AWS cloudhsm documentation change
Summary
Updated command syntax with ampersand (&) for PowerShell execution and corrected file paths in multiple configuration examples. Removed extensive section about configuring custom SSL certificates/keys for TLS mutual authentication.
Security assessment
The changes primarily correct command syntax (adding PowerShell & operator) and fix file paths, which are routine documentation improvements. The removal of TLS mutual authentication configuration examples eliminates documentation about a security feature but does not provide evidence of addressing a specific vulnerability. No CVE or security advisory is referenced, and the changes appear focused on accuracy rather than patching a security flaw.
Diff
diff --git a/cloudhsm/latest/userguide/configure-tool-examples5.md b/cloudhsm/latest/userguide/configure-tool-examples5.md index c548b8346..95d13818e 100644 --- a//cloudhsm/latest/userguide/configure-tool-examples5.md +++ b//cloudhsm/latest/userguide/configure-tool-examples5.md @@ -27 +27 @@ PKCS #11 library - "C:\Program Files\Amazon\CloudHSM\bin\configure-pkcs11.exe" -a <HSM IP addresses> + & "C:\Program Files\Amazon\CloudHSM\bin\configure-pkcs11.exe" -a <HSM IP addresses> @@ -51 +51 @@ Key Storage Provider (KSP) - "C:\Program Files\Amazon\CloudHSM\bin\configure-ksp.exe" -a <HSM IP addresses> + & "C:\Program Files\Amazon\CloudHSM\bin\configure-ksp.exe" -a <HSM IP addresses> @@ -72 +72 @@ JCE provider - "C:\Program Files\Amazon\CloudHSM\bin\configure-jce.exe" -a <HSM IP addresses> + & "C:\Program Files\Amazon\CloudHSM\bin\configure-jce.exe" -a <HSM IP addresses> @@ -93 +93 @@ CloudHSM CLI - "C:\Program Files\Amazon\CloudHSM\bin\configure-cli.exe" -a <The ENI IPv4 / IPv6 addresses of the HSMs> + & "C:\Program Files\Amazon\CloudHSM\bin\configure-cli.exe" -a <The ENI IPv4 / IPv6 addresses of the HSMs> @@ -122 +122 @@ PKCS #11 library - "C:\Program Files\Amazon\CloudHSM\configure-pkcs11.exe" --cluster-id <cluster-1234567> + & "C:\Program Files\Amazon\CloudHSM\bin\configure-pkcs11.exe" --cluster-id <cluster-1234567> @@ -146 +146 @@ Key Storage Provider (KSP) - "C:\Program Files\Amazon\CloudHSM\configure-ksp.exe" --cluster-id <cluster-1234567> + & "C:\Program Files\Amazon\CloudHSM\bin\configure-ksp.exe" --cluster-id <cluster-1234567> @@ -167 +167 @@ JCE provider - "C:\Program Files\Amazon\CloudHSM\configure-jce.exe" --cluster-id <cluster-1234567> + & "C:\Program Files\Amazon\CloudHSM\bin\configure-jce.exe" --cluster-id <cluster-1234567> @@ -188 +188 @@ CloudHSM CLI - "C:\Program Files\Amazon\CloudHSM\bin\configure-cli.exe" --cluster-id <cluster-1234567> + & "C:\Program Files\Amazon\CloudHSM\bin\configure-cli.exe" --cluster-id <cluster-1234567> @@ -211 +211 @@ PKCS #11 library - C:\Program Files\Amazon\CloudHSM\configure-pkcs11.exe --cluster-id <cluster-1234567>--region <us-east-1> --endpoint <https://cloudhsmv2.us-east-1.amazonaws.com> + & "C:\Program Files\Amazon\CloudHSM\bin\configure-pkcs11.exe" --cluster-id <cluster-1234567>--region <us-east-1> --endpoint <https://cloudhsmv2.us-east-1.amazonaws.com> @@ -235 +235 @@ Key Storage Provider (KSP) - "C:\Program Files\Amazon\CloudHSM\configure-ksp.exe" --cluster-id <cluster-1234567> --region <us-east-1> --endpoint <https://cloudhsmv2.us-east-1.amazonaws.com> + & "C:\Program Files\Amazon\CloudHSM\bin\configure-ksp.exe" --cluster-id <cluster-1234567> --region <us-east-1> --endpoint <https://cloudhsmv2.us-east-1.amazonaws.com> @@ -256 +256 @@ JCE provider - "C:\Program Files\Amazon\CloudHSM\configure-jce.exe" --cluster-id <cluster-1234567> --region <us-east-1> --endpoint <https://cloudhsmv2.us-east-1.amazonaws.com> + & "C:\Program Files\Amazon\CloudHSM\bin\configure-jce.exe" --cluster-id <cluster-1234567> --region <us-east-1> --endpoint <https://cloudhsmv2.us-east-1.amazonaws.com> @@ -277 +277 @@ CloudHSM CLI - "C:\Program Files\Amazon\CloudHSM\configure-cli.exe" --cluster-id <cluster-1234567> --region <us-east-1> --endpoint <https://cloudhsmv2.us-east-1.amazonaws.com> + & "C:\Program Files\Amazon\CloudHSM\bin\configure-cli.exe" --cluster-id <cluster-1234567> --region <us-east-1> --endpoint <https://cloudhsmv2.us-east-1.amazonaws.com> @@ -284,147 +283,0 @@ For more information about the `--cluster-id`, `--region`, and `--endpoint` para -This examples shows how to use the `--server-client-cert-file` and `--server-client-key-file` parameters to reconfigure SSL by specifying a custom key and SSL certificate for AWS CloudHSM - -PKCS #11 library - - -###### To use a custom certificate and key for TLS client-server mutual authentication with Client SDK 5 on Linux - - 1. Copy your key and certificate to the appropriate directory. - - $ sudo cp ssl-client.crt </opt/cloudhsm/etc> - $ sudo cp ssl-client.key </opt/cloudhsm/etc> - - 2. Use the configure tool to specify `ssl-client.crt` and `ssl-client.key`. - - $ sudo /opt/cloudhsm/bin/configure-pkcs11 \ - --server-client-cert-file </opt/cloudhsm/etc/ssl-client.crt> \ - --server-client-key-file </opt/cloudhsm/etc/ssl-client.key> - - - - -###### To use a custom certificate and key for TLS client-server mutual authentication with Client SDK 5 on Windows - - 1. Copy your key and certificate to the appropriate directory. - - cp ssl-client.crt <C:\ProgramData\Amazon\CloudHSM\ssl-client.crt> - cp ssl-client.key <C:\ProgramData\Amazon\CloudHSM\ssl-client.key> - - 2. With a PowerShell interpreter, use the configure tool to specify `ssl-client.crt` and `ssl-client.key`. - - & "C:\Program Files\Amazon\CloudHSM\bin\configure-pkcs11.exe" ` - --server-client-cert-file <C:\ProgramData\Amazon\CloudHSM\ssl-client.crt> ` - --server-client-key-file <C:\ProgramData\Amazon\CloudHSM\ssl-client.key> - - - - -OpenSSL Dynamic Engine - - -###### To use a custom certificate and key for TLS client-server mutual authentication with Client SDK 5 on Linux - - 1. Copy your key and certificate to the appropriate directory. - - $ sudo cp ssl-client.crt </opt/cloudhsm/etc> - sudo cp ssl-client.key </opt/cloudhsm/etc> - - 2. Use the configure tool to specify `ssl-client.crt` and `ssl-client.key`. - - $ sudo /opt/cloudhsm/bin/configure-dyn \ - --server-client-cert-file </opt/cloudhsm/etc/ssl-client.crt> \ - --server-client-key-file </opt/cloudhsm/etc/ssl-client.key> - - - - -Key Storage Provider (KSP) - - -###### To use a custom certificate and key for TLS client-server mutual authentication with Client SDK 5 on Windows - - 1. Copy your key and certificate to the appropriate directory. - - cp ssl-client.crt <C:\ProgramData\Amazon\CloudHSM\ssl-client.crt> - cp ssl-client.key <C:\ProgramData\Amazon\CloudHSM\ssl-client.key> - - 2. With a PowerShell interpreter, use the configure tool to specify `ssl-client.crt` and `ssl-client.key`. - - & "C:\Program Files\Amazon\CloudHSM\bin\configure-ksp.exe" ` - --server-client-cert-file <C:\ProgramData\Amazon\CloudHSM\ssl-client.crt> ` - --server-client-key-file <C:\ProgramData\Amazon\CloudHSM\ssl-client.key> - - - - -JCE provider - - -###### To use a custom certificate and key for TLS client-server mutual authentication with Client SDK 5 on Linux - - 1. Copy your key and certificate to the appropriate directory. - - $ sudo cp ssl-client.crt </opt/cloudhsm/etc> - sudo cp ssl-client.key </opt/cloudhsm/etc> - - 2. Use the configure tool to specify `ssl-client.crt` and `ssl-client.key`. - - $ sudo /opt/cloudhsm/bin/configure-jce \ - --server-client-cert-file </opt/cloudhsm/etc/ssl-client.crt> \ - --server-client-key-file </opt/cloudhsm/etc/ssl-client.key> - - - - -###### To use a custom certificate and key for TLS client-server mutual authentication with Client SDK 5 on Windows - - 1. Copy your key and certificate to the appropriate directory. - - cp ssl-client.crt <C:\ProgramData\Amazon\CloudHSM\ssl-client.crt> - cp ssl-client.key <C:\ProgramData\Amazon\CloudHSM\ssl-client.key> - - 2. With a PowerShell interpreter, use the configure tool to specify `ssl-client.crt` and `ssl-client.key`. - - & "C:\Program Files\Amazon\CloudHSM\bin\configure-jce.exe" ` - --server-client-cert-file <C:\ProgramData\Amazon\CloudHSM\ssl-client.crt> ` - --server-client-key-file <C:\ProgramData\Amazon\CloudHSM\ssl-client.key> - - - - -CloudHSM CLI - - -###### To use a custom certificate and key for TLS client-server mutual authentication with Client SDK 5 on Linux - - 1. Copy your key and certificate to the appropriate directory. - - $ sudo cp ssl-client.crt </opt/cloudhsm/etc> - sudo cp ssl-client.key </opt/cloudhsm/etc> - - 2. Use the configure tool to specify `ssl-client.crt` and `ssl-client.key`. - - $ sudo /opt/cloudhsm/bin/configure-cli \ - --server-client-cert-file </opt/cloudhsm/etc/ssl-client.crt> \ - --server-client-key-file </opt/cloudhsm/etc/ssl-client.key> - - - - -###### To use a custom certificate and key for TLS client-server mutual authentication with Client SDK 5 on Windows - - 1. Copy your key and certificate to the appropriate directory. - - cp ssl-client.crt <C:\ProgramData\Amazon\CloudHSM\ssl-client.crt> - cp ssl-client.key <C:\ProgramData\Amazon\CloudHSM\ssl-client.key> - - 2. With a PowerShell interpreter, use the configure tool to specify `ssl-client.crt` and `ssl-client.key`. - - & "C:\Program Files\Amazon\CloudHSM\bin\configure-cli.exe" ` - --server-client-cert-file <C:\ProgramData\Amazon\CloudHSM\ssl-client.crt> ` - --server-client-key-file <C:\ProgramData\Amazon\CloudHSM\ssl-client.key> - - - - -For more information about the `--server-client-cert-file` and `--server-client-key-file` parameters, see [AWS CloudHSM Client SDK 5 configuration parameters](./configure-tool-params5.html). - @@ -596 +449 @@ PKCS #11 library - "C:\Program Files\Amazon\CloudHSM\bin\configure-pkcs11.exe" --disable-key-availability-check + & "C:\Program Files\Amazon\CloudHSM\bin\configure-pkcs11.exe" --disable-key-availability-check @@ -620 +473 @@ Key Storage Provider (KSP) - "C:\Program Files\Amazon\CloudHSM\bin\configure-ksp.exe" --disable-key-availability-check + & "C:\Program Files\Amazon\CloudHSM\bin\configure-ksp.exe" --disable-key-availability-check @@ -641 +494 @@ JCE provider - "C:\Program Files\Amazon\CloudHSM\bin\configure-jce.exe" --disable-key-availability-check + & "C:\Program Files\Amazon\CloudHSM\bin\configure-jce.exe" --disable-key-availability-check @@ -662 +515 @@ CloudHSM CLI - "C:\Program Files\Amazon\CloudHSM\bin\configure-cli.exe" --disable-key-availability-check + & "C:\Program Files\Amazon\CloudHSM\bin\configure-cli.exe" --disable-key-availability-check