Configure Azure Key Vault as Bring Your Own Key Provider

Activate Azure Key Vault Managed HSM

Before using the HSM, activation is required. During activation, data plane commands (e.g., creating keys or assigning roles) are disabled. Only administrators assigned during HSM creation can perform activation.

Generate RSA Key-Pairs:

• You need to generate at least three (up to ten) RSA key-pairs. The minimum number required to decrypt the security domain is known as a quorum.

Generate RSA Key-Pairs Using OpenSSL: Run the following commands to create three self-signed certificates:

openssl req -newkey rsa:2048 -nodes -keyout cert_0.key -x509 -days 365 -out cert_0.cer
openssl req -newkey rsa:2048 -nodes -keyout cert_1.key -x509 -days 365 -out cert_1.cer
openssl req -newkey rsa:2048 -nodes -keyout cert_2.key -x509 -days 365 -out cert_2.cer

Download the Security Domain: Use the RSA public keys to download the security domain:

az keyvault security-domain download --hsm-name ContosoMHSM --sd-wrapping-keys ./certs/cert_0.cer ./certs/cert_1.cer ./certs/cert_2.cer --sd-quorum 2 --security-domain-file ContosoMHSM-SD.json

Complete Activation:

• Once the command executes successfully, your HSM will activate.

• Allow a few minutes for activation to complete.

Important: Store the RSA key pairs and the security domain file securely for future use, such as disaster recovery or setting up another HSM sharing the same security domain.

Register an Application in Azure for FenixPyre

1. Log in to the Azure Portal: Access the Azure portal and sign in.

2. Navigate to Microsoft Entra ID: Select Microsoft Entra ID from the menu.

3. Open App Registrations: Click + Add and then select App Registration.

1. Register a New App: Provide a name for your app and click Create to register it.

1. Create a client secret

   • In the app settings, navigate to Certificates & Secrets.

   • Click + New Client Secret, provide a description, and click Add.

   • Copy and store the client secret securely as it will only be shown once.

Configure Role-Based Access Control (RBAC) for Azure Key Vault Managed HSM

1. Access Managed HSM: In the Azure portal, open the HSM you created.

2. Open the RBAC Tab: Select the RBAC tab.

1. Create Local RBAC: Click the + icon to create a new role assignment. Select Managed HSM Crypto User under Roles and All keys under Scope.

1. Select Security Principal: Click Select Security Principal and choose Enterprise Applications. Then, select your previously registered app.

2. Finalize RBAC Setup: Complete the role assignment process to grant the appropriate permissions to the app.

Finalize the Encryption Key Provider Setup in FenixPyre

1. Assign a Vault Name: In the FenixPyre portal, provide a unique and descriptive name for your vault.

1. Copy HSM URI: Copy the HSM URI from the Azure HSM overview page.

1. Copy Client ID and Tenant ID: Retrieve the Client ID and Tenant ID from your registered app.

1. Use Client Secret: Use the client secret you copied earlier.

2. Verify and Finalize Setup in FenixPyre: In the FenixPyre dashboard, paste the HSM URI, Client ID, Tenant ID, and Client Secret. Click Verify, then Create to finalize the setup.