Securing Private Keys with nCipher HSM

[unxpectedReboot]

We have been trying for months, unsuccessfully, to complete our integration with the nCipher HSM (formerly Thales nShield) in order to protect the private keys for SSL Forward Proxy. The firewall is connected and authenticated to both the HSM and RFS, and we can see calls being made to the HSM in the mp-log cryptod.log file, but we are stuck on getting the private key protected by the HSM. 

After generating a certificate and key pair using the HSM and syncing to the RFS, the next step is to sync to the RFS from the firewall and import the certificate to the firewall while selecting "Private Key resides on HSM." However, after this step (and syncing again), we see an error icon indicating that while the key is configured to be on the HSM, it could not find it. This is also reflected in the cryptod file and the output from the below command showing hsm ssl cert not found: 86:

debug cryptod show counters

There have been some discussions as to whether it is required to first protect the master key with the HSM, but have found no documentation supporting this, and our environment would not appreciate having to update 100+ master keys. 

The documentation states Step 1) as "import or generate certificate and private key onto the HSM," with no further direction. We have been working this problem for months now, and would appreciate any help or guidance on the matter. Is there something simple we are missing, or some process we're not following correctly?

For reference: pa-5220 running 8.0.9

Thank you in advance!