AWS cloudhsm high security documentation change
Summary
Added documentation for a new issue where Client SDK 5 connections fail due to weak CA certificate keys
Security assessment
The change documents a security vulnerability where weak RSA keys (<2048 bits) in CA certificates cause connection failures. This is explicitly a cryptographic weakness that impacts secure connections to CloudHSM clusters.
Diff
diff --git a/cloudhsm/latest/userguide/ki-all.md b/cloudhsm/latest/userguide/ki-all.md index 2fc97e02e..631fef287 100644 --- a//cloudhsm/latest/userguide/ki-all.md +++ b//cloudhsm/latest/userguide/ki-all.md @@ -7 +7 @@ -Issue: AES key wrapping uses PKCS #5 padding instead of providing a standards-compliant implementation of key wrap with zero paddingIssue: The client daemon requires at least one valid IP address in its configuration file to successfully connect to the clusterIssue: There was an upper limit of 16 KB on data that can be hashed and signed by AWS CloudHSM using Client SDK 3Issue: Imported keys could not be specified as non-exportableIssue: The default mechanism for the wrapKey and unWrapKey commands in the key_mgmt_util has been removedIssue: If you have a single HSM in your cluster, HSM failover does not work correctlyIssue: If you exceed the key capacity of the HSMs in your cluster within a short period of time, the client enters an unhandled error stateIssue: Digest operations with HMAC keys of size greater than 800 bytes are not supportedIssue: The client_info tool, distributed with Client SDK 3, deletes the contents of the path specified by the optional output argumentIssue: You receive an error when running the SDK 5 configure tool using the --cluster-id argument in containerized environmentsIssue: You receive the error "Failed to create cert/key from provided pfx file. Error: NotPkcs8"Issue: ECDSA signing fails with "invalid mechanism" error starting with SDK 5.16Issue: Signing operations with prehashed data do not properly clear session tokens in interactive modeIssue: CloudHSM client library's default client certificate expires on Jan 31, 2026 +Issue: AES key wrapping uses PKCS #5 padding instead of providing a standards-compliant implementation of key wrap with zero paddingIssue: The client daemon requires at least one valid IP address in its configuration file to successfully connect to the clusterIssue: There was an upper limit of 16 KB on data that can be hashed and signed by AWS CloudHSM using Client SDK 3Issue: Imported keys could not be specified as non-exportableIssue: The default mechanism for the wrapKey and unWrapKey commands in the key_mgmt_util has been removedIssue: If you have a single HSM in your cluster, HSM failover does not work correctlyIssue: If you exceed the key capacity of the HSMs in your cluster within a short period of time, the client enters an unhandled error stateIssue: Digest operations with HMAC keys of size greater than 800 bytes are not supportedIssue: The client_info tool, distributed with Client SDK 3, deletes the contents of the path specified by the optional output argumentIssue: You receive an error when running the SDK 5 configure tool using the --cluster-id argument in containerized environmentsIssue: You receive the error "Failed to create cert/key from provided pfx file. Error: NotPkcs8"Issue: ECDSA signing fails with "invalid mechanism" error starting with SDK 5.16Issue: Signing operations with prehashed data do not properly clear session tokens in interactive modeIssue: CloudHSM client library's default client certificate expires on Jan 31, 2026Issue: Client SDK 5 connection fails due to weak CA certificate key @@ -42,0 +43,2 @@ The following issues impact all AWS CloudHSM users regardless of whether they us + * Issue: Client SDK 5 connection fails due to weak CA certificate key + @@ -195,0 +198,16 @@ As an additional workaround, we have added a configuration option to bypass this +## Issue: Client SDK 5 connection fails due to weak CA certificate key + +After upgrading to Client SDK 5 version 5.17.0 or 5.17.1, your application fails to connect to the AWS CloudHSM cluster with the following error: + + + Certificate verification error with error code 67 and depth 1: CA certificate key too weak + + * **Impact:** Clusters that were initialized with a CA certificate using an RSA key weaker than 2048 bits will fail to connect on Client SDK 5 versions 5.17.0 and 5.17.1. + + * **Workaround:** Downgrade to a Client SDK 5 version earlier than 5.17.0 to restore connectivity to your cluster. + + * **Resolution status:** We are currently working on a fix. + + + +