Docs

Migrating from another HSM

Migration risk lives in the transfer. Roost generates the transfer key itself, so a key leaves your current HSM only wrapped, and plaintext never exists outside an HSM.

Plan

roost migrate plan --inventory keys.csv

27 keys found
  9 exportable (wrapped import)      ->  roost migrate import
 18 non-exportable                   ->  new keys + reissue, see plan.md
estimated side-by-side period: 6 weeks

Wrapped import

roost migrate import --name signing-legacy --partition prod
# 1. Roost creates a one-time wrapping key pair inside the box and prints the public half
# 2. your HSM wraps the key with it (AES-KWP or RSA-OAEP)
# 3. paste or upload the wrapped blob; the import needs the partition's approvals

An imported key is marked imported permanently and shows the import record instead of a birth record.

Keys that cannot leave

Most HSM keys are non-exportable. For those, Roost generates new keys and the plan lists which certificates to reissue, in what order, and how long both systems run side by side. CSRs are produced inside Roost with birth records attached.