Select your cookie preferences

We use essential cookies and similar tools that are necessary to provide our site and services. We use performance cookies to collect anonymous statistics, so we can understand how customers use our site and make improvements. Essential cookies cannot be deactivated, but you can choose “Customize” or “Decline” to decline performance cookies.

If you agree, AWS and approved third parties will also use cookies to provide useful site features, remember your preferences, and display relevant content, including relevant advertising. To accept or decline all non-essential cookies, choose “Accept” or “Decline.” To make more detailed choices, choose “Customize.”

AWS CloudHSM Client SDK 5 configuration syntax

Focus mode
AWS CloudHSM Client SDK 5 configuration syntax - AWS CloudHSM

The following table illustrates the syntax for AWS CloudHSM configuration files for Client SDK 5.

PKCS #11
configure-pkcs11[ .exe ] -a <ENI IP address> [--hsm-ca-cert <customerCA certificate file path>] [--cluster-id <cluster ID>] [--endpoint <endpoint>] [--region <region>] [--server-client-cert-file <client certificate file path>] [--server-client-key-file <client key file path>] [--client-cert-hsm-tls-file <client certificate hsm tls path>] [--client-key-hsm-tls-file <client key hsm tls path>] [--log-level <error | warn | info | debug | trace>] Default is <info> [--log-rotation <daily | weekly>] Default is <daily> [--log-file <file name with path>] Default is </opt/cloudhsm/run/cloudhsm-pkcs11.log> Default for Windows is <C:\\Program Files\\Amazon\\CloudHSM\\cloudhsm-pkcs11.log> [--log-type <file | term>] Default is <file> [-h | --help] [-V | --version] [--disable-key-availability-check] [--enable-key-availability-check] [--disable-validate-key-at-init] [--enable-validate-key-at-init] This is the default for PKCS #11
OpenSSL
configure-dyn[ .exe ] -a <ENI IP address> [--hsm-ca-cert <customerCA certificate file path>] [--cluster-id <cluster ID>] [--endpoint <endpoint>] [--region <region>] [--server-client-cert-file <client certificate file path>] [--server-client-key-file <client key file path>] [--client-cert-hsm-tls-file <client certificate hsm tls path>] [--client-key-hsm-tls-file <client key hsm tls path>] [--log-level <error | warn | info | debug | trace>] Default is <error> [--log-type <file | term>] Default is <term> [-h | --help] [-V | --version] [--disable-key-availability-check] [--enable-key-availability-check] [--disable-validate-key-at-init] This is the default for OpenSSL [--enable-validate-key-at-init]
KSP
configure-ksp[ .exe ] -a <ENI IP address> [--hsm-ca-cert <customerCA certificate file path>] [--cluster-id <cluster ID>] [--endpoint <endpoint>] [--region <region>] [--client-cert-hsm-tls-file <client certificate hsm tls path>] [--client-key-hsm-tls-file <client key hsm tls path>] [--log-level <error | warn | info | debug | trace>] Default is <info> [--log-rotation <daily | weekly>] Default is <daily> [--log-file <file name with path>] Default is <C:\\Program Files\\Amazon\\CloudHSM\\cloudhsm-ksp.log> [--log-type <file | term>] Default is <file> [-h | --help] [-V | --version] [--disable-key-availability-check] [--enable-key-availability-check] [--disable-validate-key-at-init] This is the default for KSP [--enable-validate-key-at-init]
JCE
configure-jce[ .exe ] -a <ENI IP address> [--hsm-ca-cert <customerCA certificate file path>] [--cluster-id <cluster ID>] [--endpoint <endpoint>] [--region <region>] [--server-client-cert-file <client certificate file path>] [--server-client-key-file <client key file path>] [--client-cert-hsm-tls-file <client certificate hsm tls path>] [--client-key-hsm-tls-file <client key hsm tls path>] [--log-level <error | warn | info | debug | trace>] Default is <info> [--log-rotation <daily | weekly>] Default is <daily> [--log-file <file name with path>] Default is </opt/cloudhsm/run/cloudhsm-jce.log> Default for Windows is <C:\\Program Files\\Amazon\\CloudHSM\\cloudhsm-jce.log> [--log-type <file | term>] Default is <file> [-h | --help] [-V | --version] [--disable-key-availability-check] [--enable-key-availability-check] [--disable-validate-key-at-init] This is the default for JCE [--enable-validate-key-at-init]
CloudHSM CLI
configure-cli[ .exe ] -a <ENI IP address> [--hsm-ca-cert <customerCA certificate file path>] [--cluster-id <cluster ID>] [--endpoint <endpoint>] [--region <region>] [--server-client-cert-file <client certificate file path>] [--server-client-key-file <client key file path>] [--client-cert-hsm-tls-file <client certificate hsm tls path>] [--client-key-hsm-tls-file <client key hsm tls path>] [--log-level <error | warn | info | debug | trace>] Default is <info> [--log-rotation <daily | weekly>] Default is <daily> [--log-file <file name with path>] Default for Linux is </opt/cloudhsm/run/cloudhsm-cli.log> Default for Windows is <C:\\Program Files\\Amazon\\CloudHSM\\cloudhsm-cli.log> [--log-type <file | term>] Default setting is <file> [-h | --help] [-V | --version] [--disable-key-availability-check] [--enable-key-availability-check] [--disable-validate-key-at-init] [--enable-validate-key-at-init] This is the default for CloudHSM CLI
configure-pkcs11[ .exe ] -a <ENI IP address> [--hsm-ca-cert <customerCA certificate file path>] [--cluster-id <cluster ID>] [--endpoint <endpoint>] [--region <region>] [--server-client-cert-file <client certificate file path>] [--server-client-key-file <client key file path>] [--client-cert-hsm-tls-file <client certificate hsm tls path>] [--client-key-hsm-tls-file <client key hsm tls path>] [--log-level <error | warn | info | debug | trace>] Default is <info> [--log-rotation <daily | weekly>] Default is <daily> [--log-file <file name with path>] Default is </opt/cloudhsm/run/cloudhsm-pkcs11.log> Default for Windows is <C:\\Program Files\\Amazon\\CloudHSM\\cloudhsm-pkcs11.log> [--log-type <file | term>] Default is <file> [-h | --help] [-V | --version] [--disable-key-availability-check] [--enable-key-availability-check] [--disable-validate-key-at-init] [--enable-validate-key-at-init] This is the default for PKCS #11
PrivacySite termsCookie preferences
© 2025, Amazon Web Services, Inc. or its affiliates. All rights reserved.