Struct HsmConfig 

pub struct HsmConfig {
    pub provider: HsmProvider,
    pub library_path: String,
    pub pin: String,
    pub slot_id: Option<u64>,
    pub token_label: Option<String>,
    pub pkcs11_uri: Option<String>,
    pub max_sessions: usize,
}

[hsm] section — PKCS#11 HSM configuration.

[hsm]
provider = "entrust"
library_path = "/opt/nfast/toolkits/pkcs11/libcknfast.so"
pin = "env:KIPUKA_HSM_PIN"
slot_id = 0

Fields

provider: HsmProvider

HSM middleware provider.

library_path: String

Absolute path to the PKCS#11 shared library (.so / .dylib / .dll).

pin: String

PKCS#11 user PIN for session login.

Supports "env:VAR_NAME" syntax to read the PIN from an environment variable at startup, avoiding plaintext storage in the config file.

slot_id: Option<u64>

PKCS#11 slot ID to use.

When absent, the first available slot is used.

token_label: Option<String>

PKCS#11 token label (alternative to slot_id).

When both slot_id and token_label are set, slot_id takes precedence.

pkcs11_uri: Option<String>

PKCS#11 URI for advanced key identification.

Example: "pkcs11:token=kipuka;object=ca-key;type=private"

This is a template for CA keys; per-CA pkcs11_uri in [[ca]] overrides this when present.

max_sessions: usize

Maximum concurrent PKCS#11 sessions.

Limits the number of simultaneous signing operations to avoid exhausting HSM session resources. Default: 8.

Implementations

impl HsmConfig

pub fn resolve_pin(&self) -> Result<String, String>

Resolve the HSM PIN, expanding "env:VAR_NAME" references.

Trait Implementations

impl Clone for HsmConfig

fn clone(&self) -> HsmConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for HsmConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for HsmConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.