Add note about PKCS#11

3 years ago · 73fc350b84
parent 9fd0964e1c
commit 73fc350b84
1 changed files with 2 additions and 1 deletions
--- a/systemd/step-ca.service
+++ b/systemd/step-ca.service
@ -30,7 +30,8 @@ SecureBits=keep-caps
 NoNewPrivileges=yes

 ; Sandboxing
-; This works with YubiKey PIV (via pcscd), and presumably with YubiHSM2 via http connector
+; This sandboxing works with YubiKey PIV (via pcscd HTTP API), but it is likely
+; too restrictive for PKCS#11 HSMs.
 ProtectSystem=full
 ProtectHome=true
 RestrictNamespaces=true