How Danggeun built a large-scale signing key management system with AWS CloudHSM – Part 3: Implementing the signing system, troubleshooting, and seamless key rotation | Amazon Web Services

In part 3 of its AWS CloudHSM-based signing system, Danggeun completed signing implementation with PKCS#11 and crypto11.

The team worked through operational issues and troubleshooting to stabilize the HSM-dependent setup.

By abstracting CloudHSM, KMS, and local signers behind a TokenSigner interface, it built an Active-Standby architecture.

On failure, the system can fail over to KMS without interruption while preserving tens of millions of tokens.

It also moved from RS256 to ES256 to improve performance and efficiency.