Validate charon can load the HSM-backed private key

Load the responder certificate from the filesystem and its matching private key from CryptoHub.

Install the certificates

sudo install -d -m 755 /etc/swanctl/x509 /etc/swanctl/x509ca
sudo install -m 644 /root/strongswan-certs/responder-cert.pem \
  /etc/swanctl/x509/responder-cert.pem
sudo install -m 644 /root/strongswan-certs/ca-cert.pem \
  /etc/swanctl/x509ca/ca-cert.pem

Configure the token credential

The following command reads the endpoint password and CKA_ID from their protected files. It writes both values into the root-only strongSwan credential file without printing them.

PIN="$(sudo cat /etc/strongswan-chlibs/token-pin)"
KEY_ID="$(sudo cat /etc/strongswan-chlibs/responder-key-id)"

sudo tee /etc/swanctl/swanctl.conf > /dev/null <<EOF
connections {
}

secrets {
    token-strongswan {
        module = futurex
        slot = 0
        handle = $KEY_ID
        pin = "$PIN"
    }
}
EOF

unset PIN KEY_ID
sudo chmod 600 /etc/swanctl/swanctl.conf
sudo chown root:root /etc/swanctl/swanctl.conf

swanctl.conf contains the endpoint password. Restrict the file to root and exclude it from unprotected backups.

Load the key

sudo systemctl restart strongswan-starter
sudo swanctl --load-creds --clear --raw

The output includes load-token reply {success=yes ...}. The charon log includes loaded RSA private key from token.

sudo grep -Ei 'loaded RSA private key|load-token|futurex' \
  /var/log/charon-debug.log | tail -20

​Install the certificates

​Configure the token credential

​Load the key

Install the certificates

Configure the token credential

Load the key