now I am able to manage CSR using HSM. Please See solution in answer. – Sandip Patidar Oct 10 '18 at 6:54

I did research & followed PKCS #11 OASIS document standard:


Finally, I am able to manage Certificate Request (CSR) from HSM.

Following are the steps to achieve the same:

  1. Generate Key Pair (Private, Public)
  2. Derive Key(C_DeriveKey) from public key and give followings attribute:
    • Mechanism - ENCODE_PKCS_10 (Certificate Request)
    • Signing Key (Private Key)
    • Signing Mechanism - SHA1_RSA_PKCS

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.