Verify Fulcio PKCS #11 mode

Verify that Fulcio is correctly using the HSM for cryptographic operations by checking status conditions and pod configurations.

Before you begin

  • The SecureSign custom resource is deployed with Fulcio PKCS #11 configuration.
  • Cluster administrator access to the OpenShift cluster.
  • A workstation with the python3 command for parsing JSON output.

Procedure

  1. Check the Fulcio PKCS #11 status condition: 
    $ oc get fulcio fulcio-server -n trusted-artifact-signer -o jsonpath='{.status.conditions}' | \
  python3 -m json.tool | grep -A 5 "FulcioPKCS11"

    Expected output:

    {
    "type": "FulcioPKCS11Ready",
    "status": "True",
    "reason": "PKCS11Configured"
}

    This condition indicates that Fulcio successfully loaded the PKCS #11 configuration and can access the HSM.

  2. Verify that Fulcio is using PKCS #11 for certificate signing: 
    $ oc get pod -l app.kubernetes.io/name=fulcio-server \
  -n trusted-artifact-signer -o jsonpath='{.items[0].spec.containers[0].args}' | \
  python3 -m json.tool

    The output should include arguments related to PKCS #11:

    ["--ca=pkcs11ca", "--pkcs11-config-path=/etc/fulcio-config/crypto11.conf", ...]

    These arguments confirm that Fulcio is configured to use the PKCS #11 certificate authority with the specified configuration and key ID.

  3. Verify that the PKCS #11 library is available in the Fulcio pod: 
    $ oc exec -n trusted-artifact-signer deployment/fulcio-server -- ls -l /var/run/hsm-lib/

    The output should list the PKCS #11 library file (for example, libsofthsm2.so).

  4. Review the Fulcio logs for PKCS #11 initialization messages: 
    $ oc logs -n trusted-artifact-signer deployment/fulcio-server | grep -i pkcs11

    The logs should contain messages indicating successful PKCS #11 initialization and HSM connection.

  5. Check the Fulcio resource status for overall health: 
    $ oc get fulcio fulcio-server -n trusted-artifact-signer -o yaml

    The status section should show Fulcio as ready with PKCS #11 configuration applied.

  6. Optional: If your HSM provides audit logging, review the HSM audit logs:

    Check the HSM vendor’s audit log interface to verify that Fulcio successfully authenticated and established connections to the HSM. Verify successful key operations including:

    • HSM authentication using the configured PIN
    • Access to the signing key (CKA_ID 99)
    • Signature operations performed by Fulcio