Purchase and enable a KMS instance

Prerequisites

• Network configuration requirements: You must have one VPC and one vSwitch. To create a VPC and a vSwitch, see Create a VPC and a vSwitch or Create a vSwitch.

  Note

  You can log on to the VPC console to view your existing VPCs, vSwitches, and the availability zones where the vSwitches reside.

• PrivateZone configuration requirements: If you use an Alibaba Cloud account for the Chinese mainland site (aliyun.com) to purchase a KMS instance in a region outside the Chinese mainland, or if you use an Alibaba Cloud account for the international site (alibabacloud.com) to purchase a KMS instance in a region within the Chinese mainland, you must manually activate PrivateZone. For more information, see Activate PrivateZone.

  Note

  • If you use an Alibaba Cloud account for the Chinese mainland site (aliyun.com) to purchase a KMS instance in a region within the Chinese mainland, or if you use an Alibaba Cloud account for the international site (alibabacloud.com) to purchase a KMS instance in a region outside the Chinese mainland, PrivateZone is automatically activated. You do not need to manually activate it.

  • KMS covers the fees for DNS resolution of instance domain names, so you are not charged by PrivateZone for this service.

Procedure

1. Log on to the Key Management Service console. In the top navigation bar, select a region. In the left-side navigation pane, click Resource > Instances.

2. On the Software Key Management tab, find the target software key management instance and click Enable in the Actions column.

3. In the Enable KMS Instance panel, configure the parameters and click Enable Now.

   Parameter	Description
   Instance Name	A custom name for the KMS instance. The name can contain letters, digits, and the following special characters: _/+=.@-.
   VPC ID	Select a VPC to bind to the KMS instance.
   Zone Configuration	This setting depends on the deployment mode that you select when you purchase the instance. Dual-availability zone and multi-availability zone deployments are supported. For a multi-availability zone deployment, you can configure up to three availability zones. Zone and vSwitch: Configure an availability zone and a vSwitch. Make sure that the vSwitch has at least one available IP address. Other Zones: You can have availability zones randomly assigned or you can manually specify them. Note Some regions have only one availability zone. In these regions, a KMS instance can be deployed only in a single availability zone. The latency and performance differences are negligible whether the KMS instance is in the same availability zone as your services or a different one. You can select availability zones based on your requirements.

4. The enablement process takes about 30 minutes. Refresh the page to confirm that the instance status has changed to Enabled.

Prerequisites

• HSM configuration requirements: You must have a configured HSM cluster that the KMS instance can connect to. For more information, see Configure an HSM cluster for a hardware key management instance.

  Warning

  If you need to add more HSMs to the cluster later, contact Alibaba Cloud technical support to change the cluster's synchronization method to automatic. This helps prevent synchronization failures.

• Network configuration requirements: Ensure that a vSwitch is available in each availability zone that is configured for the KMS instance. The following description assumes a dual-availability zone deployment.

  Note

  You can log on to the VPC console, click the target vSwitch on the vSwitch page, and view the number of available IP addresses on the details page.

  • Use the two vSwitches that are bound to the HSM instance: You do not need to create new vSwitches. Ensure that each vSwitch has at least four available IP addresses reserved.

  • Do not use the two vSwitches that are bound to the HSM instance: You need to create two vSwitches in different availability zones. Each vSwitch must have at least four available IP addresses reserved. For more information, see Create a vSwitch.

• PrivateZone configuration requirements: If you use an Alibaba Cloud account for the Chinese mainland site (aliyun.com) to purchase a KMS instance in a region outside the Chinese mainland, or if you use an Alibaba Cloud account for the international site (alibabacloud.com) to purchase a KMS instance in a region within the Chinese mainland, you must manually activate PrivateZone. For more information, see Activate PrivateZone.

  Note

  • If you use an Alibaba Cloud account for the Chinese mainland site (aliyun.com) to purchase a KMS instance in a region within the Chinese mainland, or if you use an Alibaba Cloud account for the international site (alibabacloud.com) to purchase a KMS instance in a region outside the Chinese mainland, PrivateZone is automatically activated. You do not need to manually activate it.

  • KMS covers the fees for DNS resolution of instance domain names, so you are not charged by PrivateZone for this service.

Procedure

1. Log on to the Key Management Service console. In the top navigation bar, select a region. In the left-side navigation pane, click Resource > Instances.

2. Click the Hardware Key Management tab, find the target hardware key management instance, and click Enable in the Actions column.

3. In the Connect to HSM panel, configure the settings and then click Connect to HSM to specify the HSM cluster.

   1. Instance Name: A custom name for the KMS instance. The name can contain letters, digits, and the following special characters: _/+=.@-.

   2. Select Cluster: Select the HSM cluster that you configured in CloudHSM.

      Note

      A hardware key management instance can be bound to only one HSM cluster.

   3. Configure HSM Access Secret.:

      Chinese mainland HSM

      • Automatically generate certificates: If you select Automatically generate certificates when you purchase an HSM in the Chinese mainland, HSM automatically generates the required certificates. No manual configuration is needed.

      • Manually generate certificates: If you did not configure automatic certificate generation when you purchased the HSM, you must configure a client certificate (a PKCS#12 certificate with a protection password) and a security domain certificate (the PEM-formatted CA certificate that issues the TLS server certificate for the HSM cluster). For more information about how to generate certificates, see Generate certificates and configure mutual TLS authentication.

        • Client Protection Password: The protection password that you set when you generate the client.p12 client certificate. If you use the certificate generation tool (hsm_certificate_generate), the default password is 12345678.

        • Client Certificate: A PKCS#12 certificate. Click Select File and select the generated client.p12 file to upload.

        • Security Domain Certificate: A PEM-formatted CA certificate. Click Select File and select the generated rootca.pem file to upload.

      International HSM

      • Automatically generate certificates: If you select Automatically generate certificates when you purchase an HSM outside the Chinese mainland, HSM automatically generates the required certificates and deploys them to the server-side HSM. You only need to configure the corresponding certificates on the client SDK to complete the authentication configuration.

      • Manually generate certificates: If you did not configure automatic certificate generation, you must manually configure the client certificate. For more information about how to generate certificates, see Import a GVSM (NIST FIPS) cluster certificate.

        • Username: The username of the HSM operator. This is fixed to kmsuser.

        • Password: The password for the HSM operator. This is the password that you set when you create an HSM operator (CU user).

        • Security Domain Certificate: A PEM-formatted certificate. Log on to the CloudHSM console, click the ID of any HSM instance in the cluster, go to the Instance Details tab, and find the HSM Certificate section. Click ClusterOwnerCertificate and copy the content, or save it as a PEM file and then upload the file.

   4. VPC: This defaults to the VPC ID that is bound to the HSM and cannot be changed.

   5. Configure Zone and vSwitch: This setting depends on the deployment mode that you select when you purchase the instance. Dual-availability zone and multi-availability zone deployments are supported. Each vSwitch in each availability zone must have at least four available IP addresses reserved.

      For a multi-availability zone deployment, you can configure up to three availability zones.

      Note

      Dual-availability zone or multi-availability zone deployments provide high availability, disaster recovery, and load balancing for KMS. The latency and performance differences are negligible whether the KMS instance is in the same availability zone as your services or a different one. You can select availability zones based on your requirements.

4. After you complete the configuration, wait for the system to process the request. The instance is enabled when its status changes to Enabled.

   Note

   If you purchased a secret quota for the instance, enablement takes about 30 minutes. If you did not purchase a secret quota, it takes about 10 minutes. You may need to refresh the page to see the updated status.

Prerequisites

• HSM configuration requirements:

  • You have purchased an off-cloud HSM.

  • You have configured an XKI Proxy external proxy. The following connection methods are supported. For specific instructions, contact your HSM provider.

    Note

    For more information about the XKI Proxy server, see XKI Proxy Server.

    • Public network connection: A direct connection is established over the public internet.

    • VPC endpoint connection: You must first create an endpoint service as described below. For more information, see Create and manage endpoint services.

      • The two availability zones of the endpoint service must match the availability zones selected for the KMS instance.

      • You must add your current Alibaba Cloud account to the allowlist of the endpoint service.

      • The Automatically Accept Endpoint Connections setting for the endpoint service must be set to Yes.

• PrivateZone configuration requirements: If you use an Alibaba Cloud account for the Chinese mainland site (aliyun.com) to purchase a KMS instance in a region outside the Chinese mainland, or if you use an Alibaba Cloud account for the international site (alibabacloud.com) to purchase a KMS instance in a region within the Chinese mainland, you must manually activate PrivateZone. For more information, see Activate PrivateZone.

  Note

  • If you use an Alibaba Cloud account for the Chinese mainland site (aliyun.com) to purchase a KMS instance in a region within the Chinese mainland, or if you use an Alibaba Cloud account for the international site (alibabacloud.com) to purchase a KMS instance in a region outside the Chinese mainland, PrivateZone is automatically activated. You do not need to manually activate it.

  • KMS covers the fees for DNS resolution of instance domain names, so you are not charged by PrivateZone for this service.

Procedure

1. Log on to the Key Management Service console. In the top navigation bar, select a region. In the left-side navigation pane, click Resource > Instances.

2. Click the External Key Management tab, find the target instance, and click Enable in the Actions column.

3. In the Connect to HSM panel, configure the settings and then click Connect to HSM to specify the HSM cluster.

   Parameter	Description
   Instance Name	A custom name for the KMS instance. The name can contain letters, digits, and the following special characters: _/+=.@-.
   VPC	Select a VPC to bind to the KMS instance.
   Zone Configuration	This setting depends on the deployment mode that you select when you purchase the instance. Dual-availability zone and multi-availability zone deployments are supported. For a multi-availability zone deployment, you can configure up to three availability zones. Zone and vSwitch: Configure an availability zone and a vSwitch. Make sure that the vSwitch has at least one available IP address. Other Zones: You can have availability zones randomly assigned or you can manually specify them. Note Some regions have only one availability zone. In these regions, a KMS instance can be deployed only in a single availability zone. Dual-availability zone or multi-availability zone deployments provide high availability, disaster recovery, and load balancing for KMS. The latency and performance differences are negligible whether the KMS instance is in the same availability zone as your services or a different one. You can select availability zones based on your requirements.
   External Proxy Connectivity	Public Endpoint Connectivity: The KMS instance connects to the XKI Proxy external proxy over the public internet. VPC Endpoint Service Connectivity : The KMS instance connects to the XKI Proxy external proxy by using a VPC endpoint service.
   Domain Name of External Proxy	This parameter is required only if you set External Proxy Connectivity to Public Endpoint Connectivity. Enter the domain name of the XKI Proxy external proxy.
   Endpoint Service	This parameter is required only if you set External Proxy Connectivity to VPC Endpoint Service Connectivity . Select an endpoint service. The availability zones selected for the KMS instance must be the same as the availability zones of the endpoint service.
   External Proxy Configuration	Manual Configuration: Manually configure the External Proxy Path, Certificate Fingerprint, AccessKey ID, and AccessKey secret of the XKI proxy. Configuration File Upload: Configure the parameters by uploading a configuration file.

   If you purchased a secret quota for the instance, enablement takes about 30 minutes. If you did not purchase a secret quota, it takes about 10 minutes. You may need to refresh the page. The instance is enabled when its status changes to Enabled.