---
title: "Configure key stores - GeCert"
description: "Configure the GeCert KeyStores section: the default database key store and the Kryptus HSM, Azure Key Vault and PKCS #11 key stores, with the HardDelete, KeyRegistrationDisabled and KeyInsertionDisabled options."
canonical: "https://docs.lacunasoftware.com/en-us/articles/gecert/on-premises/configure-key-stores"
locale: "en"
product: "GeCert"
last_updated: "2026-10-13"
---

# Configure key stores - GeCert

The [GeCert](https://docs.lacunasoftware.com/en-us/articles/gecert) key stores are configured in the **KeyStores** section: each subsection is named after a key store and holds its
configuration, starting with the `Type`. The name is what the web application shows and what the Sys Admin releases to each organization
([key store access](https://docs.lacunasoftware.com/en-us/articles/gecert#concepts)).

## Default key store

Every instance has the `DatabaseDefault` key store, of type `Database`, which keeps the keys encrypted in the database, with no
configuration. It does not accept the registration of existing keys and always removes the key from the database when it is deleted. To
change its options, declare a subsection with the same `DatabaseDefault` name and `Type=Database`.

## Common options

Every key store accepts these options: 

* **Type**: `Database`, `Kryptus`, `AzureKeyVault` or `Pkcs11`
* **HardDelete**: `True` to remove the key from the key store when it is deleted in GeCert. The default is `False`: the key is only marked
  as deleted. In the database it is always `True`; in the Kryptus HSM, deletion is not supported
* **KeyRegistrationDisabled**: `True` to prevent the registration of keys that already exist in the key store (**Register existing key**).
  In the database it is always `True`
* **KeyInsertionDisabled**: `True` to prevent key generation and PKCS #12 import into this key store. A key store with registration and
  insertion disabled only serves the keys already in it

## Kryptus HSM

To keep the keys in a [Kryptus kNET HSM](https://kryptus.com/en/network-hsm-knet/), GeCert uses the KMIP protocol over HTTPS:

* **Type**: `Kryptus`
* **Host**: IP address or hostname of the VHSM
* **Port**: HTTPS port of the VHSM
* **VcoUsername** and **VcoPassword**: credentials of a **VCO** user, with which GeCert creates one HSM user for each organization's
  partition
* **RootUsername** and **RootPassword**: credentials of a **regular** user, who owns the root of the key store. It is where GeCert keeps,
  as secret data, the PIN of each partition. If the user does not exist, GeCert creates it with the VCO user
* **ResponseCacheDisabled**: `True` to turn off the cache of the HSM responses. The default is `False`

Example (*.ini* or *.conf* configuration file):

```ini
[KeyStores:MyHsm]
Type=Kryptus
Host=10.1.2.3
Port=443
VcoUsername=vco
VcoPassword=VCO_PASSWORD
RootUsername=gecert
RootPassword=USER_PASSWORD
```

Example (environment variables):

```bash
KeyStores__MyHsm__Type=Kryptus
KeyStores__MyHsm__Host=10.1.2.3
KeyStores__MyHsm__Port=443
KeyStores__MyHsm__VcoUsername=vco
KeyStores__MyHsm__VcoPassword=VCO_PASSWORD
KeyStores__MyHsm__RootUsername=gecert
KeyStores__MyHsm__RootPassword=USER_PASSWORD
```

## Azure Key Vault

GeCert authenticates with Azure using an application registered in Microsoft Entra ID and a client secret, and creates, imports, reads,
uses and deletes keys in the Key Vault. Create the application, the secret and the Key Vault and grant the permissions as described for
[Amplia](https://docs.lacunasoftware.com/en-us/articles/amplia/on-premises/key-stores/azure), including the permissions to import and delete keys. Then configure:

* **Type**: `AzureKeyVault`
* **Endpoint**: the Key Vault's *Vault URI*, for example `https://my-vault.vault.azure.net/`
* **TenantId**: the Microsoft Entra tenant ID
* **AppId**: the application's *Application (client) ID*
* **AppKey**: the application's client secret
* **UseHsm**: by default (`True`), generated and imported keys are HSM-protected, which requires a *Premium* Key Vault. Set it to `False`
  to use software keys

In Azure Key Vault, generated keys have 2048 or 4096 bits, and the key name may only contain letters, digits and hyphens. 

Example (*.ini* or *.conf* configuration file):

```ini
[KeyStores:MyKeyVault]
Type=AzureKeyVault
Endpoint=https://my-vault.vault.azure.net/
TenantId=00000000-0000-0000-0000-000000000000
AppId=00000000-0000-0000-0000-000000000000
AppKey=APPLICATION_CLIENT_SECRET
HardDelete=True
```

## PKCS #11 device

For an HSM or token with a PKCS #11 library, installed on the GeCert server: 

* **Type**: `Pkcs11`
* **Module**: the path or name of the PKCS #11 library (for example, `eTPKCS11.dll`)
* **Pin**: the token PIN
* **TokenSerialNumber**: the serial number of the token to use, when the library sees more than one. If omitted, the first token is used
* **IgnoreCaseOnLabelMatching**: `True` to look keys up by label case-insensitively. The default is `False`

Example (*.ini* or *.conf* configuration file):

```ini
[KeyStores:MyToken]
Type=Pkcs11
Module=eTPKCS11.dll
Pin=TOKEN_PIN
HardDelete=True
```

Example (JSON configuration):

```json
"KeyStores": {
	"MyHsm": {
		"Type": "Kryptus",
		"Host": "10.1.2.3",
		"Port": 443,
		"VcoUsername": "vco",
		"VcoPassword": "VCO_PASSWORD",
		"RootUsername": "gecert",
		"RootPassword": "USER_PASSWORD"
	},
	"MyToken": {
		"Type": "Pkcs11",
		"Module": "eTPKCS11.dll",
		"Pin": "TOKEN_PIN",
		"HardDelete": true
	}
}
```

After configuring a key store, release it to the organizations that will use it: in the **Sys Admin** area, in the organization details,
click **Grant key store access**. 

## See also

* [GeCert key stores](https://docs.lacunasoftware.com/en-us/articles/gecert#key-stores)
* [Amplia key stores](https://docs.lacunasoftware.com/en-us/articles/amplia/on-premises/key-stores), with the pros and cons of each type