HashiCorp Vault - Managed Keys

this document provides information regarding the configuration of the {{futurex}} {{vectera}} hsm with hashicorp vault's managed keys feature by using {{futurex}} pkcs #11 libraries for additional questions related to your hsm, see the relevant user guide application description from the hashicorp vault documentation website within certain environments, customers want to leverage key management systems external to vault, when handling, storing, and interacting with private key material, or are required to do so by standards requirements to satisfy these requirements, vault has a centralized abstraction called managed keys that different secrets engines can plug into, allowing them to delegate these operations to a trusted external kms minimally, a managed key consists of a named managed key entry managed by the sys/managed key api besides a name, there are backend specific configurations to access the key in question for pkcs #11 (hsm) backed managed keys, the managed key configuration must reference a kms library stanza which points to a pkcs #11 access library on the host machine note that a configured, named managed key corresponds to a single key within a backend more than one managed key can be configured targeting a single backend by creating multiple managed keys with the api guardian integration the {{guard}} introduces mission critical viability to core cryptographic infrastructure, including centralization of device management elimination of points of failure distribution of transaction loads group specific function blocking user defined grouping systems see the applicable guide in the {{futurex}} portal for configuring hsms with the {{guard}} , including pkcs #11 and cng configuration