Pular para o conteúdo principal

Configure key stores - GeCert

The GeCert key stores are configured in the KeyStores section: each subsection is named after a key store and holds its configuration, starting with the Type. The name is what the web application shows and what the Sys Admin releases to each organization (key store access).

Default key store​

Every instance has the DatabaseDefault key store, of type Database, which keeps the keys encrypted in the database, with no configuration. It does not accept the registration of existing keys and always removes the key from the database when it is deleted. To change its options, declare a subsection with the same DatabaseDefault name and Type=Database.

Common options​

Every key store accepts these options:

  • Type: Database, Kryptus, AzureKeyVault or Pkcs11
  • HardDelete: True to remove the key from the key store when it is deleted in GeCert. The default is False: the key is only marked as deleted. In the database it is always True; in the Kryptus HSM, deletion is not supported
  • KeyRegistrationDisabled: True to prevent the registration of keys that already exist in the key store (Register existing key). In the database it is always True
  • KeyInsertionDisabled: True to prevent key generation and PKCS #12 import into this key store. A key store with registration and insertion disabled only serves the keys already in it

Kryptus HSM​

To keep the keys in a Kryptus kNET HSM, GeCert uses the KMIP protocol over HTTPS:

  • Type: Kryptus
  • Host: IP address or hostname of the VHSM
  • Port: HTTPS port of the VHSM
  • VcoUsername and VcoPassword: credentials of a VCO user, with which GeCert creates one HSM user for each organization's partition
  • RootUsername and RootPassword: credentials of a regular user, who owns the root of the key store. It is where GeCert keeps, as secret data, the PIN of each partition. If the user does not exist, GeCert creates it with the VCO user
  • ResponseCacheDisabled: True to turn off the cache of the HSM responses. The default is False

Example (.ini or .conf configuration file):

[KeyStores:MyHsm]
Type=Kryptus
Host=10.1.2.3
Port=443
VcoUsername=vco
VcoPassword=VCO_PASSWORD
RootUsername=gecert
RootPassword=USER_PASSWORD

Example (environment variables):

KeyStores__MyHsm__Type=Kryptus
KeyStores__MyHsm__Host=10.1.2.3
KeyStores__MyHsm__Port=443
KeyStores__MyHsm__VcoUsername=vco
KeyStores__MyHsm__VcoPassword=VCO_PASSWORD
KeyStores__MyHsm__RootUsername=gecert
KeyStores__MyHsm__RootPassword=USER_PASSWORD

Azure Key Vault​

GeCert authenticates with Azure using an application registered in Microsoft Entra ID and a client secret, and creates, imports, reads, uses and deletes keys in the Key Vault. Create the application, the secret and the Key Vault and grant the permissions as described for Amplia, including the permissions to import and delete keys. Then configure:

  • Type: AzureKeyVault
  • Endpoint: the Key Vault's Vault URI, for example https://my-vault.vault.azure.net/
  • TenantId: the Microsoft Entra tenant ID
  • AppId: the application's Application (client) ID
  • AppKey: the application's client secret
  • UseHsm: by default (True), generated and imported keys are HSM-protected, which requires a Premium Key Vault. Set it to False to use software keys

In Azure Key Vault, generated keys have 2048 or 4096 bits, and the key name may only contain letters, digits and hyphens.

Example (.ini or .conf configuration file):

[KeyStores:MyKeyVault]
Type=AzureKeyVault
Endpoint=https://my-vault.vault.azure.net/
TenantId=00000000-0000-0000-0000-000000000000
AppId=00000000-0000-0000-0000-000000000000
AppKey=APPLICATION_CLIENT_SECRET
HardDelete=True

PKCS #11 device​

For an HSM or token with a PKCS #11 library, installed on the GeCert server:

  • Type: Pkcs11
  • Module: the path or name of the PKCS #11 library (for example, eTPKCS11.dll)
  • Pin: the token PIN
  • TokenSerialNumber: the serial number of the token to use, when the library sees more than one. If omitted, the first token is used
  • IgnoreCaseOnLabelMatching: True to look keys up by label case-insensitively. The default is False

Example (.ini or .conf configuration file):

[KeyStores:MyToken]
Type=Pkcs11
Module=eTPKCS11.dll
Pin=TOKEN_PIN
HardDelete=True

Example (JSON configuration):

"KeyStores": {
	"MyHsm": {
		"Type": "Kryptus",
		"Host": "10.1.2.3",
		"Port": 443,
		"VcoUsername": "vco",
		"VcoPassword": "VCO_PASSWORD",
		"RootUsername": "gecert",
		"RootPassword": "USER_PASSWORD"
	},
	"MyToken": {
		"Type": "Pkcs11",
		"Module": "eTPKCS11.dll",
		"Pin": "TOKEN_PIN",
		"HardDelete": true
	}
}

After configuring a key store, release it to the organizations that will use it: in the Sys Admin area, in the organization details, click Grant key store access.

See also​

View as Markdown