Prerequisites

Common Prerequisites

Before you can perform client side encryption:

1. Make sure you have a stable release of Google Chrome or Microsoft Edge installed and running.

2. Make sure your access to KACLS is not blocked by web filters, for example, Zscaler.

3. Make sure you have the CCKM Admins rights to perform Google Workspace CSE operations on the CipherTrust Manager.

4. Make sure that an identity provider system is set up correctly. For this, the identity provider admin uses either of following methods:

   Using .well-known File Configuration

   1. Host the cse-configuration JSON file on a Web server. A sample JSON file looks like this:

      {
        "name": "CSE IDP",
        "client_id": "<authenticationAud>",
        "discovery_uri": "<openidConfigurationURL>",
        "audience": "cse-test"
      }
      

      Here,

      • <authenticationAud> is the ID of the third-party identity provider. For example, for Auth0, it is represented by the Client ID.

      • <openidConfigurationURL> is the identity provider configuration URL. For example, for Auth0, it can be https://demo.auth0.com/.well-known/openid-configuration.

   2. Create a sub-domain on the Google domain portal for the hosted Web server. Navigate to the Google domain > DNS > Customer resource records and add the IP address of the Web server with the name cse.

   Using IdP Fallback Settings

   1. On the Google Admin Console, set identity provider configuration.

   2. Specify the following fields:

      • Name: Name for the identity provider.

      • Client ID: The ID of the third-party identity provider. For example, for Auth0 and STA, it is represented by the Client ID.

      • Discovery URI: The identity provider configuration URL. For example, for Auth0, it can be https://demo.auth0.com/.well-known/openid-configuration, and for STA, it is represented by WELL KNOWN CONFIGURATION URL.

      • Grant type: Set as Implicit.

   3. Test and save the settings.

5. (Applicable when a valid public DNS for the CipherTrust Manager is unavailable.) Create a subdomain for Thales key service (KACLS) on Google domain. Refer to Creating a Subdomain on Google Domain.

6. Create a URL to access the KACLS. This URL is referred to as KACLS Endpoint URL in this document. Refer to Creating a KACLS Endpoint URL below.

7. Configure Google Workspace connection to KACLS. Refer to Configure Google Workspace Connection to KACLS for details.

Creating a Subdomain on Google Domain

1. Log on to Google domain as a super admin for the user domain.

2. Navigate to DNS > Custom resource records.

3. Create a subdomain for the KACLS. Specify a name for your subdomain and the IP address or hostname of the KACLS.

Creating a KACLS Endpoint URL

A KACLS URL is needed to access the Thales key service. Google Workspace administrators use this URL to configure Google Workspace to communicate with the KACLS. Creating a KACLS URL requires an identity provider and a KACLS endpoint.

To create a KACLS endpoint URL:

1. Create an identity provider.

   • GUI: Refer to Creating Identity Providers.

   • API: Refer to Creating Identity Providers.

2. Create a KACLS endpoint.

   • GUI: Refer to Creating KACLS Endpoints.

   • API: Refer to Creating KACLS Endpoints.

Configure Google Workspace Connection to KACLS

To configure the Google Workspace connection to KACLS:

1. Open the Google Admin console, http://admin.google.com.

2. Log on to the user domain as a super admin.

3. Navigate to CSE settings: Security > Client Side Encryption.

   

4. Click Add external key service.

5. Specify Name of external key service. This name will appear in error messages if Google Workspace cannot contact the key service.

6. Enter URL of external key service. This URL was created in Creating a KACLS Endpoint URL.

   

7. Click TEST CONNECTION to test that Google Workspace can communicate with the KACLS.

   If the connection fails, correct the KACLS endpoint URL, ensure the Internet connectivity, and retry.

8. Click CONTINUE.

9. Click SAVE. The Google Workspace connection to KACLS is configured.

Additional Prerequisites for Gmail

Apart from the prerequisites described above, perform these additional steps for Gmail:

1. Create a test environment and enroll it with Google.

2. Enable Google Workspace CSE for intended Gmail users (senders and recipients).

   1. Open the Google Admin console, http://admin.google.com.

   2. Log on to the user domain as a super admin.

   3. Navigate to CSE settings: Data > Compliance > Client-Side Encryption.

      

   4. Scroll down to the Apps section and click the Gmail link.

   5. Select an organizational unit or group for which you want to enable Gmail CSE.

   6. Under User access, select ON.

   7. Save the settings.

3. Prepare your certificates.

   1. Generate S/MIME certificates. Adhere to the Google-specified certificate chain rules.

   2. Wrap associated private keys using your KACLS endpoint URLs. Refer to Encrypting Private Keys (wrapprivatekey) for details.

   3. Upload the wrapped private keys and certificates to Google.

      1. Using Google Workspace Admin Console: Use this method if you want Google to trust your own root CA.

         1. Open the Google Admin console, http://admin.google.com.

         2. Log on to the user domain as a super admin.

         3. Navigate to CSE settings: Apps > Google Workspace > Gmail.

         4. On the right, click User settings.

         5. Click S/MIME and select Enable S/MIME encryption for sending and receiving emails and Allow users to upload their own certificates.

         6. Click ADD to upload the root certificate. This root CA is the chain of intermediate and root certificates.

         7. Save the changes.

      2. Using Gmail API client libraries: Use this method to upload each user's S/MIME certificates and wrapped private keys using the API client libraries provided by Google.

Additional Prerequisites for Key Migration

Browser Requirement

The latest stable version of Google Chrome is installed and running.

Configure External Key Management (EKM) Service

To configure the external key management service.

1. Create a sub-domain for KACLS in the Google domain. Refer to Creating a subdomain on Google domain for details.

2. Create a KACLS Endpoint URL, refer to Creating a KACLS Endpoint URL.

Configure Migration on KACLS

Using the API, you need to update the rewrap and privilegedUnwrap configurations on the following.

1. Old KACL

2. New KACL

Refer to the Update a Rewrap Configuration and Update a Privileged Unwrap Configuration APIs.

Configure Google Workspace Connection to KACLS

Refer to Configure Google Workspace Connection to KACLS for details.