HSM generated keys for EJBCAs generated PKCS#12 objects

[dwabisch]

Is your feature request related to a problem or specific use case? Please describe.
I am wondering if it is possible to create PKCS#12 objects by EJBCA with "good" keys from HSM?
So far I do not know that it is currently possible to configure a HSM for the EJBCA-Key-Generation.

Describe the solution you'd like
I would like to configure a HSM that will generate PKCS#12 object by EJBCA.

Describe alternatives you've considered

Product deployment

• next version

Additional context

[primetomas]

Can you specify more details. I am guessing that you do not mean CA signing keys but rather server generated end user keys. Is that a valid guess?

[dwabisch]

Correct! I am interested into EE_user keys that are generated by HSM.

[primetomas]

EJBCA does not support server generating end entity keys on an HSM. You have to do your own RA integration for that. I.e. you can have a small component that generates your keys and gets the certificate from EJBCA and returns a P12 to end entity.
If you need to store the P12 for key recovery in EJBCA there are APIs to store key recovery information.