Learn how to configure and manage the OKMS access certificate for your Data Security products.
Requirements
Instructions
OKMS access certificate description
To communicate with your OKMS domain, you will need to create an access certificate.
Access certificates to an OKMS domain are used for the Key Management Service (KMS). This will be used for any interaction with the domain, either to create encryption keys or to carry out operations with them.
An access certificate is only valid for the domain for which it was generated.
NOTE: Only the certificate creation with a CSR is covered by the PCI-DSS certification.
Create an access certificate from the KMS
From the OVHcloud Control Panel
It's possible to create this certificate from the dedicated entry of the KMS. From the OVHcloud Control Panel, navigate to the Key Management Service section via the Identity, Security & Operations menu.
Then, select the Access certificates tab and click + Generate an access certificate.
If you do not provide a CSR, OVHcloud will generate the access certificate along with a private key.
On the next screen, provide a name for your certificate, choose a validity period, select a generation method (via OVHcloud or your own), and click Add user IDs.
If you have your own private key, add the contents of your certificate into the field, and click Add user IDs.
The second part of the form allows you to indicate the OVHcloud identities associated to this certificate that will be used to calculate access rights via the OVHcloud IAM.
It is possible to add the root identity to the certificate so not to be constrained by the OVHcloud IAM.
Add your users, groups, and/or service accounts, then click Generate access certificate.
On the next screen, be sure to Download private key and confirm by checking ☑ the box. Then click Finish.
NOTE: The private key will no longer be accessible at a later stage. If you lose it, you will need to regenerate a certificate.
NOTE: The privateKeyPEM field needs to be edited so that all instances of \n are replaced by carriage returns.
Finally, you can download the public key of the certificate from the dashboard by clicking the more options ... button and selecting Download.
From the OVHcloud API
You can generate this certificate by letting OVHcloud generate the private key, or by providing your Certificate Signing Request (CSR) in the case that you have your own private key.
You can generate a certificate via the following API:
The following information is required:
- name: the name of the certificate
- identityURNs: list of OVHcloud identities in URN format that will be provided to the IAM for calculating access rights
- description: certificate description (optional)
- certificateType: certificate signature algorithm (ECDSA or RSA) - ECDSA by default (optional)
- validity: certificate validity duration in days - 365 days by default (optional)
For the ACCOUNT_NIC, the following API call will retrieve that information. It is in the format "az123-ovh" and is listed in the "account" line of the API response:
Example of certificate creation with root account:
Example of certificate creation with local user:
NOTE: A user policy with the correct permissions for accessing the KMS should be created and applied to the user.
The API then returns the certificate creation status:
Copy the value of the privateKeyPEM field to a domain.key file
WARNING: The private key will no longer be accessible at a later stage. If you lose it, you will need to regenerate a certificate.
NOTE: The privateKeyPEM field will need to be edited so that all instances of \n are replaced by carriage returns.
Then copy the certificate ID and access its details via the API:
The API returns the certificate in PEM:
Copy the value of the certificatePEM field to a client.cert file.
NOTE: The certificatePEM field will need to be edited so that all instances of \n are replaced by carriage returns.
If you have your own private key, it is possible to use it by providing a CSR.
You can generate a certificate via the following API:
The following information is required:
- name: the name of the certificate
- identityURNs: list of OVHcloud identities in URN format that will be provided to the IAM for calculating access rights
- description: certificate description (optional)
- validity: certificate validity duration in days - 365 days by default (optional)
-
csr: the content of the CSR
NOTE: The CSR needs to be in JSON format. The CSR file will need to be edited so that there are no carriage returns; rather,
\nwill have to be inserted where the line breaks were previously. You can see this in practice in the example below. If you need assistance, there are third-party tools available online to adjust content into the correct JSON format.
Example of certificate creation:
The API then returns the certificate creation status:
Copy the ID of the certificate and access its details via the API:
The API returns the certificate in PEM:
Copy the value of the certificatePEM field to a client.cert file.
Go further
Using OVHcloud Key Management Service (KMS)
For more information and tutorials, please see our other Manage & Operate support guides or explore the guides for other OVHcloud products and services.