Connect to Azure

In this guide, you will learn how to connect the Securosys EKM Proxy to Azure Key Vault through Azure Managed HSM.

This page assumes that you have already deployed the proxy as described in the previous step. This includes the proxy having a server key and server certificate configured. You should also have the CA certificate of the root CA that can be used to verify the server certificate.

Permissions Required

To follow this guide, ensure that you have the required permissions on Azure. See the prerequisites for more information.

Obtain Managed HSM Client Certificate and Common Name

Recall that the EKM Proxy uses mTLS to authenticate the connection. Because Azure Managed HSM acts as the client in the mTLS handshake, you need to download its client certificate and configure in the EKM Proxy.

1. Log in to your Azure subscription via CLI with your Managed HSM which has EKM enabled.

2. Get the client certificate from your Managed HSM by running the following command:

   az keyvault ekm-connection certificate show --hsm-name <MHSM Name>

3. Edit the EKM Proxy application.yaml file and:

   • Add the Managed HSM client certificate in the truststore.certificate field.
   • Add the Managed HSM common name to the ekm.allowedClientCns list.

4. Restart the EKM Proxy so the change takes effect.

   docker compose restart azure_ekm_proxy

Create EKM Connection

Next, register your Securosys EKM Proxy in Azure by adding an "external key management connection". You will require the root CA certificate of the EKM Proxy TLS server certificate (chain).

1. Use the following Azure CLI command to create a new connection:

az keyvault ekm-connection create \
    --hsm-name <MHSM Name> \
    --host <EKM Proxy Host Name> \
    --server-ca-certificate <path to PEM file of root CA of server cert> \
    [--path-prefix <EKMProxy Path Prefix>]

2. Verify the connection with:

az keyvault ekm-connection check --hsm-name <MHSM Name>

Example output:

{
  "apiVersion": "1.0.0",
  "ekmProduct": "CLP-US02-HM06 RE-3.2.11",
  "ekmVendor": "Securosys",
  "proxyName": "Securosys EKM Proxy v1.0.0",
  "proxyVendor": "Securosys"
}

This is an overall EKM connectivity check. Therefore it will not perform key specific checks like presence of an external key and authorization to it.

Example EKM Proxy logs from a successful connectivity check:

azure_ekm_proxy  | 2026.06.06 20:53:15.265 INFO  [nio-8080-exec-5] [rBase.[Tomcat].[localhost].[/]] Initializing Spring DispatcherServlet 'dispatcherServlet'
azure_ekm_proxy  | 2026.06.06 20:53:15.266 INFO  [nio-8080-exec-5] [.web.servlet.DispatcherServlet] Initializing Servlet 'dispatcherServlet'
azure_ekm_proxy  | 2026.06.06 20:53:15.270 INFO  [nio-8080-exec-5] [.web.servlet.DispatcherServlet] Completed initialization in 3 ms
azure_ekm_proxy  | 2026.06.06 20:53:15.391 INFO  [nio-8080-exec-5] [ness.controller.InfoController] Info request: GetProxyInfoRequest(request_context=RequestContext(request_id=b305bb77-797c-11f1-a047-c60f57e75ffd, correlation_id=b5493c4a-797c-11f1-b27a-6045bd7604b0, pool_name=Securosys-EKM-MHSM))
azure_ekm_proxy  | 2026.06.06 20:53:15.393 INFO  [nio-8080-exec-5] [ness.controller.InfoController] Api version: 0.1-preview
azure_ekm_proxy  | 2026.06.06 20:53:15.401 INFO  [nio-8080-exec-5] [km.business.service.HsmService] Setup configuration latency for each request: 0 ms

Latency

For proper operation, the Securosys EKM Proxy is expected to respond to API requests within 250 milliseconds. If Azure Managed HSM does not receive a response within this time window, the request will time out.

Create Key on HSM

Azure assumes that keys are already created on the external HSM. Therefore, you need to pre-create your keys by directly accessing your HSM Partition.

Creating keys is made simple with the Securosys CyberVault KMS. Alternatively, you can create keys with any of the HSM APIs. For example, you can use the JCE-based Primus Tools or the pkcs11-tool. View a list of available APIs here.

Note down the name/label of the key that you created. Repeat this for as many keys as you need.

For more details on the key lifecycle, see the Azure documentation.

Azure EKM supported keys

Azure EKM only supports the following keys and key sizes:

• AES-256
• RSA-2048, RSA-3072, RSA-4096

Create External Key in Azure

Create an external key in Azure Key Vault. This creates an entry that references an existing key on your Primus HSM or CloudHSM Partition.

Execute the following command to create the external key entry. Repeat this for as many keys as you need.

az keyvault key create --hsm-name <MHSM Name> \
    --external-key-id <Name/Label of the key in Primus HSM or CloudHSM> \
    --name <Name of Key reference to be created in MHSM>

Azure Portal

An external key can also be created through the Azure Portal. See Manage keys in an Azure Key Vault Managed HSM for more information.

Enable CMK using External Key

After creating your Azure External Key for Managed HSM with EKM, proceed by enabling customer-managed keys in an Azure service of your choice. For example, enable Customer Managed Keys for your Azure Storage Encryption. See all Azure services supporting CMK.

When Azure services perform crypto operations against the external key, Managed HSM communicates with the EKM Proxy to perform the requested operation in your on-premise Primus HSM or your CloudHSM.

Troubleshooting

In case you're having issues with your Azure Managed HSM look for EKM Proxy events within your Azure Managed HSM Diagnostic Logs

Look for new events with OperationName:

• EkmGetKeyMetadata
• EkmGetProxyInfo
• EkmUnwrapKey
• EkmWrapKey

Example diagnostic log query:

AzureDiagnostics
| where ResourceProvider == "MICROSOFT.KEYVAULT"
| project TimeGenerated, Resource, OperationName, requestUri_s, ResultType, ResultDescription
| where OperationName contains "Ekm"

For issues with the Securosys EKM Proxy, inspect the Docker container logs: docker logs azure_ekm_proxy

For issues with the Primus HSM, ask your HSM administrator to look at the Primus HSM Security Log.