Code Signing Private Key Protection Requirements for CloudHSM Providers

Effective June 1, 2023, the code signing certificate key pair must be generated and stored in a hardware crypto module that meets or exceeds the requirements of FIPS 140-2 level 2 or Common Criteria EAL 4+. This means the key pair will be generated in a device where the private key cannot be exported. 

If you are using a Cloud Key Storage solution such as Azure Key Vault or Amazon Key Management Service (KMS) as your provider, you will be impacted by the new compliance requirements. Following the June 1, 2023 deadline, if you have not completed Code Signing Verification, you will be blocked from issuing or renewing Code Signing certificates.

This article outlines the requirements for submitting the information about your cloud HSM setup to satisfy the verification requirements. 

Supported Vendors

• Microsoft Azure Key Vault (Premium SKU)

• Microsoft Azure Key Vault Managed HSM

• Amazon Key Management Service (KMS)

• AWS CloudHSM

Prerequisites

Azure Key Vault: Configure Policies

The following two Azure Policies must be assigned to demonstrate adequate protection of the private keys in your Azure environment. Both policies must be in a “Compliant” state. The instructions below will guide you to assign these three policies. 

Note: Azure Key Vault Standard SKU is not supported, as it is not compliant with the CA/Browser forum requirements (keys can be created only in a Hardware Security Module, which is only available in the Premium tier).

• Confirm SKU (Pricing tier)
• Policy #1: Keys should be backed by a hardware security module (HSM)
• Policy #2: Resource logs in Key Vault should be enabled  

Confirm Sku (Pricing tier)

1. Log in to your Azure environment and open Key Vault.
2. Select the key vault that is being used to store the Code Signing keys (repeat this step if you have multiple key vaults to store the Code Signing keys).
3. Click the Overview tab and take a screenshot of the screen to confirm you have a “Premium” SKU. Provide this screenshot to Entrust. 

Assign policy #1 (Keys should be backed by a hardware security module (HSM))

1. Log in to your Azure environment and go to the Policy screen. Click Assign policy.


2. Click the ... (ellipses) menu for the policy definition.


3. Search for “Keys should be backed by a hardware security module (HSM)” and then click Add.


4. Click Review & Create, then click Create in the next step.


5. The following must be true for resource compliance:

• Resource Compliance state should be compliant
• At least one resource must be compliant
• No exceptions are permitted

Note: The policy check might take up to 48 hours to complete.

Assign policy #2 (Resource logs in Key Vault should be enabled)

1. Go to the Policy screen and click Assign policy.


2. Click the ... (ellipses) menu for the policy definition.


3. Search for Resource logs in Key Vault should be enabled and then click Add.
4. Click Review & Create, then click Create in the next step.
5. The following must be true on the resource Compliance screen:

• Resource compliance state should be compliant
• At least one resource must be compliant
• No exceptions are permitted

Note: The policy check might take up to 48 hours to complete.

 Azure Key Vault Managed HSM: Configure Policy

The following Azure Policy must be assigned to demonstrate adequate protection of the private keys in your Azure environment. The policy must be in a “Compliant” state. The instructions below will guide you to assign these three policies.

• Confirm Azure Key Vault Managed HSM
• Policy: Resource logs in Azure Key Vault Managed HSM should be enabled

Confirm Azure Key Vault Managed HSM

1. Log in to your Azure environment and open Azure Key Vault Managed HSMs
2. Take a screenshot of the screen to confirm you have at least one HSM created. Provide this screenshot to Entrust. 

Assign policy: Resource logs in Azure Key Vault Managed HSM should be enabled

1. Log in to your Azure environment and go to Policy > Assign policy.


2. Click the ... (ellipses) menu for the policy definition.


3. Search for “Resource logs in Azure Key Vault Managed HSM should be enabled” and then click Add.


4. Click Review & Create, then click Create in the next step.


The following must be true for resource compliance:

• Resource Compliance state should be compliant
• At least one resource must be compliant
• No exceptions are permitted

Note: The policy check might take up to 48 hours to complete.


If you need help assigning these policies, please contact Microsoft Azure’s support team.