HSM Sources

Register the Hardware Security Modules in your estate — network appliances, cloud HSM services, or a generic PKCS#11 device — as Versus integrations, so certificate policy can name the HSM that is meant to hold a key.

This covers HSM Sources, under the Versus Platform workspace — Integrations → HSM Sources (/integrations/hsm, administrator access; the page itself is titled HSM Integrations).

Scope today. An HSM source is a connection record: type, endpoint, partition or slot, and credentials, with a reachability test. It is referenced by TLS certificate profiles and App Builder entitlements. Versus does not yet open PKCS#11 sessions, generate keys inside the HSM, or anchor its own encryption keys there — see What is roadmap.

---

Supported HSM types

Twelve types, grouped in the picker as Appliance, Cloud, and Other. Choosing a type pre-fills the port and relabels the partition field.

---

Adding a source

Click Add HSM and fill in:

• Name — a label, e.g. Production Luna HSM.
• HSM Type — one of the twelve above.
• Host (appliances) or Management Endpoint (cloud types) — hostname or IP of the HSM or its management API, e.g. cluster-id.cloudhsm.amazonaws.com.
• Port — defaulted per type; editable.
• Partition Name / Slot Label / Key Group / HSM ID — the vendor-specific partition, slot, or key group.
• Username / CO and Password — the admin or crypto-officer account.
• Partition PIN — the partition or crypto-officer PIN.
• Advanced options — API Key (cloud HSM management APIs), Verify SSL (default on), Enabled (default on).

Password, PIN, and API key are encrypted at rest and write-only: the API never returns them, and leaving a field blank when editing keeps the stored value. Vendor-specific extras — a client-certificate path, cluster ID, or region — go in the source's extra_config JSON via the API (/api/integrations/hsm-sources/). Sources are tenant-scoped in multi-tenant deployments.

---

Testing a connection

The refresh icon on a source card runs Test connection. For AWS CloudHSM, Azure HSM, and Google Cloud HSM Versus issues an HTTPS GET to https://<host>:<port>/ (honouring Verify SSL) and treats any HTTP response — even a 4xx — as reachable, since the management endpoint answered. For every other type, including IBM Cloud HSM and generic PKCS#11, it opens a plain TCP connection to the host and port with a 10-second timeout.

The result is stored on the source as Reachable, Connection error (with the error text), or Not tested, with a last-tested timestamp; the page's summary strip counts Total / Reachable / Errors. This is a network-reachability check only — it does not log in to a partition or exercise a key.

---

Where HSM sources are used

• Certificate profiles. A profile's Custody is Centralized Escrow (Versus-managed key), CSR-Only (customer key, never escrowed), or HSM-Backed (key generated and held in an HSM, non-exportable). Choosing HSM-Backed reveals an HSM Source selector, and the profile records that reference. Today this is a declared policy: issuance still generates and escrows keys under the software KEK (app-master-v1). The escrow model already carries hsm_source, hsm_key_handle, and a kek_ref of the form hsm:<source_id>:<label> for the HSM-backed path, and the certificate inventory carries an hsm_backed flag, but an escrow row tagged with an HSM KEK is refused at unwrap ("HSM-backed keys require Phase 3").
• App Builder. An app version can be entitled to an HSM Source resource, so a no-code app can reference one without exposing the whole integrations page.

---

What is roadmap

Versus models HSM custody, but its own encryption keys are software keys. The Versus Vault's master KEK — the key that unwraps every per-secret data-encryption key — is a strong software key delivered by your secrets manager, and binding it to an HSM is a roadmap item, as Day in the Life of a Secret states. The same applies to CLM's key-escrow KEK (the "Phase 3" path above) and to non-exportable TLS keys generated inside an HSM. Do not read an HSM source's Reachable status as HSM-backed key protection. For the vault's current envelope-encryption design, see Vault Hardening.

---

Quick Reference

Related: Certificates · Certificate Authorities · Secret Vault · External Vault Integrations · App Builder overview