Managing Azure Keys
This section describes how to manage Azure keys on CCKM. Before proceeding, you must have an Azure key vault added to the CCKM. Refer to Managing Azure Vaults for details.
Adding Azure Keys
CCKM provides two methods to add Azure keys:
Creating/Uploading New Key Material: Add key material by creating and uploading new source key or creating new native key.
Cloning Existing Key Material: Clone key material from an existing key to create a new key.
Creating/Uploading New Key Material
To add an Azure key by creating/uploading new key material:
Open the Cloud Key Manager application.
In the left pane, click Cloud Keys > Azure.
Click Add Key. The Select Material Origin screen of the Add Azure Key wizard is displayed.
Under Select Method, select Create/Upload New Key Material. The Select Source section appears. Depending on your requirements, select from the following sources:
Uploading CipherTrust (Local) Key Material
Upload the local key material using CipherTrust to configure source key.
Select Material Origin
Select CipherTrust (Local).
Click Next. The Configure Source Key screen is displayed.
Configure Source Key
Enter a Key Name.
Select the Key Size from the available options. The supported sizes are 2048, 3072, and 4096.
Click Next.
Configure Destination (Azure) Key
Enter a user-friendly alias as the Azure Key Name. This helps uniquely identify a key. By default, the Key Name specified on the previous screen is populated.
Select the desired Vault from the drop-down list.
Select the Key Type.
For a standard vault, the key type is RSA.
For a premium vault, the key type can be RSA or RSA HSM.
(Optional) Set the key activation and expiration dates.
Select the Set Activation Date check box and from the on-screen calendar, select the date and time to activate the key.
Select the Set Expiration Date check box and from the on-screen calendar, select the key expiration date and time.
(Optional) Select the Enable Key check box.
Select the Key Attributes. The supported attributes are:
Encrypt, Decrypt, Sign
Verify, Wrap Key, Unwrap Key
(Optional) Enter Tags. A tag is a label assigned to the key, which consists of a user-defined key and a value.
To add a tag:
Specify a tag name.
Specify the tag value.
Click the + button.
Similarly, you can add more tags.
Click Next. The Review and Add screen is displayed.
Review and Add
This screen shows the key details that you have provided. These details are divided into MATERIAL ORIGIN, SOURCE KEY, and DESTINATION KEY sections.
Before adding the key, review all details. After the key is added, certain features will no longer be editable.
Review the key details displayed on the screen.
If details are incorrect or you want to make any changes, click Edit next to the SOURCE KEY and DESTINATION KEY sections and update details. Alternatively, click Back and make changes, as appropriate.
Click Add Key.
The key creation starts. A Create Key In Progress message is displayed on the screen. Leave the window open until the process is completed.
When the status next to the SOURCE KEY and DESTINATION KEY sections becomes Complete and the Key ID links are displayed, the key is created successfully.
Click Close. The Add Azure Key wizard is closed.
The newly created key is displayed in the list of Azure keys. The origin of the key is CCKM.
Creating Microsoft Azure (Native) Key Material
Create the Azure key material directly using the native Microsoft Azure application.
Select Material Origin
Select Microsoft Azure (Native).
Click Next. The Configure Source Key screen is displayed.
Configure Source Key
Enter a user-friendly alias as the Azure Key Name. This helps uniquely identify a key.
Select the desired Vault from the drop-down list.
Select the Key Type.
For a standard vault, the key type can be RSA or Elliptic Curve.
For a premium vault, the key type can be Elliptic Curve, Elliptic Curve HSM, RSA, or RSA HSM.
(Applicable to RSA or RSA HSM key types) Select Size from the following options: 2048, 3072, and 4096.
(Applicable to Elliptic Curve or Elliptic Curve HSM key types) Select Curve from the following options: P-256, P-384, P-521, and SECP256K1.
(Optional) Set the key activation and expiration dates.
Select the Set Activation Date check box and from the on-screen calendar, select the date and time to activate the key.
Select the Set Expiration Date check box and from the on-screen calendar, select the key expiration date and time.
(Optional) Select the Enable Key check box.
Select the Key Attributes.
If the Key Type is RSA or RSA HSM, the supported attributes are:
Encrypt, Decrypt, Sign
Verify, Wrap Key, Unwrap Key
If the Key Type is Elliptic Curve or Elliptic Curve HSM, the supported attributes are:
Sign
Verify
(Optional) Enter Tags. A tag is a label assigned to the key, which consists of a user-defined key and a value.
To add a tag:
Specify a tag name.
Specify the tag value.
Click the + button.
Similarly, you can add more tags.
Click Next. The Review and Add screen is displayed.
Review and Add
This screen shows the key details that you have provided. These details are divided into MATERIAL ORIGIN and NATIVE KEY sections.
Before adding the key, review all details. After the key is added, certain features will no longer be editable.
Review the key details displayed on the screen.
If details are incorrect or you want to make any changes, click Edit next to the NATIVE KEY section and update details. Alternatively, click Back and make changes, as appropriate.
Click Add Key.
The key creation starts. A Create Key In Progress message is displayed on the screen. Leave the window open until the process is completed.
When the status next to the NATIVE KEY section becomes Complete and the Key ID link is displayed, the key is created successfully.
Click Close. The Add Azure Key wizard is closed.
The newly created key is displayed in the list of Azure keys. The origin of the key is Native.
Uploading Luna HSM Key Material
Upload the key material using Luna HSM to configure source key.
Select Material Origin
Select Luna HSM.
Click Next. The Configure Source Key screen is displayed.
Configure Source Key
Enter a Luna HSM Key Label.
Select the Partition ID of the desired Luna HSM.
Select the key Mechanism. The supported key mechanisms are:
CKM_RSA_FIPS_186_3_AUX_PRIME_KEY_PAIR_GEN
CKM_RSA_X9_31_KEY_PAIR_GEN
CKM_RSA_FIPS_186_3_PRIME_KEY_PAIR_GEN
CKM_RSA_PKCS_KEY_PAIR_GEN
Select the Key Size from the available options. The supported sizes are 2048, 3072, and 4096.
Select the Key Attributes. The options are:
Encrypt, Decrypt, Wrap, Unwrap
Sign, Verify, Derive
Click Next.
Configure Destination (Azure) Key
Enter a user-friendly alias as the Azure Key Name. This helps uniquely identify a key. By default, the Key Name specified on the previous screen is populated.
Select the desired Vault from the drop-down list.
Select the Key Type.
For a standard vault, the key type is RSA.
For a premium vault, the key type can be RSA or RSA HSM.
(Optional) Set the key activation and expiration dates.
Select the Set Activation Date check box and from the on-screen calendar, select the date and time to activate the key.
Select the Set Expiration Date check box and from the on-screen calendar, select the key expiration date and time.
(Optional) Select the Enable Key check box.
Select the Key Attributes. The supported attributes are:
Encrypt, Decrypt, Sign
Verify, Wrap Key, Unwrap Key
(Optional) Enter Tags. A tag is a label assigned to the key, which consists of a user-defined key and a value.
To add a tag:
Specify a tag name.
Specify the tag value.
Click the + button.
Similarly, you can add more tags.
Click Next. The Review and Add screen is displayed.
Review and Add
This screen shows the key details that you have provided. These details are divided into MATERIAL ORIGIN, SOURCE KEY, and DESTINATION KEY sections.
Before adding the key, review all details. After the key is added, certain features will no longer be editable.
Review the key details displayed on the screen.
If details are incorrect or you want to make any changes, click Edit next to the SOURCE KEY and DESTINATION KEY sections and update details. Alternatively, click Back and make changes, as appropriate.
Click Add Key.
The key creation starts. A Create Key In Progress message is displayed on the screen. Leave the window open until the process is completed.
When the status next to the SOURCE KEY and DESTINATION KEY sections becomes Complete and the Key ID links are displayed, the key is created successfully.
Click Close. The Add Azure Key wizard is closed.
The newly created key is displayed in the list of Azure keys. The origin of the key is CCKM.
Uploading Vormetric DSM Key Material
Upload the key material using Vormetric DSM to configure source key.
Select Material Origin
Select Vormetric DSM.
Click Next. The Configure Source Key screen is displayed.
Configure Source Key
Enter a DSM Key Name.
(Optional) Provide a basic Description of the key.
Select the desired DSM Domain.
(Optional) Set the key expiration date. Select the Expiration Date check box and from the on-screen calendar, select the key expiration date and time.
Select the key Algorithm. The supported algorithms are:
RSA-4048
RSA-3072
RSA-4096
Click Next.
Configure Destination (Azure) Key
Enter a user-friendly alias as the Azure Key Name. This helps uniquely identify a key. By default, the Key Name specified on the previous screen is populated.
Select the desired Vault from the drop-down list.
Select the Key Type.
For a standard vault, the key type is RSA.
For a premium vault, the key type can be RSA or RSA HSM.
(Optional) Set the key activation and expiration dates.
Select the Set Activation Date check box and from the on-screen calendar, select the date and time to activate the key.
Select the Set Expiration Date check box and from the on-screen calendar, select the key expiration date and time.
(Optional) Select the Enable Key check box.
Select the Key Attributes. The supported attributes are:
Encrypt, Decrypt, Sign
Verify, Wrap Key, Unwrap Key
(Optional) Enter Tags. A tag is a label assigned to the key, which consists of a user-defined key and a value.
To add a tag:
Specify a tag name.
Specify the tag value.
Click the + button.
Similarly, you can add more tags.
Click Next. The Review and Add screen is displayed.
Review and Add
This screen shows the key details that you have provided. These details are divided into MATERIAL ORIGIN, SOURCE KEY, and DESTINATION KEY sections.
Before adding the key, review all details. After the key is added, certain features will no longer be editable.
Review the key details displayed on the screen.
If details are incorrect or you want to make any changes, click Edit next to the SOURCE KEY and DESTINATION KEY sections and update details. Alternatively, click Back and make changes, as appropriate.
Click Add Key.
The key creation starts. A Create Key In Progress message is displayed on the screen. Leave the window open until the process is completed.
When the status next to the SOURCE KEY and DESTINATION KEY sections becomes Complete and the Key ID links are displayed, the key is created successfully.
Click Close. The Add Azure Key wizard is closed.
The newly created key is displayed in the list of Azure keys. The origin of the key is CCKM.
Cloning Existing Key Material
To add a new Azure key by cloning existing key material:
Open the Cloud Key Manager application.
In the left pane, click Cloud Keys > Azure.
Click Add Key. The Select Material Origin screen of the Add Azure Key wizard is displayed.
Under Select Method, select Clone Existing Key Material. The Select Source section appears. Depending on your requirements, select from the following sources:
Cloning CipherTrust (Local) Key Material
Upload the local key material using CipherTrust to configure source key.
Select Material Origin
Select CipherTrust (Local).
Click Next. The Select CipherTrust Key screen is displayed.
Select CipherTrust Key
Select the desired key from the Key Name drop-down list. This field contains the available local CipherTrust Manager keys.
Click Next. The Configure Destination (Azure) Key screen is displayed.
Configure Destination (Azure) Key
Enter a user-friendly alias as the Azure Key Name. This helps uniquely identify a key.
Select the desired Vault from the drop-down list.
Select the Key Type.
For a standard vault, the key type is RSA.
For a premium vault, the key type can be RSA or RSA HSM.
(Optional) Set the key activation and expiration dates.
Select the Set Activation Date check box and from the on-screen calendar, select the date and time to activate the key.
Select the Set Expiration Date check box and from the on-screen calendar, select the key expiration date and time.
(Optional) Select the Enable Key check box.
Select the Key Attributes. The supported attributes are:
Encrypt, Decrypt, Sign
Verify, Wrap Key, Unwrap Key
(Optional) Enter Tags. A tag is a label assigned to the key, which consists of a user-defined key and a value.
To add a tag:
Specify a tag name.
Specify the tag value.
Click the + button.
Similarly, you can add more tags.
Click Next. The Review and Add screen is displayed.
Review and Add
This screen shows the key details that you have provided. These details are divided into MATERIAL ORIGIN, SOURCE KEY, and DESTINATION KEY sections.
Before adding the key, review all details. After the key is added, certain features will no longer be editable.
Review the key details displayed on the screen.
If details are incorrect or you want to make any changes, click Edit next to the SOURCE KEY and DESTINATION KEY sections and update details. Alternatively, click Back and make changes, as appropriate.
Click Add Key.
The key creation starts. A Create Key In Progress message is displayed on the screen. Leave the window open until the process is completed.
When the status next to the DESTINATION KEY section becomes Complete and the Key ID link is displayed, the key is created successfully.
Click Close. The Add Azure Key wizard is closed.
The newly created key is displayed in the list of Azure keys. The origin of the key is CCKM.
Cloning Luna HSM Key Material
Upload the key material using Luna HSM to configure source key.
Select Material Origin
Select Luna HSM.
Click Next. The Select Luna HSM Key screen is displayed.
Select Luna HSM Key
Select the desired key from the HSM Key Name drop-down list. This field contains the available Luna HSM keys.
Click Next. The Configure Destination (Azure) Key screen is displayed.
Configure Destination (Azure) Key
Enter a user-friendly alias as the Azure Key Name. This helps uniquely identify a key.
Select the desired Vault from the drop-down list.
Select the Key Type.
For a standard vault, the key type is RSA.
For a premium vault, the key type can be RSA or RSA HSM.
(Optional) Set the key activation and expiration dates.
Select the Set Activation Date check box and from the on-screen calendar, select the date and time to activate the key.
Select the Set Expiration Date check box and from the on-screen calendar, select the key expiration date and time.
(Optional) Select the Enable Key check box.
Select the Key Attributes. The supported attributes are:
Encrypt, Decrypt, Sign
Verify, Wrap Key, Unwrap Key
(Optional) Enter Tags. A tag is a label assigned to the key, which consists of a user-defined key and a value.
To add a tag:
Specify a tag name.
Specify the tag value.
Click the + button.
Similarly, you can add more tags.
Click Next. The Review and Add screen is displayed.
Review and Add
This screen shows the key details that you have provided. These details are divided into MATERIAL ORIGIN, SOURCE KEY, and DESTINATION KEY sections.
Before adding the key, review all details. After the key is added, certain features will no longer be editable.
Review the key details displayed on the screen.
If details are incorrect or you want to make any changes, click Edit next to the SOURCE KEY and DESTINATION KEY sections and update details. Alternatively, click Back and make changes, as appropriate.
Click Add Key.
The key creation starts. A Create Key In Progress message is displayed on the screen. Leave the window open until the process is completed.
When the status next to the DESTINATION KEY section becomes Complete and the Key ID link is displayed, the key is created successfully.
Click Close. The Add Azure Key wizard is closed.
The newly created key is displayed in the list of Azure keys. The origin of the key is CCKM.
Cloning Vormetric DSM Key Material
Upload the key material using Vormetric DSM to configure source key.
Select Material Origin
Select Vormetric DSM.
Click Next. The Select Vormetric DSM Key screen is displayed.
Select Vormetric DSM Key
Select the desired key from the DSM Key Name drop-down list. This field contains the available Vormetric DSM keys.
Click Next. The Configure Destination (Azure) Key screen is displayed.
Configure Destination (Azure) Key
Enter a user-friendly alias as the Azure Key Name. This helps uniquely identify a key.
Select the desired Vault from the drop-down list.
Select the Key Type.
For a standard vault, the key type is RSA.
For a premium vault, the key type can be RSA or RSA HSM.
(Optional) Set the key activation and expiration dates.
Select the Set Activation Date check box and from the on-screen calendar, select the date and time to activate the key.
Select the Set Expiration Date check box and from the on-screen calendar, select the key expiration date and time.
(Optional) Select the Enable Key check box.
Select the Key Attributes. The supported attributes are:
Encrypt, Decrypt, Sign
Verify, Wrap Key, Unwrap Key
(Optional) Enter Tags. A tag is a label assigned to the key, which consists of a user-defined key and a value.
To add a tag:
Specify a tag name.
Specify the tag value.
Click the + button.
Similarly, you can add more tags.
Click Next. The Review and Add screen is displayed.
Review and Add
This screen shows the key details that you have provided. These details are divided into MATERIAL ORIGIN, SOURCE KEY, and DESTINATION KEY sections.
Before adding the key, review all details. After the key is added, certain features will no longer be editable.
Review the key details displayed on the screen.
If details are incorrect or you want to make any changes, click Edit next to the SOURCE KEY and DESTINATION KEY sections and update details. Alternatively, click Back and make changes, as appropriate.
Click Add Key.
The key creation starts. A Create Key In Progress message is displayed on the screen. Leave the window open until the process is completed.
When the status next to the DESTINATION KEY section becomes Complete and the Key ID link is displayed, the key is created successfully.
Click Close. The Add Azure Key wizard is closed.
The newly created key is displayed in the list of Azure keys. The origin of the key is CCKM.
Viewing Azure Keys
To view an Azure key:
Open the Cloud Key Manager application.
In the left pane, click Cloud Keys > Azure. The list of available Azure keys is displayed. The Azure Keys page displays the following details:
Field Description Key Name Unique, user-friendly alias of the key. This is useful in searching for specific keys. Current Version Current version of the key. Key Vault Name of the Azure key vault. Region Azure region where the key is created. Status State of the key. The status can be:
• Available
• Soft Deleted
• DeletedAlgorithm Name of the algorithm. Supported algorithms are:
• EC
• RSA
• EC-HSM
• RSA HSMOrigin Source of the key material. The origin of the key can be:
• CCKM: Key material is created on CCKM.
• Native: Key material is created on the cloud.
• External (Unknown): Source of the key material is unknown. It is different than CCKM and the native cloud.Cloud Name of the cloud. Supported clouds are:
• Azure Cloud
• Azure China Cloud
• Azure German Cloud
• Azure US GovernmentCreation Date Time when the key is created.
Sometimes, you might notice certain keys are displayed as grayed out. This happens when the keys are no longer accessible. For example, when:
Any cloud permissions on the keys are changed. The keys are no longer accessible from the Azure connection.
Connection is changed in KMS. The new connection does not have permissions to access the keys.
Editing Azure Keys
To view or edit an Azure key:
Open the Cloud Key Manager application.
In the left pane, click Cloud Keys > Azure. The list of available Azure keys is displayed.
Click the overflow icon (
) corresponding to the desired alias and click View/Edit.Configure the KEY SCHEDULES. Refer to KEY SCHEDULES for details.
KEY SCHEDULES
To configure the key schedules, go to the KEY SCHEDULES section and select/enter the following details:
From the Select Rotation Schedule drop-down list, select a rotation schedule.
Select the key origin. The available options are CipherTrust, Native (Azure), Luna, or DSM.
Click the desired tab to view the instructions.
Select the Key Type. The available options are RSA and RSA-HSM.
Select the Key Size. The available options are 2048, 3072, and 4096.
Select the Key Type. The available options are RSA, EC, RSA-HSM, and EC-HSM.
select the Elliptical Curve Name. The available options are P-56, P-384, P-521, and SECP256K1.
Select the Partition.
Select the Key Type. The available options are RSA and RSA-HSM.
Select the Key Size. The available options are 2048, 3072, and 4096.
Select the Domain.
Select the Key Type. The available options are RSA and RSA-HSM.
Select the Key Size. The available options are 2048, 3072, and 4096.
Select Enabled if you want to enable the rotated key.
Click Update.
A message Key schedule updated successfully is displayed on the screen.
Rotating Keys (Add Version)
Note
To rotate Azure keys, CCKM Users require Add Key and Upload Key permissions.
To rotate a key:
Open the Cloud Key Manager application.
In the left pane, click Cloud Keys > Azure. The list of available Azure keys is displayed.
Click the overflow icon (
) corresponding to the desired alias and click Rotate Now (Add Version). The Add New Version screen is displayed.Select Key Material Origin. Depending on your requirements, select an appropriate option. Refer to the following sections for details:
A message Azure Key successfully rotated is displayed on the screen. Navigate to Cloud Keys > Azure > View/Edit > Versions to view the versions of the rotated Azure key.
Deleting Azure Keys
Non-soft-delete keys can be deleted directly from the Azure vaults using CCKM.
To delete an Azure key:
Open the Cloud Key Manager application.
In the left pane, click Cloud Keys > Azure. The list of available Azure keys is displayed.
Click the overflow icon (
) corresponding to the desired alias and click Delete. The Confirm Delete dialog box is displayed.Click Delete.
A confirmation message is displayed on the screen. The key status changes to DELETED.
Soft-Deleting Azure Keys
Soft deleting is the process of deleting Azure keys from the Azure vaults and CCKM. These keys still exist on CCKM and in the Azure vaults. The soft-deleted keys can be recovered.
Note
This operation can be performed only on the Azure keys residing in the soft-enabled key vaults.
To soft-delete an Azure key:
Open the Cloud Key Manager application.
In the left pane, click Cloud Keys > Azure. The list of available Azure keys is displayed.
Click the overflow icon (
) corresponding to the desired alias and click Soft Delete. The Confirm Soft Delete dialog box is displayed. Click Soft Delete.
A message key <key name> soft-deleted is displayed on the screen. The status of the key changes to SOFT-DELETED.
Recovering Soft-Deleted Azure Keys
If needed, you can recover a soft-deleted key.
To recover a soft-deleted Azure key:
Open the Cloud Key Manager application.
In the left pane, click Cloud Keys > Azure. The list of available Azure keys is displayed.
Click the overflow icon (
) corresponding to the desired alias and click Recover Soft Delete. The Confirm Recover Key dialog box is displayed. Click Recover Key.
A message Key <key name> recovered from soft-delete. is displayed on the screen. The status of the key changes to AVAILABLE.
Purging Azure Keys
Purging is the process of permanently deleting soft-deleted Azure keys from the Azure vaults. However, backup of the purged key can be restored on CCKM. If you wish to restore backup of the purged key, follow the steps mentioned in the Restoring Backup section.
Note
This operation can be performed only on the soft-deleted Azure keys residing in the soft-enabled key vaults.
To purge an Azure key:
Open the Cloud Key Manager application.
In the left pane, click Cloud Keys > Azure. The list of available Azure keys is displayed.
Click the overflow icon (
) corresponding to the desired alias and click Purge. The Purge Azure Key dialog box is displayed.Select the I wish to purge this key. check box.
Click Purge Key.
Purging a key might take some time. After successful deletion, a message key <key name> hard deleted is displayed on the screen. The status of the key changes to DELETED.
If needed, you can restore a purged key from its backup. Refer to Restoring Backup for details.
Restoring Backup
To restore a purged Azure key:
Open the Cloud Key Manager application.
In the left pane, click Cloud Keys > Azure. The list of available Azure keys is displayed.
Click the overflow icon (
) corresponding to the desired alias and click Restore Backup. The Confirm Restore Key dialog box is displayed.Select the desired key vault from the Select Vault drop-down list.
Note
Restoration of keys among cross-region vaults is not allowed.
Click Restore Key.
A message Key <key name> restored is displayed on the screen. The key is restored to the selected key vault. The key status changes to AVAILABLE.
Deleting Backup
Deleting a backup permanently removes the backup of a deleted Azure key from CCKM.
Note
This operation can be performed only on the keys with DELETED status.
To delete the backup of an Azure key from CCKM:
Open the Cloud Key Manager application.
In the left pane, click Cloud Keys > Azure. The list of available Azure keys is displayed.
Click the overflow icon (
) corresponding to the desired alias and click Delete Backup. The Hard Delete Azure Key dialog box is displayed.Select the I wish to delete the backup of this key. check box.
Click Delete Key Backup.
A message Key <key name> backup deleted is displayed on the screen. The backup of the key is permanently deleted from CCKM.
