List Key Certificates on the HSM Device

About this task

Use the manageKeyCerts -listHsm command to list keys on the HSM. This command can be run while CM is running.

Consider the following before you use this command:

For Thales HSMs, all HSM keys that can be loaded with the provided smart card passphrase are listed, if the keyStoreData parameter is not defined.
If you define the engine parameter, the keys stored on the HSM at the engine are listed. You must configure HSM support at the engine to use this command.
If a netHSM is used and multiple engines access it, any of the engines can be specified to run the request.
If the engine parameter is not defined, the command lists the keys stored on the HSM at CM. HSM support must be enabled at CM.

To list the key certificate on the HSM device, type the following command:

manageKeyCerts -listHsm [parameters]

Refer to the following table for a description of the list parameters:


Parameter	Description
engine	Name of the engine with access to the HSM. Optional.
keyStoreData	HSM keystore blob string. Used with the Thales HSM. This is a 40-character hex string, displayed as "Key Instance" by the Thales KeySafe utility. If it is not provided, all keys that can be loaded with the provided smart card passphrase are listed. Alternatively, the blob string can be written to a file. Specify that file name in the keyStoreFile parameter.
keyStoreFile	File containing HSM keystore data. If defined, this parameter overrides the keyStoreData parameter.
systempass	CM system passphrase.
adminid	Administrator ID. Optional. Prompts if not defined.
adminpass	Administrator password. Optional. Prompts if not defined.
keystorepass	Keystore password. Optional. Prompts if not defined. For Safenet, the user PIN for the slot used by Secure Proxy. For Thales, the passphrase for the operator smart card that will be used to protect the key. The card must be inserted in the module's card reader.

Note: If you run the manageKeyCerts -list command and it takes a long time to run or appears to lock up, open the install_dir/bin/security.properties file on the CM computer, where install_dir is the location of the CM installation, insert the line DEF_KEYSTORE_TYPE=JKS and save the file.