Prerequisites

Make sure to adhere to the prerequisites before continuing with integrating Securosys Primus HSM or CloudHSM with Azure EKM.

On the Microsoft Azure side, you need:

• Existing Azure subscription
• Create or use an existing Managed HSM Resource
  • Requires Azure role permissions "Managed HSM Crypto User" and "Managed HSM EKM Administrator"
• Set up or use existing Managed HSM logging
• Choose the Azure service that will use your external keys. This can be any service that supports customer-managed keys. For example, create an Azure Storage Account.

On the Securosys HSM side, you need:

• Existing Securosys Support Portal account
• Fully initialized and configured Primus HSM or CloudHSM
• Optionally: existing RSA or AES key(s) on the HSM Partition

For customer managed infrastructure, you need:

• Infrastructure to deploy the Securosys EKM Proxy Docker container
  • This can be a VM with Docker installed or a Kubernetes cluster, either on-premise or on Azure.
  • This must be reachable on the public internet.
• Publicly reachable domain name of the proxy host.
• TLS server certificate for the proxy host and the corresponding root CA certificate.