AWS cloudhsm medium security documentation change
Summary
Added documentation about CloudHSM client library's default client certificate expiring on Jan 31, 2026, including impact and resolution status
Security assessment
Certificate expiration is a security concern as it can disrupt TLS communications. The change explicitly documents an upcoming expiration date (Jan 31, 2026) of the default client certificate, which could lead to service disruption if unaddressed. However, the note clarifies no impact beyond that date due to customer-managed certificates.
Diff
diff --git a/cloudhsm/latest/userguide/ki-all.md b/cloudhsm/latest/userguide/ki-all.md index 9e675acad..ba4e960e6 100644 --- a//cloudhsm/latest/userguide/ki-all.md +++ b//cloudhsm/latest/userguide/ki-all.md @@ -5 +5 @@ -Issue: AES key wrapping uses PKCS #5 padding instead of providing a standards-compliant implementation of key wrap with zero paddingIssue: The client daemon requires at least one valid IP address in its configuration file to successfully connect to the clusterIssue: There was an upper limit of 16 KB on data that can be hashed and signed by AWS CloudHSM using Client SDK 3Issue: Imported keys could not be specified as non-exportableIssue: The default mechanism for the wrapKey and unWrapKey commands in the key_mgmt_util has been removedIssue: If you have a single HSM in your cluster, HSM failover does not work correctlyIssue: If you exceed the key capacity of the HSMs in your cluster within a short period of time, the client enters an unhandled error stateIssue: Digest operations with HMAC keys of size greater than 800 bytes are not supportedIssue: The client_info tool, distributed with Client SDK 3, deletes the contents of the path specified by the optional output argumentIssue: You receive an error when running the SDK 5 configure tool using the --cluster-id argument in containerized environmentsIssue: You receive the error "Failed to create cert/key from provided pfx file. Error: NotPkcs8"Issue: ECDSA signing fails with "invalid mechanism" error starting with SDK 5.16Issue: Signing operations with prehashed data do not properly clear session tokens in interactive mode +Issue: AES key wrapping uses PKCS #5 padding instead of providing a standards-compliant implementation of key wrap with zero paddingIssue: The client daemon requires at least one valid IP address in its configuration file to successfully connect to the clusterIssue: There was an upper limit of 16 KB on data that can be hashed and signed by AWS CloudHSM using Client SDK 3Issue: Imported keys could not be specified as non-exportableIssue: The default mechanism for the wrapKey and unWrapKey commands in the key_mgmt_util has been removedIssue: If you have a single HSM in your cluster, HSM failover does not work correctlyIssue: If you exceed the key capacity of the HSMs in your cluster within a short period of time, the client enters an unhandled error stateIssue: Digest operations with HMAC keys of size greater than 800 bytes are not supportedIssue: The client_info tool, distributed with Client SDK 3, deletes the contents of the path specified by the optional output argumentIssue: You receive an error when running the SDK 5 configure tool using the --cluster-id argument in containerized environmentsIssue: You receive the error "Failed to create cert/key from provided pfx file. Error: NotPkcs8"Issue: ECDSA signing fails with "invalid mechanism" error starting with SDK 5.16Issue: Signing operations with prehashed data do not properly clear session tokens in interactive modeIssue: CloudHSM client library's default client certificate expires on Jan 31, 2026 @@ -38,0 +39,2 @@ The following issues impact all AWS CloudHSM users regardless of whether they us + * Issue: CloudHSM client library's default client certificate expires on Jan 31, 2026 + @@ -182,0 +185,9 @@ As an additional workaround, we have added a configuration option to bypass this +## Issue: CloudHSM client library's default client certificate expires on Jan 31, 2026 + + * **Impact:** There is no impact to customers beyond Jan 31, 2026. All communications between the client and HSM are secured by client-HSM TLS as described [here](./client-end-to-end-encryption.html). The client-HSM TLS uses customer owned/managed certificates which are configured by the customer during cluster initialization. + + * **Resolution status:** Resolved. + + + +