Scheduling Operations

CCKM allows you to periodically refresh or rotate keys in the background. To refresh or rotate keys, you need to create schedule configuration. A schedule configuration defines when to run a refresh or rotation job. You can use either basic format or cron format to specify the time when the rotation or refresh job will run.

Specify basic format in the following order:

[Repeats, at]

Where,

• Repeats: frequency of the scheduler. Possible values are daily, weekly, monthly, and yearly.

• at: specific time at which the rotation or refresh operation will be performed. Possible value lies between 12:00-11:00 AM/PM UTC.

Specify cron format in the following order:

"* * * * *"

These five values indicate when the job should be executed. These values are mandatory and must be specified in order of minute, hour, day of month, month, and day of week.

The following table lists the accepted values:

Adding Key Rotation Schedule

A key rotation schedule replaces selected keys with new cryptographic keys at the specified time.

To add key rotation schedule:

1. Open the Cloud Key Manager application.

2. In the left pane, click Schedules. The list of available schedules is displayed.

3. Click Add Schedule. The Add New Schedule wizard is displayed.

4. Select Schedule Type as Key Rotation.

5. Click Next.

6. On the General Info screen, enter or select following details:

   • Enter a unique Scheduler Name.

   • Select Salesforce from the Cloud Name drop-down list.

   • Add Description for the scheduler in a maximum of 250 characters.

   • Select Enable Schedule to enable the schedule.

   • Click Next.

7. Set the values on the Schedule Config screen.

   You can schedule configuration for:

   • All Keys: Refer to Configuring Rotation Schedule for All Keys for details.

   • Only Expiring Keys: Refer to Configuring Rotation Schedule for Expiring Keys for details.

Scheduling Configuration for All Keys

To configure rotation schedule for all keys:

1. Configure DURATION for the scheduler. Specify the schedule start and end time:

   • Schedule Starts: Specify time when the schedule starts.

   • Schedule Ends: Unavailable by default, that is, the scheduler never expires.

   • Never: Selected by default, that is, the scheduler configuration never expires.

   To set an end time for the scheduler, clear the Never check box, and specify the Scheduler Ends time.

2. Configure FREQUENCY of the scheduler. The frequency determines how often the scheduler will rotate keys. Select either Basic or Raw (Cron) format to specify the value.

3. Under the OPTIONAL section, set the expiry of the newly rotated key. The new key will expire automatically after this duration.

4. Configure KEY SOURCE. Select from the Key Source drop-down list. The options are Native, DSM, CipherTrust (Local), and CipherTrust (External). This will be the source of the new key material.

   • If the key source is DSM, you need to specify the DSM domain where the key will be created, the optional certificate whose public key will be used to encrypt the key, and whether to use key derivation.

   • If the key source is CipherTrust (Local) or CipherTrust (External), you can specify the optional certificate whose public key will be used to encrypt the key and whether to use key derivation.

5. (Only for DSM and CipherTrust (External) key source) Select Domain where the key will be created to upload to Salesforce.

6. Select ORGANIZATION to which the key belongs. Select from the Organization drop-down list.

7. (Optional, only for DSM, CipherTrust (Local) and CipherTrust (External) key sources) Select the Certificate whose public key is to be used to encrypt the key.

8. Configure KEY TYPE. Select the types of the key to be rotated. The options are Data, Event Bus, Search Index, Deterministic Data, and Analytics.

9. (Optional) Select the Use Key Derivation check box. This field is not applicable to the Native key source.

10. Click Save.

A message Schedule successfully created is displayed on the screen.

Configuring Rotation Schedule for Expiring Keys

To configure rotation schedule for expiring keys:

1. In the SELECTION section, select the keys to be rotated based on their expiry time. In the Only rotate keys within _ of material expiration field, select or enter the key expiry time. Material expiration can be specified in Hours, Days, Weeks, Months, and Years. For example, if the value of Only rotate keys within _ of material expiration field is set to 4 Days, then the rotation schedule is created for all the keys that will expire in 4 Days.

2. Configure DURATION for the scheduler. Specify the schedule start and end time:

   • Schedule Starts: Specify time when the schedule starts.

   • Schedule Ends: Unavailable by default, that is, the scheduler never expires.

   • Never: Selected by default, that is, the scheduler configuration never expires.

   To set an end time for the scheduler, clear the Never check box, and specify the Scheduler Ends time.

3. Under the OPTIONAL section, set the expiry of the newly rotated key. The new key will expire automatically after this duration.

4. Configure KEY SOURCE. Select from the Key Source drop-down list. The options are Native, DSM, CipherTrust (Local), CipherTrust (External). This will be the source of the new key material.

   • If the key source is DSM, you need to specify the DSM domain where the key will be created, the optional certificate whose public key will be used to encrypt the key, and whether to use key derivation.

   • If the key source is CipherTrust (Local) or CipherTrust (External), you can specify the optional certificate whose public key will be used to encrypt the key and whether to use key derivation.

5. (Only for DSM and CipherTrust (External) key sources) Select Domain where the key will be created to upload to Salesforce.

6. Select ORGANIZATION to which the key belongs. Select from the Organization drop-down list.

7. (Optional, only for DSM, CipherTrust (Local) and CipherTrust (External) key sources) Select the Certificate whose public key is to be used to encrypt the key.

8. Configure KEY TYPE. Select the types of the key to be rotated. The options are Data, Event Bus, Search Index, Deterministic Data, and Analytics.

9. (Optional) Select the Use Key Derivation check box. This field is not applicable to the Native key source.

10. Click Save.

A message Schedule successfully created is displayed on the screen.

Adding Key Refresh Schedule

A key refresh schedule synchronizes keys from linked Salesforce cloud organizations to CCKM.

To add a key refresh schedule:

1. Open the Cloud Key Manager application.

2. In the left pane, click Schedules. The list of available schedules is displayed.

3. Click Add Schedule. The Add New Schedule wizard is displayed.

4. Select Schedule Type as Key Refresh.

5. Click Next.

6. On the General Info screen, enter or select following details:

   • Enter a unique Scheduler Name.

   • Select Salesforce from the Cloud Name drop-down list.

   • Add Description for the scheduler in a maximum of 250 characters.

   • Select Enable Schedule to enable the schedule.

   • Click Next.

7. On the Schedule Config screen, enter or select the following details.

   1. Configure DURATION for the scheduler. Specify the schedule start and end time:

      • Schedule Starts: Specify time when the schedule starts.

      • Schedule Ends: Unavailable by default, that is, the scheduler never expires.

      • Never: Selected by default, that is, the scheduler configuration never expires.

      To set an end time for the scheduler, clear the Never check box, and specify the Scheduler Ends time.

   2. Configure FREQUENCY of the scheduler. The frequency determines how often the scheduler will rotate keys. Select either Basic or Raw (Cron) format to specify the value.

   3. Click Next.

8. On the Add Organization screen:

   1. Select the desired organization from the Refresh Keys from Selected Organization(s) drop-down list.

   2. Click + button. Similarly, you can add more organizations. To remove an added organization, click the close (X) icon in the name of the added organization.

      Alternatively, if you want to refresh all the existing organizations, select the Refresh All Organizations check box. When selected, the Refresh Keys from Selected Organization(s) field becomes unavailable.

   3. Click Save.

A message Schedule successfully created is displayed on the screen. The newly created scheduled is displayed in the schedules list.

Viewing/Editing Schedules

To view/edit a schedule:

1. Open the Cloud Key Manager application.

2. In the left pane, click Schedules. The Schedules page displays following details:

   Field	Description
   Name	Unique name of the scheduler configuration.
   Schedule Type	Type of the schedule. Possible types are: • Key Rotation • Key Refresh
   Cloud Name	Name of the cloud.
   Last Modified	Time when the schedule is modified.
   Frequency	Frequency of the scheduler configuration.
   Start Date	Creation time of the scheduler configuration.
   End Date	Expiry time of the scheduler configuration. Never is displayed if the schedule is set to never expire.
   Status	Status of the scheduler configuration. Possible values are: • Enabled • Disabled

3. Click the overflow icon () corresponding to the desired schedule and click View/Edit.

   Alternatively, click the Name link corresponding to the desired schedule.

4. Edit or configure the following fields:

   • Optional, basic description of the schedule.

   • Status of the scheduler configuration. Select Enable Schedule to enable the schedule, clear to disable.

   • Scheduler configuration parameters such as duration, frequency, and expiry time of the key. Refer to the key rotation Schedule Config screen or key refresh Schedule Config screen, as appropriate for details.

   • (For key refresh schedules only) Organizations whose keys you want to refresh. If you want to refresh all the existing organizations, select the Refresh All Organizations check box. When selected, the Refresh Keys from Selected Organization(s) field becomes unavailable.

5. Click Update to save the changes.

The Schedules page also contains a section named JOB HISTORY. This section displays information related to a schedule such as Run Date, Job ID, Status, and Errors.

Disabling Schedules

To disable a schedule configuration:

1. Open the Cloud Key Manager application.

2. In the left pane, click Schedules. The list of available schedules is displayed.

3. Click the overflow icon () corresponding to the desired schedule and click Disable. The Disable Schedule message is displayed.

4. Click Disable Schedule.

A message Successfully disabled the schedule is displayed on the screen.

Enabling Schedules

To enable a schedule configuration:

1. Open the Cloud Key Manager application.

2. In the left pane, click Schedules. The list of available schedules is displayed.

3. Click the overflow icon () corresponding to the desired schedule and click Enable. The Enable Schedule message is displayed.

4. Click Enable Schedule.

A message Successfully enabled the schedule is displayed on the screen.

Manually Running Schedules

To manually run a schedule:

1. Open the Cloud Key Manager application.

2. In the left pane, click Schedules. The list of available schedules is displayed.

3. Click the overflow icon () corresponding to the desired schedule and click Run Now.

The Run Now schedule is started in the background. A message Schedule is running now. It will take a few seconds to finish. is displayed on the screen. After the schedule is run successfully, a message Successfully finished running the schedule is displayed.

Deleting Schedules

1. Open the Cloud Key Manager application.

2. In the left pane, click Schedules. The list of available schedules is displayed.

3. Click the overflow icon () corresponding to the desired schedule and click Delete Schedule. The Delete Schedule message is displayed.

4. Click Delete.

A message Successfully deleted schedule is displayed on the screen.