Certificate storage limits
The following limits apply to certificate storage. You can't change these limits. The maximum number of stored certificates applies to each cluster. The read and write rate limits apply to each HSM, so the total rate that a cluster supports increases as you add HSMs.
Limit |
Value |
Scope |
|---|---|---|
Maximum stored certificates |
60 |
Each cluster |
Read operations per second |
10 |
Each HSM |
Write operations per second |
1 |
Each HSM |
Read operations include C_FindObjectsInit and
C_GetAttributeValue. Write operations include
C_CreateObject, C_SetAttributeValue, and
C_DestroyObject.
The following behaviors apply when you exceed these limits:
-
If you exceed the maximum number of stored certificates, the
C_CreateObjectoperation returnsCKR_FUNCTION_FAILED, and certificate storage records aMaxObjectsReachederror in your certificate storage audit logs. Your existing certificates remain readable. To store additional certificates, delete certificates that you no longer need. -
If you exceed the read or write rate limit, certificate storage throttles the request and operations return
CKR_FUNCTION_FAILED, except forC_GetAttributeValue, which returnsCKR_DEVICE_ERROR(see Issue: C_GetAttributeValue returns CKR_DEVICE_ERROR when throttled). The PKCS #11 library does not retry throttled certificate storage operations (see Issue: The PKCS #11 library does not retry throttled certificate storage operations), so your application must retry them with exponential backoff. For more information, see HSM throttling.
