0. Set-up the system as a HSM client.
1. Create a LDAP server instance CC-NonTMS-LDAP running at port 389.
2. CA configuration for installation with lunaSA is as follows:

    # cat ca_hsm.inf
    [DEFAULT]
    pki_instance_name=rhcs92-CA-aakkiang
    pki_https_port=28443
    pki_http_port=28080
    pki_hsm_enable=True
    pki_hsm_libfile=/usr/safenet/lunaclient/lib/libCryptoki2_64.so
    pki_hsm_modulename=<lunasa_module_name>
    pki_token_name=<lunasa_module_name>
    pki_token_password=<lunasa_password>
    pki_ssl_server_token=<lunasa_module_name>
    pki_subsystem_token=<lunasa_module_name>
    pki_audit_signing_token=<lunasa_module_name>
    [Tomcat]
    pki_ajp_port=28009
    pki_tomcat_server_port=28005
    [CA]
    pki_ca_signing_token=<lunasa_module_name>
    pki_ocsp_signing_token=<lunasa_module_name>
    pki_admin_email=caadmin@example.com
    pki_admin_name=caadmin
    pki_admin_nickname=caadmin
    pki_admin_password=Secret.123
    pki_admin_uid=caadmin
    pki_client_database_password=Secret.123
    pki_client_database_purge=False
    pki_client_pkcs12_password=Secret.123
    pki_ds_password=SECret.123
    pki_ds_secure_connection=False
    pki_ds_remove_data=True
    pki_ds_base_dn=dc=ca,dc=pki,dc=example,dc=com
    pki_ds_database=CC-NonTMS-LDAP
    pki_security_domain_name=EXAMPLE
    pki_security_domain_https_port=28443

3. # pkispawn -s CA -f ca_hsm.inf -vvv

Installation failed:

    com.netscape.certsrv.base.BadRequestException: Invalid Token provided. No such token.

Debug log has this:

    [25/Apr/2017:16:20:45][http-bio-28443-exec-4]: === Token Authentication ===
    [25/Apr/2017:16:20:45][http-bio-28443-exec-4]: Invalid Token provided. No such token.
    [25/Apr/2017:16:20:45][http-bio-28443-exec-4]: SignedAuditEventFactory:create()
    message created for eventType=ACCESS_SESSION_TERMINATED

Installation should be successful using both Thales and LunaSA HSMs.