Skip to main content

Getting Started

Deploy an Azure EKM proxy endpoint from the Cockpit Apps catalog

Applies to:
DuoKey Cockpit AdminAzure Managed HSM

Prerequisites​

Prerequisites

  • An Azure Managed HSM (or Azure service configured with a Managed HSM Customer-Managed Key) that supports the External Key Manager protocol
  • The client CA certificate (PEM) that issues Azure's client certificate — get this from your Azure Managed HSM configuration
  • A DuoKey vault already created, containing an AES-256 key or an RSA-2048/4096 key
  • DuoKey Cockpit admin access with permission to manage Apps
Note

Server certificate and private key are optional at this step. The mTLS server private key is never sent to or stored by DuoKey — it stays with whichever ingress terminates TLS in front of the proxy.

Deploy an EKM endpoint​

From the DuoKey Dashboard, open Apps, click + Create new app, and select Azure EKM. The wizard walks through five steps.

Azure EKM deploy wizard
1. EKM ProxyProxy name, description, vendor string — the endpoint slug is auto-generated
2. mTLS CertificatesClient CA certificate (required for mTLS), optional server cert, optional Subject CN pin
3. Vault & KeySelect the vault and the KEK — an AES-256 or RSA-2048/4096 key
4. AlgorithmsRestrict to A256KW / A256KWP (AES) or RSA-OAEP-256 (RSA)
5. Review & DeployTest Connection runs a wrap/unwrap self-test, then Deploy EKM Proxy

Nothing is exposed to Azure until the last step — Test Connection and Deploy both run against the vault-held key you selected.

1

EKM Proxy

Set:

  • Proxy Name — a name for this endpoint (e.g. Azure EKM Production)
  • Description — optional free text
  • Endpoint Slug — an auto-generated GUID, shown read-only. It becomes part of the endpoint URL: /azureekm/{slug}
  • Proxy Vendor — the vendor string returned to Azure in the proxy info response, defaults to DKE Cockpit
2

mTLS Certificates

Azure Managed HSM authenticates to the proxy with mutual TLS. Configure:

  • Client CA Certificate (PEM) — the CA that issued Azure's client certificate. Required if mTLS is on.
  • Server Certificate (PEM) — optional, for display / provisioning your ingress
  • Server Private Key (PEM) — optional; used only to help provision the mTLS-terminating ingress, never persisted by DuoKey
  • Require mTLS client authentication — on by default; leave it on for production and only turn it off for local testing
  • Expected client CN — optional identity pin (e.g. <hsm-name>.managedhsmclient.azure.net). When set, a validated client certificate is only accepted if its Subject CN matches (case-insensitive); leave empty to trust any certificate that chains to the CA above
Caution

If mTLS is required and no client CA certificate is configured, every request to the endpoint is refused.

3

Vault & Key

Select the vault and key to use as the Key Encryption Key (KEK). The key type determines which wrap algorithms are available in the next step: AES-256 keys support A256KW/A256KWP, RSA keys support RSA-OAEP-256.

4

Algorithms

Choose which algorithms this endpoint allows, from the set compatible with the key type you selected:

Key typeAvailable algorithms
AES-256A256KW (RFC 3394), A256KWP (RFC 5649)
RSA-2048 / RSA-4096RSA-OAEP-256

Leave every option unchecked to allow every algorithm compatible with the chosen key.

5

Review & Deploy

Review the summary — proxy name, endpoint slug, mTLS status, client CA upload status, pinned CN (if any), vault, key, and allowed algorithms — then use Test Connection to run a wrap/unwrap self-test, or click Deploy EKM Proxy.

After deployment​

Deploying creates the app and configures the endpoint in one step — there is no separate enable action. The response gives you the endpoint's base URL and the individual operation paths:

Example deploy response (paths)TEXT
ekm_url:        /azureekm/<slug>
info_endpoint:    /azureekm/<slug>/info
wrap_endpoint:    /azureekm/<slug>/{key_name}/wrapkey
unwrap_endpoint:  /azureekm/<slug>/{key_name}/unwrapkey
metadata_endpoint:/azureekm/<slug>/{key_name}/metadata
health_endpoint:  /azureekm/<slug>/health
1

Register the endpoint with Azure

Configure your Azure Managed HSM / Azure SQL Managed HSM setup with the proxy's base URL and API version (0.1-preview), so Azure knows where to send wrap/unwrap requests.

2

Run the self-test

Use the app's Test action to run a wrap/unwrap round trip. For an AES-256 KEK this exercises the real vault key end-to-end; for an RSA KEK (or before a key is selected) it instead validates the wrap/unwrap plumbing with a synthetic key. To validate an RSA-backed endpoint's real key before production, use the endpoint health check instead (next step).

3

Check endpoint health

The app's health check confirms the endpoint is deployed and enabled, the key is present and operational, the self-test passes, and mTLS is correctly configured — useful for pre-production validation and ongoing monitoring.

Tip

The endpoint slug and any uploaded mTLS trust anchor act as credentials. If you ever suspect they were exposed, redeploy the endpoint with a new client CA, or disable it from the app's detail page.

Next Steps​

Overview

What Azure EKM is and how the protocol works

See Also