Prerequisites

This installation guide describes how to configure a Primus HSM to be used as a QSCD. This requires enabling SAM mode and configuring the trusted CAs.

Get an HSM

As a first step, you need to get an HSM. This can be an on-premise Primus HSM or a Securosys CloudHSM.

CloudHSM

CloudHSM is a hosted offering from Securosys, where Securosys manages the HSMs for you in a geo-redundant cluster.

For testing purposes, CloudHSM offers the Sandbox (SBX) service.
For production use as a SAM, CloudHSM offers the Economy Certified (ECO CC) service — see the compliance note below!

Sign up to CloudHSM

→

On-premise

Contact the Securosys Sales team to purchase a Primus HSM. There are various models available.

You will need to deploy, manage, and maintain the HSM yourself. For production, a cluster of two or more devices is highly recommended.

Required Firmware

The Primus HSM must run firmware version v3.1 (or newer), since v3.1 introduced support for SAM mode.

Firmware packages can be downloaded from the Support Portal.

Full Compliance

For full compliance with Common Criteria (CC), the HSM needs to run a certified firmware version. Currently, this is the 3.1.0 release, which is CC certified as of 2026-02-23. Note that the 3.2 (LTS) branch is not CC certified.

Additionally, the HSM needs to be operated in compliance with Common Criteria. For details, see Section 14.1 "Common Criteria operating instructions and condition" of the Primus HSM User Guide (Section 15.1 in E31 and later).

warning

When using CloudHSM, you would need to choose the ECO CC service to have a certified firmware and operating environment. However, the ECO CC service runs firmware version 2.8.22 (as of June 2026). Please contact us if you require SAM mode and firmware 3.1.0 on CloudHSM ECO CC.

Additionally, please contact your local auditor or regulator to find out whether you need to own the HSM hardware yourself or whether the Securosys-operated CloudHSM ECO CC service is acceptable.

Required Licenses

CloudHSM

When purchasing the CloudHSM service, select the following features:

• Smart Key Attributes (SKA)
• Signature Activation Module (SAM) ➜ please contact sales
• Transaction Security Broker (if using the workflow engine)

On-premise

For on-premise HSMs, your license needs to include the following options:

• KEY_AUTH, EXTENDED_KEY_ATTRIBUTES (for SKA)
• SAM
• ROOT_KEY_STORE
• REST_API, TSB_ENGINE (if using the Transaction Security Broker)

UI

System ➜ Diagnostics Device ➜ License

Console

hsm_diagnostics lic

Existing CA

As explained in the concepts guide, the identification of users is delegated to an external Certificate Authority (CA). Therefore, you need to have a Public Key Infrastructure (PKI) that can identify users and issue certificates to them.

Later in the installation, you will load one or more (max 5) certificates of the issuing CAs onto the HSM Partition.

tip

You can use the Primus HSM to securely store the CA signing keys. Simply create an additional HSM Partition for the CA, to keep the CA and your eIDAS applications separate. See the Solutions Explorer for a list of existing integrations with various PKI and CA vendors.