Seeking assistance on using PKCS11 with a remote HSM.
I have a small linux host with an HSM card installed. The HSM has libraries and utility scripts provided to interact with it, on that host. These include a pkcs11 utility. What I can’t grasp is how to access this remotely. I get that pkcs11 provides an API. But I don’t get how to use it as part of a bigger PKI infrastructure. If on another linux host I used openssl (or other pki toolkit) to sign a certificate request, I need access to the private key - stored on my host with its HSM. How do I do that?
The openssl command has some component using pkcs11 like “… -engine pkcs11 -keyform engine -keyfile "pkcs11:model=PKCS … serial=xxxxx ;token= xxxxx UserPIN= xxx …” and so on. That is obviously not contacting a network service. So how can a remote HSM that provides a signing key be reached in this case?
Am I getting the sense of this wrong? Does the whole CSR file need to be sent over to the HSM host and submitted to be signed? For example using ssh to that host and passing the CSR to a script there that then runs the pkcs11 library functions to return a cert and then provide it to the ssh based request?
I’m missing some details about how this all works. Assistance appreciated. Thank you.