hsm

Exactly one of the two may be set at the config level (API mode has neither; signing modes require one to be set). See https://mnestor.github.io/ssoossh/operations/hsm/ for setup. Supported: ECDSA P-256/384/521, RSA >= 2048. Ed25519 is not supported by PKCS#11 here; keep ssh_key for an Ed25519 CA.

Key	Type	Default
hsm.module	string	empty
hsm.token_label	string	empty
hsm.pin	string	empty
hsm.pin_file	string	empty
hsm.key_label	string	empty
hsm.key_id	string	empty

module

string, default empty

The absolute path to the PKCS#11 shared library, e.g. /usr/lib/softhsm/libsofthsm2.so. Setting it enables HSM mode.

hsm:
  module: "/usr/lib/softhsm/libsofthsm2.so"

token_label

string, default empty

Selects the token (softhsm2-util –init-token –label …).

hsm:
  token_label: "ssoossh-ca"

pin

string, default empty

The user PIN. Mutually exclusive with PINFile.

hsm:
  pin: "1234"

pin_file

string, default empty

A path whose trimmed contents are the user PIN. Preferred over inline PIN so the config file can stay world-readable-ish.

hsm:
  pin_file: "/etc/ssoossh/hsm-pin"

key_label

string, default empty

Selects the key pair by CKA_LABEL. At least one of key_label or key_id is required; when both are set both must match.

hsm:
  key_label: "ssoossh-ca"

key_id

string, default empty

Selects the key pair by CKA_ID, hex-encoded (pkcs11-tool –id).

hsm:
  key_id: "01"