Comment by tptacek | Hacker News Reader

Top New Best Ask Show Jobs

Comment by tptacek | Hacker News Reader

Parent Full thread

What's the reg you're up against that says your need an HSM?

E.g. this: https://www.bsi.bund.de/EN/Themen/Unternehmen-und-Organisati...

I am aware of industry talks of lobbying on behalf of HSM manufacturers that led to these requirements and that's just sad.

Pretty sure ETSI demands it for trusted service providers https://portal.etsi.org/TB-SiteMap/ESI/Trust-Service-Provide...

Also CAB Forum has started to require private keys in HSM only for code signing certs.

Yes, but you can outsource that part to Digicert et al, so that you don’t need to buy the HSM yourself.

Reply on news.ycombinator.com