> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Section Overview Understand the Hardware Security Module HSM Integration
> This lesson covers integrating a Hardware Security Module with HashiCorp Vault, focusing on Auto Unsealing and Seal Wrap features for enhanced security.
In this lesson, we’ll cover the key concepts of integrating a Hardware Security Module (HSM) with HashiCorp Vault. You’ll learn two primary features—Auto Unsealing and Seal Wrap—and understand how they enhance Vault’s security posture.
* **Auto Unsealing with HSM**: Enables Vault to decrypt its master key automatically using an HSM, eliminating manual unseal operations.
* **Seal Wrap**: Leverages the HSM to wrap and protect Vault’s storage encryption keys, ensuring data-at-rest remains secure.
HashiCorp does not provide an HSM for certification candidates. If you have access to an on-premises or cloud-based HSM, follow the [official Vault PKCS#11 seal documentation][pkcs11-docs] to configure auto unsealing and seal wrap.
This section is concise—just enough to grasp the exam topics and real-world deployment considerations. Next, we’ll dive into how Auto Unsealing works under the hood.
***
## Quick Comparison: Auto Unsealing vs. Seal Wrap
| Feature | Purpose | Typical Use Case |
| -------------- | ------------------------------------------------------------------- | ------------------------------------------ |
| Auto Unsealing | Vault uses HSM to decrypt its master key automatically | Zero-downtime recovery and streamlined ops |
| Seal Wrap | Wraps Vault’s data encryption keys inside the HSM’s secure boundary | Additional Layer of storage encryption |
***
## Links and References
* [Official Vault PKCS#11 Seal Integration][pkcs11-docs]
* [HashiCorp Vault Documentation](https://developer.hashicorp.com/vault/docs/)
* [HSM Concepts and Best Practices](https://en.wikipedia.org/wiki/Hardware_security_module)
[pkcs11-docs]: https://developer.hashicorp.com/vault/docs/configuration/seal/pkcs11