{"record":{"id":"c4b0a7953ac13dad","repo":"ory/hydra","slug":"hardware-security-module-is-not-supported-on-this","errorCode":null,"errorMessage":"Hardware Security Module is not supported on this platform.","messagePattern":"Hardware Security Module is not supported on this platform\\.","errorType":"exception","errorClass":"ErrOpSysNotSupported","httpStatus":null,"severity":"critical","filePath":"hsm/manager_nohsm.go","lineNumber":32,"sourceCode":"\n\t\"github.com/pkg/errors\"\n\n\t\"github.com/ory/hydra/v2/jwk\"\n\n\t\"github.com/go-jose/go-jose/v3\"\n)\n\ntype Context interface {\n}\n\ntype KeyManager struct {\n\tjwk.Manager\n\tsync.RWMutex\n\tContext\n\tKeySetPrefix string\n}\n\nvar ErrOpSysNotSupported = errors.New(\"Hardware Security Module is not supported on this platform.\")\n\nfunc NewContext(c *config.DefaultProvider, l *logrusx.Logger) Context {\n\tl.Fatalf(\"Hardware Security Module is not supported on this platform.\")\n\treturn nil\n}\n\nfunc NewKeyManager(hsm Context, config *config.DefaultProvider) *KeyManager {\n\treturn nil\n}\n\nfunc (m *KeyManager) GenerateAndPersistKeySet(_ context.Context, set, kid, alg, use string) (*jose.JSONWebKeySet, error) {\n\treturn nil, errors.WithStack(ErrOpSysNotSupported)\n}\n\nfunc (m *KeyManager) GetKey(_ context.Context, set, kid string) (*jose.JSONWebKeySet, error) {\n\treturn nil, errors.WithStack(ErrOpSysNotSupported)\n}\n","sourceCodeStart":14,"sourceCodeEnd":50,"githubUrl":"https://github.com/ory/hydra/blob/4174065ffb052799890f7480f5360a877a67ffc1/hsm/manager_nohsm.go#L14-L50","documentation":"This is Hydra's fallback KeyManager (`hsm/manager_nohsm.go`) error. This build of the binary was compiled without Hardware Security Module (HSM/PKCS#11) support, so every key-manager operation (GenerateAndPersistKeySet, GetKey, GetKeySet, DeleteKey, DeleteKeySet, AddKey) returns ErrOpSysNotSupported, and NewContext fatals at startup. It indicates a binary/platform mismatch: HSM configuration was requested but the nohsm stub is linked in.","triggerScenarios":"Running a Hydra binary built without the `hsm` build tag (or the standard release) while `hsm` configuration is present in the config; any call to the KeyManager interface in such a build; NewContext is invoked during setup and logs a fatal error.","commonSituations":"Operators set `hsm:` config copied from an HSM-enabled deployment but run the vanilla Docker image; downloading the default release binary instead of the HSM/cgo build; CI images lacking PKCS#11 libraries; platform where HSM support simply is not compiled.","solutions":["Remove the `hsm` section from the Hydra configuration if you do not actually need an HSM.","Use a Hydra build compiled with HSM support (the build variant with the HSM build tag / cgo enabled and PKCS#11 available).","Install the PKCS#11 vendor library and required OS packages on the host, then run the HSM-capable binary.","If self-building, build with the HSM enabled tag and verify the resulting binary connects to the HSM before deploying."],"exampleFix":"# before: vanilla image with HSM config\nimage: oryd/hydra:latest\nhsm:\n  library: /usr/lib/softhsm.so\n# after: either drop hsm config or use HSM-enabled build\nimage: oryd/hydra:latest-hsm   # or custom build with HSM tag\nhsm:\n  library: /usr/lib/softhsm.so","handlingStrategy":"fallback","validationCode":"// verify at boot whether HSM is actually usable in this build/binary\nif hsmConfigured && !buildHasHSM() {\n    log.Fatal(\"hsm configured but this binary lacks HSM support; use the HSM build or remove hsm config\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Match the binary flavor to the config: HSM config only on HSM-enabled builds","Smoke-test HSM connectivity in CI before deploying","Remove the hsm config section on platforms/builds without PKCS#11","Document which release artifacts include HSM support"],"tags":["hsm","pkcs11","build-config","hydra"],"backgroundTag":"hsm-not-supported-on-platform","analyzedSha":"4174065ffb052799890f7480f5360a877a67ffc1","analyzedAt":"2026-09-03T14:52:41.581Z","contentChangedAt":"2026-09-03T14:52:41.581Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}