A hardware security module (HSM) is a physical device that securely generates, stores, and manages cryptographic keys. HSMs provide both logical and physical protection of cryptographic materials against unauthorized use and tampering. Cryptographic operations (for example, certificate signing) occur exclusively inside the device at the request of a trusted application or entity. This protection helps you comply with strict industry and security requirements, such as the Payment Card Industry Data Security Standard (PCI DSS) or Federal Information Processing Standards (FIPS).

You can store and generate private keys used for TLS decryption on an HSM integrated with a Next-Generation Firewall (NGFW) or Panorama. A master key encrypts the private keys stored on the HSM. The NGFW or Panorama acts as a client, establishing a secure TLS connection with an external HSM server. When the client requests a cryptographic operation, the HSM server performs the operation and sends the result. This process ensures private keys are never exposed. For enhanced security, you can also store the master key on an HSM instead of the NGFW.

NGFWs integrate with the following HSM and key management products:

To secure keys with an HSM, you need to set up connectivity between your NGFW and the HSM server, register the NGFW as an HSM client with the HSM server, then configure HSM settings for master keys and private keys, and any additional steps specific to the HSM product.