Hsm Ped Keys Xfer

Coworker asks “are the PED keys in possession?”

Context: A Hardware Security Module (HSM) is end-of-life (EOL). Customer wants to understand risk and action items if moving the associated private keys to a new HSM still within their PKISaaS certificate lifecycle management (CLM) solution.

Expert analysis: HSMs may have a physical security mechanism so a single entity could not access the device. For example, CUSTOMER, has PED keys and vendor (E.g., DigiCert) have PED keys, CUSTOMER has to come on site to unlock their HSMs - so, that’s a scheduled event. Customer may retain the right to limit [vendor] access using PED keys.