Uninstall the PQCOP CodeSafe Machines

If you are following this guide as a training exercise, you need to uninstall the PQCOP CodeSafe machines to clear your environment before creating a mixed-state environment. Creating a mixed-state environment demonstrates how to use an LMS key with two types of HSM: the nShield Connect XC and the nShield 5c.

Uninstall the PQCOP CodeSafe machine from the nShield 5c

To uninstall the PQCOP CodeSafe machine from the nShield 5c, complete the following steps. You will need the UUID of the CodeSafe machine.

  1. Run pipsqueak:

    ./pipsqueak
PQSDK: 1.4.1 (7852-268D-3BF9: 1.4.1)

  2. Stop the PQCOP CodeSafe machine:

    csadmin stop --esn 7852-268D-3BF9 --uuid 607fc44d-953b-4b83-8c2b-945a22cef78e
7852-268D-3BF9        SUCCESS

  3. Destroy the CodeSafe machine:

    csadmin destroy --esn 7852-268D-3BF9 --uuid 607fc44d-953b-4b83-8c2b-945a22cef78e
7852-268D-3BF9        SUCCESS

  4. Verify that it is not listed:

    csadmin list
7852-268D-3BF9        No SEE machines currently installed

  5. Run pipsqueak.
    You should get a connection error.

    ./pipsqueak
2026-02-18T11:19:56 dispatch__socket_connect[dispatch.c:172] OSErrorErrno(57): connecting to XXX.XXX.XXX.XXX on port 8888: Connection refused
PQSDK: 1.4.1 ()

  6. Clear the module and remove published objects. For more information, see Clear the module and remove published objects.

Uninstall the PQCOP CodeSafe machine from the nShield XC

  1. Run pipsqueak:

    ./pipsqueak
PQSDK: 1.4.1 (5F08-02E0-D947: 1.4.1)

  2. Remove the CodeSafe machine:

    loadsee-setup -r -m 1
    Example output 
    Module #1:
  Machine file:             /opt/nfast/kmdata/custom-seemachines/pqsdk-1.4.1.sar
  Encryption key:
  Signing key hash:
  Userdata file:            /opt/nfast/kmdata/custom-seemachines/userdata.sar
  WorldID published object: pqsdk
  Postload helper:
  Postload args:

Erase this configuration? (yes/no): yes
Module #1 SEE auto-loading configuration removed.
Reload new configuration now? (yes/no): yes
Clear modules before reloading new configuration? (yes/no): yes
Modules cleared for new configuration.
Check the hardserver log to ensure the SEE machine was loaded correctly after clearing.

  3. Clear the module and remove published objects. For more information, see Clear the module and remove published objects.

Clear the module and remove published objects

  1. Clear the module:

    nopclearfail -c -m 1
Module 1, command ClearUnit: OK

  2. Remove published objects using the removepubobj.py script, available from Entrust Support:

    • Linux

      /opt/nfast/python3/bin/python3 ./removepubobj.py -m 1 -p pqsdk

    • Windows

      c:\> & 'C:\Program Files\nCipher\nfast\python3\python3.exe' ./removepubobj.py -m 1 -p pqsdk
    Entrust Support provides the script separately from the release.

  3. Run pipsqueak again.
    No HSMs should appear in the output.

    ./pipsqueak
PQSDK: 1.4.1 ()