SoftHsm rebuild and Key generation

1

Hi
My KMS cannot connect to mysofthsm, the error is:

ad_name":“main”,“level”:“INFO”,“level_value”:20000,“appName”:“kernel-keymanager-service”}
WARNING: couldn’t connect (10.60.242.234:5666): Connection refused
WARNING: couldn’t create pkcs11 socket (tcp://10.60.242.234:5666): Bad file descriptor

WARNING: couldn’t connect (10.60.242.234:5666): Connection refused
WARNING: couldn’t create pkcs11 socket (tcp://10.60.242.234:5666): Bad file descriptor

config file is invalid

I checked the softhsm and it works and i can display my slots.
Now i want to rebuild the softhsm docker image.
1 - What is the procedure to follow to regenerate my keys.
2 - should regenerate all keys for all modules ?

2

Hi @zeddari

I have asked one of my team to look into this.

Best Regards,
Team MOSIP

3

Hi @zeddari

  1. To regenerate the keys you need to run the keys-generator job to generate all the required keys for all MOSIP modules.
  2. If all MOSIP modules are running, keys needs to regenerated for all modules.

Please note, keys regeneration is required only when you have deleted all the keys from softHSM module. before you run the keys-generator job you need to clear the keymanager DB key_alias & key_store table data.
Also note that any data which is encrypted with old keys will not be able to decrypt with the new set of generated keys and all existing data will not be recoverable.

Thanks,

1 Like
4

Hi
I do regeneration only for key_mgr schema or also for IDA.
if also for IDA, please specify the config to be done.

Also for my partners, Should I regenerate all of them ?

a last question, can we export softhsm docker image that is built and working fine from one host to another ? I did it but the new image does not contains any keys as the original one.

5

Hi @zeddari

If you want to regenerate keys for IDA, in IDA DB same key_alias & key_store tables will exists. You need to clean the entries from these tables and run the ida-keys-generator job to generate fresh keys.

You can use the existing partner keys but you have to onboard the partners again to get the new signed certificate from keymanager.

Yes, you can export existing softhsm docker image with existing set of keys into new host. However you have to use the same softHSM pin.

6

Hi Taheer
Thank you very much for your support.
My issue was solved by following your advices

BR

2 Likes
7

Hi @zeddari

It’s great to hear that your issue was resolved and our team was able to guide you through it.

Best Regards,
Team MOSIP