Why I don't like smartcards, HSMs, YubiKeys, etc.
HSMs are shit.<p>In a previous role we used a major vendor's HSM to protect our private keys. VERY expensive kit, more expensive than the load balancers and servers combined.<p>We needed to use Elliptic Curve keys for a particular customer - so it got even more expensive as we had to buy:<p>1. A license from the LB vendor to use the HSM<p>2. A licence from the HSM vendor to use EC with the LB.<p>... even though they trumpeted these announcements of how radically great they were together we found:<p>1. The integration didn't work, full stop.<p>2. The version of OpenSSL we had to use (supplied) was about 18 months out of date<p>3. The specially b0rked version of OpenSSL supplied didn't support EC via a HSM<p>Even better - when Heartbleed came out I had a patch from RedHat on day 1. The load balancer?<p>Nope - nothing on their website - I had to create a ticket which said 'we are aware of the issue', at which point the ticket was closed. I questioned this and was told they couldn't keep it open, I had to create a new ticket every few weeks to find out whether they'd actually deigned to assign a bug id to the issue.<p>The HSM vendor just said nothing, zero, until a new version of the firmware was silently released 4 months later.<p>The whole industry is shit. I'd rather have a farm of Yubikeys than one of those HSMs.