External Keys for OpenBao

OpenBao's concept of external keys allows users to register keys backed by an HSM and use them in OpenBao. A number of OpenBao secret engines, such as the PKI engine, can natively use these external keys.

With Primus HSM, external keys are provided through the open source Securosys REST plugin (plugin, core logic). It acts as a KMS plugin in OpenBao and exposes both auto-unsealing and external keys functionality.

Benefits

• HSM-backed keystore: Perform cryptographic operations with HSM-backed keys and manage keys.
• Familiar setup: Combine the secure, tamper-protected Primus HSM keystore with the native OpenBao APIs, such as the PKI engine.
• Compliance: Key material never leaves the FIPS- and CC-certified Primus HSM.

Next Steps

• Follow the installation guide to set up the Securosys REST plugin.