As explained in Configuring and deploying Certificate Authorities, the Vendor field of the HSM configuration page allows selecting the following Hardware security modules.

Vendor

Description

​none

A built-in software PKCS #11 module (not recommended). 

nshield

An Entrust nShield HSM. See HSM requirements for the supported versions.

On test environments, you can change the Vendor parameter value of an already deployed Certificate Authorities solution.

Changing vendor from none to nShield

See below for changing the value of the Vendor parameter from none to nShield.

To change the vendor from none to nShield

  1. Create a new database, as explained in Creating the Certificate Authorities database, or recreate the public schema of the database.
  2. Run the following command. 
    sudo kubectl delete namespace pkihub-v202410180954
  3. Set the Vendor field of the HSM configuration page to nShield.
  4. Save the configuration. 
  5. Redeploy the solution.

Changing vendor from nShield to none

See below for changing the value of the Vendor parameter from nShield to none.

Use pkihub as solution identifier when running the clusterctl solution config export and clusterctl solution config import commands.

To change the vendor from nShield to none

  1. Create a new database, as explained in Creating the Certificate Authorities database, or recreate the public schema of the database.
  2. Run the following command. 
    sudo kubectl delete namespace pkihub-v202410180954
  3. Set the Vendor field of the HSM configuration page to none.
  4. Save the configuration. 
  5. Export the configuration files with the clusterctl solution config export command.
  6. Delete the config folder of the HSM installation.
  7. Delete the kmdata.tar file of the HSM installation.
  8. Import the configuration files with the clusterctl solution config import command.
  9. Redeploy the solution.