--- title: An Introduction to Hardware Security Modules (HSMs) description: Hardware security modules (HSMs) are physical devices that store sensitive data like private keys and expose only cryptographic operations such as signing,... canonical: https://daily.dev/posts/an-introduction-to-hardware-security-modules-hsms--jichwfpqp twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: An Introduction to Hardware Security Modules (HSMs) | daily.dev og:description: Hardware security modules (HSMs) are physical devices that store sensitive data like private keys and expose only cryptographic operations such as signing,... og:url: https://daily.dev/posts/an-introduction-to-hardware-security-modules-hsms--jichwfpqp og:image: https://api.daily.dev/og/posts/jIchWfPQP.png og:image:alt: An Introduction to Hardware Security Modules (HSMs) og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # An Introduction to Hardware Security Modules (HSMs) **[Teleport](https://daily.dev/sources/teleport)** · 4 min read · 0 upvotes · 0 comments ## Summary Hardware security modules (HSMs) are physical devices that store sensitive data like private keys and expose only cryptographic operations such as signing, never allowing the raw key to be read back. This protects against attackers who compromise a database or storage backend, since keys are no longer stored as plaintext there. Teleport, an infrastructure access platform, traditionally relied on storage-backend encryption (etcd, DynamoDB, Firestore) to protect its certificate authority's private key, leaving it vulnerable if that backend was compromised. With the upcoming Teleport 7.2 release, HSM support is being added so CA private keys live inside the HSM instead, requiring physical datacenter access to steal them. HSMs mitigate direct key theft from a database but do not stop attackers who gain persistence and abuse the Auth Server to request certificates. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is a hardware security module (HSM) and why does it protect private keys better than a database? A hardware security module is a physical device that stores sensitive data like private keys without ever allowing that data to be read back, exposing only cryptographic operations such as signing or encryption. This means that even if an attacker gains remote access to a system, they cannot extract the private key, unlike keys stored in a disk or database where compromise of the storage backend directly compromises the key material. _Teams evaluating key management options can track HSM adoption patterns and security architecture discussions on daily.dev._ ### How does Teleport plan to use HSMs to protect its certificate authority private key? Teleport is adding HSM support in its 7.2 release so that the certificate authority's private key is embedded within the HSM itself rather than stored in the storage backend (etcd, DynamoDB, or Firestore). The database then only holds ephemeral data like cluster inventory, meaning an attacker would need physical access to the datacenter to steal the key material instead of just compromising the database. _Anyone hardening cluster access can follow infrastructure security releases like this one on daily.dev._ ### What attack vectors do HSMs mitigate versus what they leave unprotected in a certificate authority setup? HSMs mitigate the attack vector where someone steals the CA private key directly from a database, since the key is never stored as readable plaintext. They do not mitigate the second vector, where an attacker gains persistence inside a victim's cluster and simply requests the Auth Server to sign certificates, which produces the same practical outcome as direct key theft. _Security engineers weighing defenses against key theft can compare mitigation strategies like this on daily.dev._ ## Similar posts on daily.dev - [Introducing Single-tenant Cloud HSM for more data encryption control](https://daily.dev/posts/introducing-single-tenant-cloud-hsm-for-more-data-encryption-control-ynugriv61) · Google Cloud · 0 upvotes · 0 comments - [Hardware Security Module Integration for Post-Quantum Key Encapsulation](https://daily.dev/posts/hardware-security-module-integration-for-post-quantum-key-encapsulation-yylcoq3hg) · Security Boulevard · 1 upvotes · 0 comments - [Enforcing trust and transparency: Open-sourcing the Azure Integrated HSM](https://daily.dev/posts/enforcing-trust-and-transparency-open-sourcing-the-azure-integrated-hsm-fjn2thhrd) · Microsoft Azure · 0 upvotes · 0 comments - [Hardware Security Module Integration for Quantum-Safe Model Contexts](https://daily.dev/posts/hardware-security-module-integration-for-quantum-safe-model-contexts-64tno8yb1) · Security Boulevard · 0 upvotes · 0 comments - [MPC, HSM, and TEE Explained: A Developer’s Guide to Key Management Technologies in Wallet Infrastructure](https://daily.dev/posts/mpc-hsm-and-tee-explained-a-developer-s-guide-to-key-management-technologies-in-wallet-infrastruc-ksotvpjk3) · Coins Bench · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cryptography](https://daily.dev/tags/cryptography) [View this post on daily.dev](https://daily.dev/posts/an-introduction-to-hardware-security-modules-hsms--jichwfpqp) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"An Introduction to Hardware Security Modules (HSMs)","url":"https://daily.dev/posts/an-introduction-to-hardware-security-modules-hsms--jichwfpqp","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/an-introduction-to-hardware-security-modules-hsms--jichwfpqp"},"datePublished":"2026-08-23T12:19:06.541Z","dateModified":"2026-08-23T12:30:58.015Z","description":"Hardware security modules (HSMs) are physical devices that store sensitive data like private keys and expose only cryptographic operations such as signing,...","image":"https://media.daily.dev/image/upload/s--1KxV4ohY--/f_auto/v1722860400/public/Placeholder%2007","thumbnailUrl":"https://media.daily.dev/image/upload/s--1KxV4ohY--/f_auto/v1722860400/public/Placeholder%2007","isAccessibleForFree":true,"articleSection":"Teleport","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Teleport","logo":"https://media.daily.dev/image/upload/s--Dw-Bbw6O--/c_limit,w_256/f_auto,q_auto/v1787487494/logos/teleport?_a=BAMAMicg0","url":"https://daily.dev/sources/teleport"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/an-introduction-to-hardware-security-modules-hsms--jichwfpqp","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cryptography","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Teleport","item":"https://daily.dev/sources/teleport"},{"@type":"ListItem","position":3,"name":"An Introduction to Hardware Security Modules (HSMs)"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/an-introduction-to-hardware-security-modules-hsms--jichwfpqp#faq","mainEntity":[{"@type":"Question","name":"What is a hardware security module (HSM) and why does it protect private keys better than a database?","acceptedAnswer":{"@type":"Answer","text":"A hardware security module is a physical device that stores sensitive data like private keys without ever allowing that data to be read back, exposing only cryptographic operations such as signing or encryption. This means that even if an attacker gains remote access to a system, they cannot extract the private key, unlike keys stored in a disk or database where compromise of the storage backend directly compromises the key material. Teams evaluating key management options can track HSM adoption patterns and security architecture discussions on daily.dev."}},{"@type":"Question","name":"How does Teleport plan to use HSMs to protect its certificate authority private key?","acceptedAnswer":{"@type":"Answer","text":"Teleport is adding HSM support in its 7.2 release so that the certificate authority's private key is embedded within the HSM itself rather than stored in the storage backend (etcd, DynamoDB, or Firestore). The database then only holds ephemeral data like cluster inventory, meaning an attacker would need physical access to the datacenter to steal the key material instead of just compromising the database. Anyone hardening cluster access can follow infrastructure security releases like this one on daily.dev."}},{"@type":"Question","name":"What attack vectors do HSMs mitigate versus what they leave unprotected in a certificate authority setup?","acceptedAnswer":{"@type":"Answer","text":"HSMs mitigate the attack vector where someone steals the CA private key directly from a database, since the key is never stored as readable plaintext. They do not mitigate the second vector, where an attacker gains persistence inside a victim's cluster and simply requests the Auth Server to sign certificates, which produces the same practical outcome as direct key theft. Security engineers weighing defenses against key theft can compare mitigation strategies like this on daily.dev."}}]} ```