:_mod-docs-content-type: PROCEDURE
[id="resolving-HSM-back-end-detection-failures_{context}"]

=  Resolving HSM back-end detection failures

[role="_abstract"]
If the {key_manager_first_ref} does not detect the hardware security module (HSM) configuration after adoption, verify that the HSM configuration exists in the source environment and that the `OpenStackControlPlane` custom resource (CR) includes the correct HSM settings.

.Procedure

. Verify that the HSM configuration exists in the source environment:
+
[source,bash]
----
$ ssh tripleo-admin@controller-0.ctlplane \
  "sudo grep -A 10 '\[p11_crypto_plugin\]' \
  /var/lib/config-data/puppet-generated/barbican/etc/barbican/barbican.conf"
----

. Verify that the `customServiceConfig` section in your `OpenStackControlPlane` CR patch includes the `[p11_crypto_plugin]` configuration block with the correct values from your source environment.

. Verify that `enabledSecretStores` includes `pkcs11` and that the `pkcs11` section references the correct Kubernetes secrets:
+
[source,yaml]
----
enabledSecretStores: ["simple_crypto", "pkcs11"]
pkcs11:
  loginSecret: hsm-login
  clientDataSecret: proteccio-data
  clientDataPath: /etc/proteccio
----

. Re-apply the `OpenStackControlPlane` CR patch if you corrected any values.