4 ms·

I use HashiCorp Vault paid version to interface with an on premises HSM and for its FIPS compliance. I don’t know of any other software that is as lightweight a

I use HashiCorp Vault paid version to interface with an on premises HSM and for its FIPS compliance. I don’t know of any other software that is as lightweight and easy to use with an HSM as vault. We are using Vault to store the signed intermediate CA and automatically unseal Vault by storing the shards in the HSM (along with the Root CA). OpenBao wouldn’t solve this for me.

bogomipz 3y ago
Can I ask what regulatory domain you are in that requires on-prem HSM(vs cloud offering)? Also do you have a recommendation for on-prem HSM vendors that work well with Vault?
- firesteelrain 3y ago
  Financial Sector and Thales TCT HSM https://cpl.thalesgroup.com/sites/default/files/content/integration_guides/field_document/2022-07/HashiCorpVault_LunaHSM_IntegrationGuide_RevE.pdf https://cpl.thalesgroup.com/sites/default/files/content/inte...
candiddevmike 3y ago
> OpenBao wouldn’t solve this for me. I'd bet OpenBao gets native HSM support. The problem will be doing it in a clean room setting to avoid any legal issues.
- firesteelrain 3y ago
  Someone would have to fund it. The compliance issues alone are very expensive.
  - NewJazz 3y ago
    Forgive my ignorance, but what does compliance have to do with HSM support? Aren't they orthogonal features?
    - tucnak 3y ago
      The "HSM support" bit is totally dependant on compliance; it's not about APIs.
      - NewJazz 3y ago
        You didn't answer my question. How is it dependent?
        wlonkly 3y ago
        The reason people pay Hashicorp for HSM support is so that they can run Vault in a FIPS-certified mode.
  - alemanek 3y ago
    IBM, somewhat unofficially, is behind this recent fork. It might take a bit but if this fork gains traction then I would assume it gets this functionality.
sidlls 3y ago
Vault isn't easy to use at any kind of larger scale, though. It works well enough for small deployment infrastructure. Once you get to a certain size, all of HashiCorp's tech starts to show its poor, overengineered design in both performance and stability.
- z33k 3y ago
  Could you elaborate a bit on what you consider large size? Did you have issues with Vault specifically? In my experience Terraform is the troublesome Hashicorp tool, not Vault.
- firesteelrain 3y ago
  We have a Vault cluster running in containers. It is working well
- fishnchips 3y ago
  > overengineered design Having operated a large Vault (FOSS, not commercial) installation, "overengineered" is not the word I'd use.
  - sidlls 3y ago
    What word would you use?
    - fishnchips 3y ago
      Cleverly designed to make you go commercial.

bogomipz 3y ago

Can I ask what regulatory domain you are in that requires on-prem HSM(vs cloud offering)? Also do you have a recommendation for on-prem HSM vendors that work well with Vault?

firesteelrain 3y ago
Financial Sector and Thales TCT HSM https://cpl.thalesgroup.com/sites/default/files/content/integration_guides/field_document/2022-07/HashiCorpVault_LunaHSM_IntegrationGuide_RevE.pdf https://cpl.thalesgroup.com/sites/default/files/content/inte...

candiddevmike 3y ago

> OpenBao wouldn’t solve this for me. I'd bet OpenBao gets native HSM support. The problem will be doing it in a clean room setting to avoid any legal issues.

firesteelrain 3y ago
Someone would have to fund it. The compliance issues alone are very expensive.
- NewJazz 3y ago
  Forgive my ignorance, but what does compliance have to do with HSM support? Aren't they orthogonal features?
  - tucnak 3y ago
    The "HSM support" bit is totally dependant on compliance; it's not about APIs.
    - NewJazz 3y ago
      You didn't answer my question. How is it dependent?
      - wlonkly 3y ago
        The reason people pay Hashicorp for HSM support is so that they can run Vault in a FIPS-certified mode.
- alemanek 3y ago
  IBM, somewhat unofficially, is behind this recent fork. It might take a bit but if this fork gains traction then I would assume it gets this functionality.

sidlls 3y ago

Vault isn't easy to use at any kind of larger scale, though. It works well enough for small deployment infrastructure. Once you get to a certain size, all of HashiCorp's tech starts to show its poor, overengineered design in both performance and stability.

z33k 3y ago
Could you elaborate a bit on what you consider large size? Did you have issues with Vault specifically? In my experience Terraform is the troublesome Hashicorp tool, not Vault.
firesteelrain 3y ago
We have a Vault cluster running in containers. It is working well
fishnchips 3y ago
> overengineered design Having operated a large Vault (FOSS, not commercial) installation, "overengineered" is not the word I'd use.
- sidlls 3y ago
  What word would you use?
  - fishnchips 3y ago
    Cleverly designed to make you go commercial.