Azure Managed HSM Azure Managed HSM

This tutorial uses Microsoft Azure’s Managed HSM ↗ — a FIPS 140-2 Level 3 certified implementation — to deploy a VM with the Keyless SSL daemon.

---

Make sure you have:

• Followed Microsoft's tutorial ↗ for provisioning and activating the managed HSM
• Set up a VM for your key server

---

Create a VM where you will deploy the keyless daemon.

---

Follow these instructions to deploy your keyless server.

---

Set up the Azure CLI (used to access the private key).

For example, if you were using macOS:

Terminal window

brew install azure-cli

---

1. Log in through the Azure CLI and create a resource group for the Managed HSM in one of the supported regions:

Terminal window

az login  
az group create --name HSMgroup --location southcentralus

Note For a list of supported regions, see the Microsoft documentation ↗.

1. Create, provision, and activate ↗ the HSM.
2. Add your private key to the keyvault, which returns the URI you need for Step 4:

az keyvault key import --hsm-name "KeylessHSM" --name "hsm-pub-keyless" --pem-file server.key

1. If the key server is running in an Azure VM in the same account, use Managed services for authorization:

1. Enable managed services on the VM in the UI. 2. Give your service user (associated with your VM) HSM sign permissions `` az keyvault role assignment create --hsm-name KeylessHSM --assignee $(az vm identity show --name "hsmtestvm" --resource-group "HSMgroup" --query principalId -o tsv) --scope / --role "Managed HSM Crypto User" ``

1. In the gokeyless YAML file, add the URI from Step 2 under privatekeystores. See our README ↗ for an example.

Once you save the config file, restart gokeyless and verify that it started successfully:

Terminal window

sudo systemctl restart gokeyless.service

sudo systemctl status gokeyless.service -l

{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/ssl/","name":"SSL/TLS"}},{"@type":"ListItem","position":3,"item":{"@id":"/ssl/keyless-ssl/","name":"Keyless SSL"}},{"@type":"ListItem","position":4,"item":{"@id":"/ssl/keyless-ssl/hardware-security-modules/","name":"Hardware security modules"}},{"@type":"ListItem","position":5,"item":{"@id":"/ssl/keyless-ssl/hardware-security-modules/azure-managed-hsm/","name":"Azure Managed HSM"}}]}