GCP 中用于存储客户端 tls 证书的私钥的密钥管理

Question

We've recently decided to try to use KMS (Key management) in GCP for storing private keys that the organization has.

I stumbled upon an issue when I tried to move the private key and password to key management where they are a part of a.p12 that we use in a key store to communicate with an external third provider.

        val pkcs12KeyStore = KeyStore.getInstance("PKCS12")
            .apply { load(ByteArrayInputStream(certificateContent), certPassword.toCharArray()) }

        val pkcs12KeyManager = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm())
            .apply { init(pkcs12KeyStore, certPassword.toCharArray()) }

        val sslContext = SslContextBuilder
            .forClient()
            .keyManager(pkcs12KeyManager)
            .build()

Is what we do when we have access to the private key and password in the application. Is there a way to achieve this when the private key is in Key management in GCP?

Answer 1

First of all let me tell you that unless they are necessary for backwards compatibility, GCP does not recommend “P12” service account keys.In the other hand, what you need to do is:

1.- Download “.p12” key (a) and convert to “pem”.

a)

$ gcloud iam service-accounts keys create svc_account.p12 \
--iam-account=$SERVICE_ACCOUNT_EMAIL \
--key-file-type=p12

b)

$ openssl pkcs12 -in svc_account.p12  \
-nocerts -nodes \
-passin pass:notasecret | openssl rsa -out privkey.pem`

2.- Create ImportJob.

export IMPORT_JOB=saimporter
export VERSION=1
$ gcloud beta kms import-jobs create $IMPORT_JOB \
--location $LOCATION \
--keyring $KEYRING_NAME \
--import-method rsa-oaep-3072-sha1-aes-256 \
--protection-level hsm
$ gcloud kms import-jobs describe $IMPORT_JOB \
--location $LOCATION \
--keyring $KEYRING_NAME

3.- Format “.pem” key for import.

$ openssl pkcs8 -topk8 -nocrypt -inform PEM \
-outform DER     -in privkey.pem  \
-out formatted.pem

4.- Via importJob, import the formatted key to KMS.

$ gcloud kms keys create $KEY_NAME \
--keyring=$KEYRING_NAME --purpose=asymmetric-signing \
--default-algorithm=rsa-sign-pkcs1-2048-sha256 \
--skip-initial-version-creation --location=$LOCATION \
--protection-level=hsm
$ gcloud kms keys versions import   \
--import-job $IMPORT_JOB   --location $LOCATION  \
--keyring $KEYRING_NAME   --key $KEY_NAME   \
--algorithm rsa-sign-pkcs1-2048-sha256  \
--target-key-file formatted.pem

5.- Then “.p12” and “.pem” files should be deleted files from disk.

As a reference, you can use the following information regarding your specific situation Import Service Account Private Key to KMS (SA -> KMS) . Plus, this official GCP's information can be useful for you now and in the future Creating service account keys . Finally, for the Google Auth library, the Google Auth options that GCP got and how to handle them Interface GoogleAuthOptions .