[{"data":1,"prerenderedAt":801},["ShallowReactive",2],{"\u002Fblog\u002Fopenbao-yubihsm":3,"\u002Fblog\u002Fopenbao-yubihsm-surround":794},{"id":4,"title":5,"authors":6,"badge":12,"body":14,"date":783,"description":784,"extension":785,"image":786,"meta":789,"navigation":341,"path":790,"seo":791,"stem":792,"__hash__":793},"posts\u002F1.blog\u002F2.openbao-yubihsm\u002Findex.md","OpenBAO Auto Unseal with YubiHSM",[7],{"name":8,"to":9,"avatar":10},"Tessellative Solutions","https:\u002F\u002Ftessellative.com",{"src":11},"\u002Ficons\u002Ftessellative_icon_round.svg",{"label":13},"OpenBAO, Vault, HSM, YubiHSM, PKCS#11, Security",{"type":15,"value":16,"toc":770},"minimark",[17,22,26,29,40,44,53,56,98,101,116,122,125,204,224,232,235,240,243,296,299,324,327,377,380,419,423,426,443,446,544,547,562,565,615,621,625,638,642,670,674,677,680,697,701,728,731,734,738,755,766],[18,19,21],"h2",{"id":20},"why-to-use-an-hsm","Why to Use an HSM",[23,24,25],"p",{},"Manual Shamir unsealing gets old fast once you run more than a couple of OpenBAO (or HashiCorp Vault) nodes in a private infrastructure. You either keep shares floating around or build some fragile automation that still leaves the root keys in software configuration. Dedicated, network accessible HSM hardware is an objectively better approach.",[23,27,28],{},"Yubico's HSM is an affordable alternative to reduce risk and adhere to compliance and regulations. It is a small USB device that talks PKCS#11 over LAN via a host connector service. OpenBAO’s PKCS#11 seal (now available as the openbao-plugin-kms-pkcs11 plugin) can hand the master key to it for decryption and get automatic unseal on every restart, while manual unseal (as a break-glass procedure) is still possible via the generated recovery keys.",[23,30,31,32,39],{},"This post goes through and explains the following ",[33,34,38],"a",{"href":35,"rel":36},"https:\u002F\u002Fcodeberg.org\u002Ftessellative\u002Fopenbao-pkcs11-yubihsm",[37],"nofollow","PoC setup"," that pieces the configuration together.",[18,41,43],{"id":42},"hsm-preparation","HSM Preparation",[23,45,46,47,52],{},"Install the ",[33,48,51],{"href":49,"rel":50},"https:\u002F\u002Fdevelopers.yubico.com\u002FYubiHSM2\u002FReleases\u002F",[37],"YubiHSM SDK",". This step is required to start the HSM connector service on the host machine, that exposes the HSM functionality over the network.\nAll the other necessary components and libs are installed in the PoC image in the above repository.",[23,54,55],{},"Firstly generate a new TLS cert and key for the transit encryption on the Host machine:",[57,58,63],"pre",{"className":59,"code":60,"language":61,"meta":62,"style":62},"language-sh shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","openssl req -x509 -newkey rsa:4096 -sha256 -days 3650 -nodes \\\n  -keyout \u002Fetc\u002Fyubihsm\u002Fconnector.key \\\n  -out \u002Fetc\u002Fyubihsm\u002Fconnector.crt \\\n  -subj \"\u002FCN=host.docker.internal\" \\\n  -addext \"subjectAltName=DNS:host.docker.internal,DNS:localhost,IP:127.0.0.1\"\n","sh","",[64,65,66,74,80,86,92],"code",{"__ignoreMap":62},[67,68,71],"span",{"class":69,"line":70},"line",1,[67,72,73],{},"openssl req -x509 -newkey rsa:4096 -sha256 -days 3650 -nodes \\\n",[67,75,77],{"class":69,"line":76},2,[67,78,79],{},"  -keyout \u002Fetc\u002Fyubihsm\u002Fconnector.key \\\n",[67,81,83],{"class":69,"line":82},3,[67,84,85],{},"  -out \u002Fetc\u002Fyubihsm\u002Fconnector.crt \\\n",[67,87,89],{"class":69,"line":88},4,[67,90,91],{},"  -subj \"\u002FCN=host.docker.internal\" \\\n",[67,93,95],{"class":69,"line":94},5,[67,96,97],{},"  -addext \"subjectAltName=DNS:host.docker.internal,DNS:localhost,IP:127.0.0.1\"\n",[23,99,100],{},"Copy and trust the new connector certificate on the host system",[57,102,104],{"className":59,"code":103,"language":61,"meta":62,"style":62},"sudo cp \u002Fetc\u002Fyubihsm\u002Fconnector.crt \u002Fetc\u002Fca-certificates\u002Ftrust-source\u002Fanchors\u002F\nsudo update-ca-trust\n",[64,105,106,111],{"__ignoreMap":62},[67,107,108],{"class":69,"line":70},[67,109,110],{},"sudo cp \u002Fetc\u002Fyubihsm\u002Fconnector.crt \u002Fetc\u002Fca-certificates\u002Ftrust-source\u002Fanchors\u002F\n",[67,112,113],{"class":69,"line":76},[67,114,115],{},"sudo update-ca-trust\n",[23,117,118,119],{},"Or on RHEL based change the trust location to: ",[64,120,121],{},"\u002Fetc\u002Fpki\u002Fca-trust\u002Fsource\u002Fanchors\u002F",[23,123,124],{},"Plug the YubiHSM in and start yubihsm-connector service on the host with the following configuration.",[57,126,130],{"className":127,"code":128,"language":129,"meta":62,"style":62},"language-yaml shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","# \u002Fetc\u002Fyubihsm-connector.yaml\ncert: \"\u002Fetc\u002Fyubihsm\u002Fconnector.crt\"\nkey: \"\u002Fetc\u002Fyubihsm\u002Fconnector.key\"\nenable-host-whitelist: false\nlisten: 0.0.0.0:12345\nserial: \"\"\n","yaml",[64,131,132,138,158,172,183,193],{"__ignoreMap":62},[67,133,134],{"class":69,"line":70},[67,135,137],{"class":136},"sHwdD","# \u002Fetc\u002Fyubihsm-connector.yaml\n",[67,139,140,144,148,151,155],{"class":69,"line":76},[67,141,143],{"class":142},"swJcz","cert",[67,145,147],{"class":146},"sMK4o",":",[67,149,150],{"class":146}," \"",[67,152,154],{"class":153},"sfazB","\u002Fetc\u002Fyubihsm\u002Fconnector.crt",[67,156,157],{"class":146},"\"\n",[67,159,160,163,165,167,170],{"class":69,"line":82},[67,161,162],{"class":142},"key",[67,164,147],{"class":146},[67,166,150],{"class":146},[67,168,169],{"class":153},"\u002Fetc\u002Fyubihsm\u002Fconnector.key",[67,171,157],{"class":146},[67,173,174,177,179],{"class":69,"line":88},[67,175,176],{"class":142},"enable-host-whitelist",[67,178,147],{"class":146},[67,180,182],{"class":181},"sfNiH"," false\n",[67,184,185,188,190],{"class":69,"line":94},[67,186,187],{"class":142},"listen",[67,189,147],{"class":146},[67,191,192],{"class":153}," 0.0.0.0:12345\n",[67,194,196,199,201],{"class":69,"line":195},6,[67,197,198],{"class":142},"serial",[67,200,147],{"class":146},[67,202,203],{"class":146}," \"\"\n",[57,205,207],{"className":59,"code":206,"language":61,"meta":62,"style":62},"yubihsm-connector -c \u002Fetc\u002Fyubihsm-connector.yaml\n# OR via Systemd after installing the YubiHSM SDK\nsystemctl start yubihsm-connector\n",[64,208,209,214,219],{"__ignoreMap":62},[67,210,211],{"class":69,"line":70},[67,212,213],{},"yubihsm-connector -c \u002Fetc\u002Fyubihsm-connector.yaml\n",[67,215,216],{"class":69,"line":76},[67,217,218],{},"# OR via Systemd after installing the YubiHSM SDK\n",[67,220,221],{"class":69,"line":82},[67,222,223],{},"systemctl start yubihsm-connector\n",[23,225,226,227,231],{},"Once it is up and running, check the status: ",[33,228,229],{"href":229,"rel":230},"https:\u002F\u002Flocalhost:12345\u002Fconnector\u002Fstatus",[37],"\nThe browser or curl should connect to this without any issues since the TLS certs should have already been trusted.",[23,233,234],{},"Optionally reset the device so it is tarting clean for the initial setup.",[236,237,239],"h3",{"id":238},"configure-the-hsm-auth-and-openbao-keys","Configure the HSM Auth and OpenBAO keys",[23,241,242],{},"Generate a proper admin auth key, delete the default one, then make a dedicated auth key for OpenBAO with only the decrypt capabilities it needs:",[57,244,246],{"className":59,"code":245,"language":61,"meta":62,"style":62},"export ADMIN_PW=$(yubihsm-shell -a get-pseudo-random --count 16 -p password --authkey 1)\nyubihsm-shell -a put-authentication-key \\\n  -i 0x0002 \\\n  -d all \\\n  -c all \\\n  --delegated all \\\n  -l ADMIN \\\n  --authkey 1 -p password \\\n  --new-password=$ADMIN_PW\n",[64,247,248,253,258,263,268,273,278,284,290],{"__ignoreMap":62},[67,249,250],{"class":69,"line":70},[67,251,252],{},"export ADMIN_PW=$(yubihsm-shell -a get-pseudo-random --count 16 -p password --authkey 1)\n",[67,254,255],{"class":69,"line":76},[67,256,257],{},"yubihsm-shell -a put-authentication-key \\\n",[67,259,260],{"class":69,"line":82},[67,261,262],{},"  -i 0x0002 \\\n",[67,264,265],{"class":69,"line":88},[67,266,267],{},"  -d all \\\n",[67,269,270],{"class":69,"line":94},[67,271,272],{},"  -c all \\\n",[67,274,275],{"class":69,"line":195},[67,276,277],{},"  --delegated all \\\n",[67,279,281],{"class":69,"line":280},7,[67,282,283],{},"  -l ADMIN \\\n",[67,285,287],{"class":69,"line":286},8,[67,288,289],{},"  --authkey 1 -p password \\\n",[67,291,293],{"class":69,"line":292},9,[67,294,295],{},"  --new-password=$ADMIN_PW\n",[23,297,298],{},"Delete the Initial Unsecure Auth Key",[57,300,302],{"className":59,"code":301,"language":61,"meta":62,"style":62},"yubihsm-shell -a delete-object \\\n  -i 0x0001 \\\n  -t authentication-key \\\n  --authkey 1 -p password\n",[64,303,304,309,314,319],{"__ignoreMap":62},[67,305,306],{"class":69,"line":70},[67,307,308],{},"yubihsm-shell -a delete-object \\\n",[67,310,311],{"class":69,"line":76},[67,312,313],{},"  -i 0x0001 \\\n",[67,315,316],{"class":69,"line":82},[67,317,318],{},"  -t authentication-key \\\n",[67,320,321],{"class":69,"line":88},[67,322,323],{},"  --authkey 1 -p password\n",[23,325,326],{},"Generate a dedicated OpenBAO Auth Key, just for the decryption",[57,328,330],{"className":59,"code":329,"language":61,"meta":62,"style":62},"export BAO_PW=$(yubihsm-shell -a get-pseudo-random --count 16 --authkey 2 -p $ADMIN_PW)\n\nyubihsm-shell -a put-authentication-key \\\n  -i 0x0003 \\\n  -d 1 \\\n  -c decrypt-pkcs,decrypt-oaep \\\n  -l \"BAO-Auth\" \\\n  --authkey 2 -p $ADMIN_PW \\\n  --new-password=$BAO_PW\n",[64,331,332,337,343,347,352,357,362,367,372],{"__ignoreMap":62},[67,333,334],{"class":69,"line":70},[67,335,336],{},"export BAO_PW=$(yubihsm-shell -a get-pseudo-random --count 16 --authkey 2 -p $ADMIN_PW)\n",[67,338,339],{"class":69,"line":76},[67,340,342],{"emptyLinePlaceholder":341},true,"\n",[67,344,345],{"class":69,"line":82},[67,346,257],{},[67,348,349],{"class":69,"line":88},[67,350,351],{},"  -i 0x0003 \\\n",[67,353,354],{"class":69,"line":94},[67,355,356],{},"  -d 1 \\\n",[67,358,359],{"class":69,"line":195},[67,360,361],{},"  -c decrypt-pkcs,decrypt-oaep \\\n",[67,363,364],{"class":69,"line":280},[67,365,366],{},"  -l \"BAO-Auth\" \\\n",[67,368,369],{"class":69,"line":286},[67,370,371],{},"  --authkey 2 -p $ADMIN_PW \\\n",[67,373,374],{"class":69,"line":292},[67,375,376],{},"  --new-password=$BAO_PW\n",[23,378,379],{},"Generate the OpenBAO Seal Key",[57,381,383],{"className":59,"code":382,"language":61,"meta":62,"style":62},"yubihsm-shell -a generate-asymmetric-key \\\n  -i 0x00ff \\\n  -l bao-seal-key-rsa \\\n  -d 1 \\\n  -c decrypt-oaep,decrypt-pkcs \\\n  -A rsa4096 \\\n  --authkey 2 -p $ADMIN_PW\n",[64,384,385,390,395,400,404,409,414],{"__ignoreMap":62},[67,386,387],{"class":69,"line":70},[67,388,389],{},"yubihsm-shell -a generate-asymmetric-key \\\n",[67,391,392],{"class":69,"line":76},[67,393,394],{},"  -i 0x00ff \\\n",[67,396,397],{"class":69,"line":82},[67,398,399],{},"  -l bao-seal-key-rsa \\\n",[67,401,402],{"class":69,"line":88},[67,403,356],{},[67,405,406],{"class":69,"line":94},[67,407,408],{},"  -c decrypt-oaep,decrypt-pkcs \\\n",[67,410,411],{"class":69,"line":195},[67,412,413],{},"  -A rsa4096 \\\n",[67,415,416],{"class":69,"line":280},[67,417,418],{},"  --authkey 2 -p $ADMIN_PW\n",[18,420,422],{"id":421},"openbao-configuration","OpenBAO Configuration",[23,424,425],{},"The PoC repository has a Containerfile that pulls the official OpenBAO UBI image and layers the YubiHSM SDK libraries on top. The important part for the integration is the yubihsm_pkcs11.conf file with the connector url.",[57,427,431],{"className":428,"code":429,"language":430,"meta":62,"style":62},"language-conf shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","# yubihsm_pkcs11.conf\nconnector=https:\u002F\u002Fhost.docker.internal:12345\n","conf",[64,432,433,438],{"__ignoreMap":62},[67,434,435],{"class":69,"line":70},[67,436,437],{},"# yubihsm_pkcs11.conf\n",[67,439,440],{"class":69,"line":76},[67,441,442],{},"connector=https:\u002F\u002Fhost.docker.internal:12345\n",[23,444,445],{},"The OpenBAO PKCS#11 seal configuration as it is in the openbao.hcl snippet:",[57,447,451],{"className":448,"code":449,"language":450,"meta":62,"style":62},"language-hcl shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","# openbao.hcl\nplugin \"kms\" \"pkcs11\" {\n  image       = \"ghcr.io\u002Fopenbao\u002Fopenbao-plugin-kms-pkcs11\"\n  version     = \"v0.1.0\"\n  binary_name = \"openbao-plugin-kms-pkcs11\"\n  sha256sum   = \"55245882727535579e710672f0eae1bcdddc846006db857baaa6e09e33d40faf\"\n}\n\nseal \"pkcs11\" {\n  lib = \"\u002Fusr\u002Flib64\u002Fpkcs11\u002Fyubihsm_pkcs11.so\" # Installed via the image build\n  token_label = \"YubiHSM\"\n  pin = \"0003\u003CBAO-AUTH-PASSWORD>\" # !!! the auth key location and the Auth password is one concatenated string value !!!\n  key_id        = \"0x00ff\"\n  key_label = \"bao-seal-key-rsa\"\n  mechanism     = \"0x0009\" # CKM_RSA_PKCS_OAEP\n  rsa_oaep_hash = \"sha1\"\n}\n","hcl",[64,452,453,458,463,468,473,478,483,488,492,497,503,509,515,521,527,533,539],{"__ignoreMap":62},[67,454,455],{"class":69,"line":70},[67,456,457],{},"# openbao.hcl\n",[67,459,460],{"class":69,"line":76},[67,461,462],{},"plugin \"kms\" \"pkcs11\" {\n",[67,464,465],{"class":69,"line":82},[67,466,467],{},"  image       = \"ghcr.io\u002Fopenbao\u002Fopenbao-plugin-kms-pkcs11\"\n",[67,469,470],{"class":69,"line":88},[67,471,472],{},"  version     = \"v0.1.0\"\n",[67,474,475],{"class":69,"line":94},[67,476,477],{},"  binary_name = \"openbao-plugin-kms-pkcs11\"\n",[67,479,480],{"class":69,"line":195},[67,481,482],{},"  sha256sum   = \"55245882727535579e710672f0eae1bcdddc846006db857baaa6e09e33d40faf\"\n",[67,484,485],{"class":69,"line":280},[67,486,487],{},"}\n",[67,489,490],{"class":69,"line":286},[67,491,342],{"emptyLinePlaceholder":341},[67,493,494],{"class":69,"line":292},[67,495,496],{},"seal \"pkcs11\" {\n",[67,498,500],{"class":69,"line":499},10,[67,501,502],{},"  lib = \"\u002Fusr\u002Flib64\u002Fpkcs11\u002Fyubihsm_pkcs11.so\" # Installed via the image build\n",[67,504,506],{"class":69,"line":505},11,[67,507,508],{},"  token_label = \"YubiHSM\"\n",[67,510,512],{"class":69,"line":511},12,[67,513,514],{},"  pin = \"0003\u003CBAO-AUTH-PASSWORD>\" # !!! the auth key location and the Auth password is one concatenated string value !!!\n",[67,516,518],{"class":69,"line":517},13,[67,519,520],{},"  key_id        = \"0x00ff\"\n",[67,522,524],{"class":69,"line":523},14,[67,525,526],{},"  key_label = \"bao-seal-key-rsa\"\n",[67,528,530],{"class":69,"line":529},15,[67,531,532],{},"  mechanism     = \"0x0009\" # CKM_RSA_PKCS_OAEP\n",[67,534,536],{"class":69,"line":535},16,[67,537,538],{},"  rsa_oaep_hash = \"sha1\"\n",[67,540,542],{"class":69,"line":541},17,[67,543,487],{},[23,545,546],{},"Bring it all up and initialize the DB:",[57,548,550],{"className":59,"code":549,"language":61,"meta":62,"style":62},"podman-compose -f compose.yaml up -d\npodman exec -it \u003Ccontainer> bao operator init\n",[64,551,552,557],{"__ignoreMap":62},[67,553,554],{"class":69,"line":70},[67,555,556],{},"podman-compose -f compose.yaml up -d\n",[67,558,559],{"class":69,"line":76},[67,560,561],{},"podman exec -it \u003Ccontainer> bao operator init\n",[23,563,564],{},"After the init the following output should tell the recovery keys (store those safely) and the root token:",[57,566,570],{"className":567,"code":568,"language":569,"meta":62,"style":62},"language-console shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","Recovery Key 1: 3NV6K62D************************8KG0NeMNsOsT\nRecovery Key 2: pUATUuuk************************gaP0+hFwzEL+\nRecovery Key 3: xuy9sXto************************aFIejQyHiqnv\nRecovery Key 4: itGD6wC9************************UX1WnaXqZ8zk\nRecovery Key 5: cCzbKJfi************************sgN3pBm0C1s\n\nInitial Root Token: s.Gp************************jEyI\n\nSuccess! Vault is initialized\n","console",[64,571,572,577,582,587,592,597,601,606,610],{"__ignoreMap":62},[67,573,574],{"class":69,"line":70},[67,575,576],{},"Recovery Key 1: 3NV6K62D************************8KG0NeMNsOsT\n",[67,578,579],{"class":69,"line":76},[67,580,581],{},"Recovery Key 2: pUATUuuk************************gaP0+hFwzEL+\n",[67,583,584],{"class":69,"line":82},[67,585,586],{},"Recovery Key 3: xuy9sXto************************aFIejQyHiqnv\n",[67,588,589],{"class":69,"line":88},[67,590,591],{},"Recovery Key 4: itGD6wC9************************UX1WnaXqZ8zk\n",[67,593,594],{"class":69,"line":94},[67,595,596],{},"Recovery Key 5: cCzbKJfi************************sgN3pBm0C1s\n",[67,598,599],{"class":69,"line":195},[67,600,342],{"emptyLinePlaceholder":341},[67,602,603],{"class":69,"line":280},[67,604,605],{},"Initial Root Token: s.Gp************************jEyI\n",[67,607,608],{"class":69,"line":286},[67,609,342],{"emptyLinePlaceholder":341},[67,611,612],{"class":69,"line":292},[67,613,614],{},"Success! Vault is initialized\n",[23,616,617],{},[618,619,620],"strong",{},"Subsequent restarts of OpenBAO are now unsealing themselves as long as the YubiHSM is reachable.",[236,622,624],{"id":623},"the-encryption-loop","The Encryption Loop",[626,627,628,632,635],"ul",{},[629,630,631],"li",{},"Storage backend data is encrypted by OpenBAO’s data-encryption keys (keyring, symmetric Database Encryption Key \u002F DEK)",[629,633,634],{},"The keyring is encrypted by the root key (master key)",[629,636,637],{},"The root key is encrypted (wrapped) by the HSM key",[18,639,641],{"id":640},"what-happens-on-initialization-first-seal-wrap","What happens on initialization (first seal \u002F wrap)",[626,643,644,647,661,664,667],{},[629,645,646],{},"OpenBAO generates a fresh root key in memory",[629,648,649,650],{},"Via PKCS#11:\n",[626,651,652,655,658],{},[629,653,654],{},"C_Login with the configured PIN (key_id + PAO_PW)",[629,656,657],{},"Locate the key object by label",[629,659,660],{},"C_EncryptInit + C_Encrypt (or wrap) of the plaintext root key",[629,662,663],{},"Sends the plaintext root key to the HSM with the encryption mechanism parameters",[629,665,666],{},"The HSM returns the ciphertext (encrypted \u002F wrapped root key)",[629,668,669],{},"OpenBAO writes that ciphertext into the storage backend",[18,671,673],{"id":672},"why-only-the-decrypt-pkcs-and-decrypt-oaep-capabilites","Why only the decrypt-pkcs and decrypt-oaep capabilites",[23,675,676],{},"Why is the YubiHSM BAO_PW key configured with only the ecrypt-pkcs and decrypt-oaep capabilities. The root key obviously needs to be encrypted somewhere during the initialization! It is because with asymmetric RSA the encrypt side never touches the private key!",[23,678,679],{},"The Initialization flow as follows:",[626,681,682,685,691,694],{},[629,683,684],{},"OpenBAO obtains the public key (via C_GetAttributeValue \u002F C_FindObjects on the public object)",[629,686,687,688],{},"It then calls C_EncryptInit + C_Encrypt using the ",[618,689,690],{},"public key",[629,692,693],{},"Public-key encryption is pure math and can be performed entirely outside the HSM by the PKCS#11 module using only the public component",[629,695,696],{},"No private-key capability is required, so the BAO_PW Authentication Key does not need encrypt-* capabilities configured in the HSM",[18,698,700],{"id":699},"what-happens-on-unseal-auto-unseal","What happens on unseal (auto-unseal)",[626,702,703,706,716,719,722,725],{},[629,704,705],{},"OpenBAO starts sealed, reads the ciphertext of the root key from storage.",[629,707,649,708],{},[626,709,710,713],{},[629,711,712],{},"Login + find key object",[629,714,715],{},"C_DecryptInit + C_Decrypt",[629,717,718],{},"Sends the ciphertext to the HSM with the encryption mechanism parameters",[629,720,721],{},"The HSM returns the plaintext root key! That is why we need TLS to protect this in transit!",[629,723,724],{},"OpenBAO uses the plaintext root key to decrypt the keyring\u002FDEK, loads the DEK into memory, and discards the root key",[629,726,727],{},"OpenBAO is now unsealed and can serve requests",[23,729,730],{},"No Shamir shares are involved for the unseal path itself; recovery keys exist only for administrative operations (root token generation, seal migration, etc.).",[23,732,733],{},"In short: the HSM only ever sees the root-key ciphertext on unseal. The wrapping key itself never leaves the HSM!",[18,735,737],{"id":736},"practical-notes","Practical Notes",[626,739,740,743,746,749,752],{},[629,741,742],{},"The connector must be reachable from the container (host.docker.internal works on most Podman\u002FDocker setups)",[629,744,745],{},"OpenSC (pkcs-tool cli) 0.27 and recent yubihsm-shell versions can segfault together; stick to the versions the Yubico SDK ships or use yubihsm-shell \u002F yubihsm-manager for key management",[629,747,748],{},"File storage is used in the demo for simplicity, swap for production",[629,750,751],{},"The TLS cert is just a quick self signed one, configure a proper TLS cert and key with your PKI",[629,753,754],{},"The HSM Connector whitelisting is disabled. Configure proper whitelist entries for increased network security when accessing the HSM",[23,756,758,763,764],{"style":757},"text-align:center;",[759,760],"img",{"width":761,"height":761,"style":762,"src":11},21,"vertical-align: middle; display: inline-block;","\nGo forth and tessellate!\n",[759,765],{"width":761,"height":761,"style":762,"src":11},[767,768,769],"style",{},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}html pre.shiki code .swJcz, html code.shiki .swJcz{--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .sfNiH, html code.shiki .sfNiH{--shiki-light:#FF5370;--shiki-default:#FF9CAC;--shiki-dark:#FF9CAC}",{"title":62,"searchDepth":76,"depth":76,"links":771},[772,773,776,779,780,781,782],{"id":20,"depth":76,"text":21},{"id":42,"depth":76,"text":43,"children":774},[775],{"id":238,"depth":82,"text":239},{"id":421,"depth":76,"text":422,"children":777},[778],{"id":623,"depth":82,"text":624},{"id":640,"depth":76,"text":641},{"id":672,"depth":76,"text":673},{"id":699,"depth":76,"text":700},{"id":736,"depth":76,"text":737},"2026-08-02","Proof of concept OpenBAO configuration with yubiHSM as the seal provider","md",{"src":787,"headerClass":788},"\u002Fblog\u002Fopenbao-yubihsm\u002Fcover.webp","aspect-[16\u002F10]",{},"\u002Fblog\u002Fopenbao-yubihsm",{"title":5,"description":784},"1.blog\u002F2.openbao-yubihsm\u002Findex","bpmoqbb4x-MMKUO7EnKZZHrUTRlcrCxFps7Cjszbrhc",[795,800],{"title":796,"path":797,"stem":798,"description":799,"children":-1},"Kubernetes on a Hetzner Private Network","\u002Fblog\u002Fk8s-on-hcloud","1.blog\u002F1.k8s-on-hcloud\u002Findex","Proof of Concept IaC for managing a Kubernetes cluster on Hetzner Cloud",null,1785701414285]