Skip to main content

Introduction

This document describes the integration of Microsoft Azure Key Vault Bring Your Own Key (referred to as Azure BYOK in this guide) with the Entrust KeyControl Key Management Solution (KMS).

Documents to read first

This guide describes how to configure the Entrust KeyControl server as a KMS in Azure BYOK.

Note
 Entrust KeyControl v10.1 supports BYOK as an add-on. You can request a free trial of Entrust KeyControl BYOK here: https://go.entrust.com/keycontrol-byok-30-day-free-trial.

To install and configure the Entrust KeyControl server see KeyControl Installation and Upgrade Guide.

Also refer to the documentation and set-up process for Microsoft Azure BYOK in the Microsoft Azure Key Vault online documentation.

Product configurations

Entrust has successfully tested the integration of KeyControl with Azure BYOK in the following configurations:

System Version

Entrust KeyControl

10.1

Features tested

Entrust has successfully tested the following features:

Feature Tested

Create cloud key

✓

Rotate cloud key

✓

Remove cloud key

✓

Upload removed cloud key

✓

Delete cloud key

✓

Cancel cloud key deletion

✓

Requirements

Entrust recommends that you allow only unprivileged connections unless you are performing administrative tasks.

Install and configure Entrust KeyControl

Deploy an Entrust KeyControl cluster

For this integration, Entrust KeyControl was deployed as a two-node cluster on premises. The installation software was downloaded in the form of an OVA file, deployed in VMware ESXi.

Follow the installation and set-up instructions in KeyControl Installation and Upgrade Guide. If using an HSM, the integration guide with the Entrust nshield HSM is available at https://www.entrust.com/documentation. Search for the key phrase KeyControl nshield HSM.

Create an Entrust KeyControl Management Vault

To create an Entrust KeyControl Management Vault:

  1. Sign in to the Entrust KeyControl Vault Server Appliance Manager.

  2. In the home page, select the user’s drop-down menu and select Vault Management.

    create keycontrol vault 1

  3. Select Create Vault.

    The Create Vault dialog appears.

  4. In the Type drop-down box, select Cloud Key Management. Enter the required information.

  5. Select Create Vault.

    For example:

    create keycontrol vault 2

  6. You will receive an email with a URL and login credentials to the Entrust KeyControl vault. Bookmark the URL and save the credentials.

    For example:

    create keycontrol vault 3

  7. Sign in to the above URL. Change the one-time password when prompted.

Configure Microsoft Azure

Create an app registration in Azure

The app registration provides trust between your app and Azure.

  1. Open a browser and sign in to the Azure portal https://portal.azure.com/#home.

  2. Navigate to Home > Azure Active Directory > App registrations.

  3. Select New registration.

    The Register an application dialog.

  4. Enter the Name, a user-facing or friendly name. Select the applicable Supported account types and enter a Redirect URI.

    For example:

    create azure app registration

  5. Select Register.

    The newly created registration appears.

    created azure app registration

  6. Select API permissions. Alternatively, select Home > Azure Active Directory > App Registrations > <Display name> > API permissions.

  7. Select Add a permission and add the following permissions:

    Microsoft API Permission

    Microsoft Graph

    Application.ReadWrite.All, User.Read (granted by default)

    Azure Key Vault

    user_impersonation

    Azure Service Management

    user_impersonation

    For example:

    azure keyvault permission

For additional information, see Creating a Service Principal.

Add the app to the subscription Reader Role list

Note
 The Owner permission of the subscription is required to perform this operation.

  1. Navigate to Home > Subscriptions.

  2. Select your subscription.

  3. Select Access control (IAM).

  4. Select Add and then select Add role assignment from the pull-down menu.

    subscription reader role 1

  5. In the Add role assignment dialog, select the Reader role and then select the Members tab.

    subscription reader role 2

  6. Select Select members, search for the app Display name, and select it.

  7. Select Save.

    subscription reader role 3

    The new subscription Reader role is added.

    subscription reader role 4

Create an Azure key vault

An existing Azure key vault with Permission model equals Vault access policy can be used for this integration. A new Azure key vault was created in this integration to show the entire process.

For an existing Azure key vault, proceed to section Add the app registration to the key vault access policies directly, skipping this section entirely.

  1. Open a browser and sign in to the Azure portal https://portal.azure.com/#home.

  2. In the home page, select the Create a resource icon.

  3. Select Key Vault.

    The Create a key vault dialog appears.

  4. In the Basics tab select the Subscription and Resource group from the pull-down menu. Enter the instance details.

  5. Select Next.

    For example:

    create azure keyvault 1

  6. In the Access configuration tab, select the Permission model, Resource access, and Access policies.

  7. If you are using Vault access policy for the Permission model:

    1. Select the user.

    2. Select Edit and select all permissions that apply.

    3. Select Save and Next.

    All Key Permissions, Secrets Permissions, and Certificate Permissions were selected for the purpose of this integration.

    create azure keyvault 2

  8. In the Networking tab, select Enable public access.

  9. Under Public access, select All networks.

  10. Select Next.

    create azure keyvault 3
    create azure keyvault 4

  11. In the Tags tab enter the required Name and Value. These were left blank for the purpose of this integration.

  12. Select Next.

  13. Review the information and select Create.

    create azure keyvault 5

  14. A deployment page appears. The newly created Azure vault is included.

    create azure keyvault 6

Add the app registration to the key vault access policies

These steps configure the key vault policies to allow access by the app.

  1. Navigate to Home > Key vault > <Key_vault_name> > Access policies.

  2. Select Create.

    The Create and access policy dialog appears.

  3. In the Permissions tab select the following Key permissions.

    Key permissions Selection

    Key Management Operations

    All

    Privileged Key Operations

    All

    Rotation Policy Operations

    All

  4. Select Next.

  5. In the Principal tab, enter the Display name of the app. After the app is found, select the app.

  6. Select Next.

    For example:

    add app reg to vault access policy 1

  7. Select Next in the Application (optional) tab.

  8. Review the information and select Create.

    For example:

    add app reg to vault access policy 2

  9. The Access policies page appears. The new vault access policy is included.

    add app reg to vault access policy 3

For additional information, see Set Permissions for the BYOK Service by Configuring Each Azure Key Vault.

Configure Entrust KeyControl as Microsoft Azure CSP

Create an Azure client secret

This secret is required to create the Entrust CSP account for Azure. It expires after a set period. You must create the Entrust KeyControl CSP account for Azure before the secret expiration date.

  1. Navigate to Home > Azure Active Directory > App registrations > <App-registration-name> > Certificates & secrets.

  2. Select New client secret.

    The Add a client secret dialog appears.

  3. Enter the Description and select the expiration date.

  4. Select Add.

    The Certificates & secrets page appears. For example:

    azure client secret

  5. Copy and save the Value of the new client secret.

    Note
    		 This value appears in Azure Portal only temporarily. When the portal hides the client secret, it cannot be retrieved and a new secret must be created.

For additional information, see Creating a client secret in Azure Active Directory.

Create an Entrust KeyControl CSP account for Azure

The following steps establish the connection between Entrust KeyControl and Azure, making Entrust KeyControl the CSP of the Azure application.

  1. Sign in to the Entrust KeyControl Vault URL bookmark from Create an Entrust KeyControl Management Vault.

  2. Select the CLOUDKEYS icon on the toolbar.

  3. Select the CSP Accounts tab.

  4. In the Action icon, select Add CSP Account in the drop-down menu.

    The Add CSP Account dialog appears.

  5. In the Details tab enter the Name and Description.

  6. In the Admin Group drop-down menu box select Cloud Admin Group.

  7. In the Type drop-down menu box select Azure.

  8. Enter the following from the Azure account:

    Item Value

    Azure AD Tenant ID

    Home > Azure Active Directory > App registrations > <Display name> > Directory (tenant) ID

    Subscription ID

    Home > Subscription > Subscription ID

    Client ID

    Home > Azure Active Directory > App registrations > <Display name> > Application (client) ID

    Client Secret

    Value of the secret created in Create an Azure client secret.

    For example:

    keycontrol csp account for azure 1

  9. Select Continue.

  10. In the Schedule tab, define the rotation schedule.

  11. Select Apply.

    For example:

    keycontrol csp account for azure 2

    The new CSP account is created.

    keycontrol csp account for azure 3

Test integration

Create a key set in Entrust KeyControl

This key set will be used to create a cloud key in Entrust KeyControl.

  1. Sign in to the Entrust KeyControl Vault URL bookmark from Create an Entrust KeyControl Management Vault.

  2. Select the CLOUDKEYS icon on the toolbar.

  3. Select the Key Sets tab.

  4. Select Actions > Create Key Set.

    The Choose the type of keys…​ dialog appears.

  5. Choose Azure Key.

    The Create Key Set dialog appears.

  6. In the Details tab enter a Name and Description.

  7. In the Admin Group menu select Cloud Admin Group.

    For example:

    keycontrol create key set 1

  8. Select Continue.

  9. In the CSP Account tab, select the CSP account created in Create an Entrust KeyControl CSP account for Azure.

    For example:

    keycontrol create key set 2

  10. Select Continue.

  11. In the HSM tab, select Enable HSM if using one. In that case ensure the HSM is configured prior to this step.

    For example:

    keycontrol create key set 3

  12. Select Continue.

  13. In the Schedule tab, select a Rotation Schedule matching the selection made during Create an Azure client secret. For example:

    keycontrol create key set 4

  14. Select Apply.

    The key set is added. For example:

    keycontrol create key set 5

  15. Verify the Azure key vault created in Create an Azure key vault is listed in the Key Vault tab with setting Accessible set to Yes.

    For example:

    keycontrol create key set 6

For additional information, see Creating a Key Set.

Create a cloud key in Entrust KeyControl

The following steps create a cloud key in Entrust KeyControl and verify it is available in Azure key vault.

  1. Sign in to the Entrust KeyControl Vault URL bookmark from Create an Entrust KeyControl Management Vault.

  2. Select the CLOUDKEYS icon on the toolbar.

  3. Select the CloudKeys tab.

  4. In the Key Set menu, select the Key Set created in Create a key set in Entrust KeyControl.

  5. In the Type menu, select Key Vault.

    For example:

    keycontrol create cloudkey 1

  6. Select Actions > Create CloudKey.

    The Create CloudKey dialog appears.

  7. In the Key Vault menu, select the Azure key vault created in Create an Azure key vault.

  8. In the Details tab, enter the Name and Description. For example:

    keycontrol create cloudkey 2

  9. Select Continue.

  10. In the Access tab, select the required Cipher.

    For example:

    keycontrol create cloudkey 3

  11. Select Continue.

  12. In the Schedule tab, select the Rotation Schedule, Activation Date, and Expiration.

    For example:

    keycontrol create cloudkey 4

  13. Select Apply.

    The cloud key is created.

    keycontrol create cloudkey 5

  14. Verify the cloud key created in Entrust KeyControl is available in Azure key vault.

    keycontrol create cloudkey 6

For additional information, see Creating a CloudKey.

Create a cloud key in Azure key vault

The following steps create a cloud key in Azure key vault and import it into Entrust KeyControl.

To create a cloud key in Azure Key Vault:

  1. Navigate to Home > Key vaults > <Key_vault_name> > Keys > Generate/Import.

    The Create a key dialog appears.

  2. Enter the Name and the required key properties.

    For example:

    azure create cloudkey 1

  3. Select Create.

    The cloud key is created.

  4. Verify the newly created key.

    For example:

    azure create cloudkey 2

To import the cloud key created in Azure into Entrust KeyControl:

  1. Sign in to the Entrust KeyControl Vault URL bookmark from Create an Entrust KeyControl Management Vault.

  2. Select the CLOUDKEYS icon on the toolbar.

  3. Select the Key Sets tab.

  4. Select the key set created in Create a key set in Entrust KeyControl.

  5. Select Actions > Import CloudKey.

    The Import Cloud Keys dialog appears.

  6. In the Type menu, select Key Vault.

  7. In the Key Vault menu, select the Azure key vault created in Create an Azure key vault.

    For example:

    azure create cloudkey 3

  8. Select Import.

  9. Verify the cloud key created in Azure key vault is available in Entrust KeyControl.

    azure create cloudkey 4

Rotate a cloud key in Entrust KeyControl

To rotate a cloud key in Entrust KeyControl:

  1. Sign in to the Entrust KeyControl Vault URL bookmark from Create an Entrust KeyControl Management Vault.

  2. Select the CLOUDKEYS icon on the toolbar.

  3. Select the CloudKeys tab.

  4. Select the key to rotate. Then, scroll down until you see the Rotate Now control.

  5. Select Rotate Now.

    The key has been rotated.

    For example:

    keycontrol key rotation 1
    keycontrol key rotation 2

  6. In Azure, navigate to Home > Key vaults > <Key_vault_name> > Keys.

  7. Select the key you want to rotate.

  8. Verify that the key has been rotated.

    For example:

    keycontrol key rotation 3

Remove a cloud key in Entrust KeyControl

A removed cloud key in Entrust KeyControl will no longer be available for use in Azure. However, Entrust KeyControl will keep a copy of the removed cloud key, which could be reloaded to Azure for use.

  1. Sign in to the Entrust KeyControl Vault URL bookmark from Create an Entrust KeyControl Management Vault.

  2. Select the CLOUDKEYS icon on the toolbar.

  3. Select the CloudKeys tab.

  4. Select the key to the removed.

  5. Select Actions > Remove from Cloud.

    The Remove from Cloud dialog appears.

  6. Type the name of the cloud key in Type CloudKey Name.

    For example:

    keycontrol remove cloudkey 1

  7. Select Remove.

  8. Verify the status change in Entrust KeyControl.

    For example:

    keycontrol remove cloudkey 2

  9. Verify the key is gone from Azure.

    For example:

    keycontrol remove cloudkey 3

For additional information, see Removing a CloudKey from the Cloud.

Upload a removed cloud key to Azure in Entrust KeyControl

To upload a removed cloud key to Azure in Entrust KeyControl:

  1. Sign in to the Entrust KeyControl Vault URL bookmark from Create an Entrust KeyControl Management Vault.

  2. Select the CLOUDKEYS icon on the toolbar.

  3. Select the CloudKeys tab.

  4. Select the key to be uploaded.

  5. Select Actions > Upload to Cloud.

    The Remove from Cloud dialog appears. For example:

    keycontrol upload removed cloudkey 1

  6. Select Upload.

  7. Verify the status change in Entrust KeyControl. For example:

    keycontrol upload removed cloudkey 2

  8. Verify the key is now available in Azure. For example:

    keycontrol upload removed cloudkey 3

Delete a cloud key in Entrust KeyControl

The deletion of a cloud key does not take effect immediately. However, after a user defined interval, the key will be permanently removed.

  1. Sign in to the Entrust KeyControl Vault URL bookmark from Create an Entrust KeyControl Management Vault.

  2. Select the CLOUDKEYS icon on the toolbar.

  3. Select the CloudKeys tab.

  4. Select the key to deleted.

  5. Select Actions > Delete CloudKey.

    The Delete CloudKey dialog appears.

  6. Select a time in Define when the CloudKey should be permanently deleted.

    For example:

    keycontrol delete cloudkey 1

  7. Select Delete.

  8. Verify the status change in Entrust KeyControl.

    For example:

    keycontrol delete cloudkey 2

  9. Verify the key is gone from Azure. For example:

    keycontrol delete cloudkey 3

For additional information, see Deleting a CloudKey.

Cancel a cloud key deletion in Entrust KeyControl

The deletion of a key can be canceled while the time in the Define when the CloudKey should be permanently deleted setting has not expired.

  1. Sign in to the Entrust KeyControl Vault URL bookmark from Create an Entrust KeyControl Management Vault.

  2. Select the CLOUDKEYS icon on the toolbar.

  3. Select the CloudKeys tab.

  4. Select the key deletion to be canceled.

  5. Select Actions > Cancel Deletion.

    The Cancel Deletion dialog appears.

    For example:

    keycontrol cancel deletion cloudkey 1

  6. Select Yes, Cancel Deletion.

  7. Verify the status change in Entrust KeyControl.

    For example:

    keycontrol cancel deletion cloudkey 2

  8. Verify the key is now available in Azure. For example:

    keycontrol cancel deletion cloudkey 3

For additional information, see Canceling a CloudKey Deletion.

RESOURCES
RELATED PRODUCTS