If you are using bouncycastle to generate self-signed certificate using local keys in a PKCS#12 (or similar), the approach using the HSM is similar.

You have to call the HSM using NCryptoki (or JCryptoki if you are working in Java) to sign the HASH and add the signature in the X509 certificate that you are creating by bouncycastle

You can use NCryptoki to sign the hash that must be added in in the X.509 certificate but you cannot create an X.509 certificate by NCryptoki.

You should mix bouncycastle + NCryptoki to accomplish your task. 

You should NCryptoki to get the signed hash and, then, use bouncycastle to pack the signature in the x509 certificate.

this is a possible procedure:

Step 1:generate a PKCS#10 certificate request:

http://wiki.ncryptoki.com/How-to-generate-a-PKCS-10-certification-request-in-C.ashx

Step 2: Create a X509 Certificate by signing it with a temporary CA's key by coding something like that (I didn't test this code):

    /**
     * Generate an X509 certificate with Bouncy Castle.
     */
    X509Certificate generateX509Certificate(CertificationRequest pkcs10) {

        // yesterday
        Date validityBeginDate = new Date(System.currentTimeMillis() - 24 * 60 * 60 * 1000);
        // in 2 years
        Date validityEndDate = new Date(System.currentTimeMillis() + 2 * 365 * 24 * 60 * 60 * 1000);

        // GENERATE THE CA's PUBLIC/PRIVATE RSA KEY PAIR
        KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA", "BC");
        keyPairGenerator.initialize(1024, new SecureRandom());

        java.security.KeyPair keyPair = keyPairGenerator.generateKeyPair();

        // GENERATE THE X509 CERTIFICATE
        X509V1CertificateGenerator certGen = new X509V1CertificateGenerator();
        X500Principal dnName = new X500Principal("CN=John Doe");

        certGen.setSerialNumber(BigInteger.valueOf(System.currentTimeMillis()));
        certGen.setSubjectDN(dnName);
        certGen.setIssuerDN(dnName); // use the same
        certGen.setNotBefore(validityBeginDate);
        certGen.setNotAfter(validityEndDate);
        certGen.setPublicKey(pkcs10.getPublicKey());
        certGen.setSignatureAlgorithm("SHA256WithRSAEncryption");

        X509Certificate cert = certGen.generate(keyPair.getPrivate(), "BC");

        return cert

    }