Use an Azure keyset when CSP Vault for Cloud Keys connects to Azure Managed HSM. With an Azure keyset, the CSP Vault for Cloud Keys can synchronize the External Key Manager (EKM) root CA certificate. When you create an EKM key, the CSP Vault for Cloud Keys creates the corresponding key reference in Azure Managed HSM. Complete the following procedures to configure an Azure keyset with Azure Managed HSM EKM:


Prerequisites

Before you begin, make sure you have completed the following tasks:

  • Obtain the common name and the EKM root CA certificate of the CSP deployment from your appliance administrator. 

  • For Azure keysets, grant the following roles to the service principal used to connect to Azure through the Managed HSM Local RBAC configuration window:

    • Managed HSM EKM Administrator (required in addition to the existing roles below)

    • Managed HSM Crypto User

    • Managed HSM Crypto Officer


To sync EKM Root CA Certificate

Sync the EKM Root CA certificate to enable mTLS between Azure Managed HSM and the CSP Vault for Cloud Keys.

  1. Log in to the Cryptographic Security Platform Vault for Cloud Keys webGUI using an account with Cloud Admin privileges.
  2. From the menu at the top, select CLOUDKEYS.
  3. Select the Key Sets tab.
  4. Select the keyset based on your requirements.
  5. Select the Managed HSM tab.
  6. Select the managed HSM based on your requirements.
  7. From the Actions drop-down list, select Sync EKM Root CA cert. A success message appears, prompting you to restart the webserver for the changes to take effect.
  8. Go back to the Key Sets tab.
  9. From the Actions drop-down list, select Restart Webserver. The following Restart Webserver window appears.

  10. Click Restart. A success message appears.

    This enables mutual Transport Layer Security (mTLS) between Azure Managed HSM and the CSP Vault for Cloud Keys.

To configure Azure Managed HSM for an Azure keyset

Provide the following information when configuring Azure Managed HSM:

  • Keyset EKM path prefix: This value combines the publicly routable address of the CSP cluster with the MHSM EKM Path Prefix value from the keyset object. For example: https://<fqdn-of-csp>/azureekm/<unique-guid>.

    To obtain the the EKM Path Prefix of the Azure keyset, complete the following steps:

    a. From the Key Sets Actions drop-down menu, select the required Azure keyset.

    b. Select the Details tab. Details of the Azure keyset appear.

    c. Scroll to the EKM Path Prefix field.

  • Common name of the CSP cluster
  • Root issuing CA certificate for the CSP cluster's external webserver certificate.

For information about configuring Azure Managed HSM, see the Microsoft Azure documentation.

To create an EKM key for an Azure keyset

Create an EKM key for an Azure keyset to provide the key encryption key (KEK) that Azure Managed HSM uses to protect data encryption keys (DEKs). 

  1. Log in to the Cryptographic Security Platform Vault for Cloud Keys webGUI using an account with Cloud Admin privileges.
  2. From the menu at the top, select CLOUDKEYS.
  3. Select the CloudKeys tab.
  4. From the Key Set drop-down list, select the required key set.
  5. From the Type drop-down list, select Managed HSM.
  6. From the Actions drop-down list, select Create CloudKey. The Create CloudKey window appears.
  7. Under Details, complete the following actions:
    1. Select EKM Key.
    2. From the Managed HSM drop-down list, select the required Managed HSM.
    3. In the Name field, enter a name for the CloudKey.
    4. Click Continue. The Settings section of the Create CloudKey window appears.
  8. From the Cipher drop-down list, select one of the following options:
    • AES-256
    • RSA-2048
    • RSA-3072
    • RSA-4096

      You cannot select the operations allowed for an EKM key. Azure Managed HSM EKM supports only wrapKey and unwrapKey, and both operations are required.

  9. Click Continue. The Schedule section of the Create CloudKey window appears.
  10. Leave all settings unchanged and click Continue. The Alerts section of the Create CloudKey window appears.
  11. Click Apply. A success message appears, confirming that the CloudKey was created. A corresponding key reference is created in Azure Managed HSM. The key reference does not contain key material. The key material remains in the CSP Vault for Cloud Keys.