Introduction

Entrust KeyControl has been rebranded as the Entrust Cryptographic Security Platform (CSP) Key Manager.

The Entrust CSP Key Manager continues to provide a comprehensive solution for discovering and managing the lifecycles of cryptographic keys, secrets, certificates, tokens, libraries, protocols, and configurations:

  • The KeyControl Compliance Manager is now the Entrust CSP Compliance Manager. It still integrates with Entrust nShield Hardware Security Modules (HSMs) to protect the master keys for the CSP.

  • KeyControl Vault is now the Entrust Cryptographic Security Platform Vault. The Cryptographic Security Platform Vaults also still integrate with Entrust nShield HSMs to provide an optional HSM root of trust.

Because the Entrust integrations are tested against specific product versions, this guide is still branded as a "KeyControl" integration. It was tested against a pre-CSP version of KeyControl.

Exercise caution when using an Entrust Integration Guide with a product version that does not match the tested version, because your version might not function in exactly the same way.

Entrust cannot guarantee the success of integrations in configurations other than those indicated in the guide. This guide remains on the website for customers using pre-CSP versions of KeyControl.

This document describes the integration of Oracle MySQL Enterprise Server with the Entrust KeyControl Vault Solution. Entrust KeyControl Vault can serve as a KMS in Oracle MySQL using the open standard Key Management Interoperability Protocol (KMIP). It is deployed as a cluster of virtual appliances that integrate with FIPS 140-2-compliant third-party hardware security modules (HSM) to securely store keys.

Documents to read first

This guide describes how to configure the Entrust KeyControl Vault server as a KMS in Oracle MySQL.

To install and configure the Entrust KeyControl Vault server as a KMIP server, see the Entrust KeyControl nShield HSM Integration Guide. You can access it from the Entrust Document Library and from the nShield Product Documentation website.

Also refer to the Oracle MySQL online documentation.

Requirements

  • Entrust KeyControl Vault version 10.3.1 or later.

    An Entrust KeyControl Vault license is required for the installation. You can obtain this license from your Entrust KeyControl Vault and Oracle MySQL account team or through Entrust KeyControl Vault customer support.

  • MySQL Enterprise Server 8.4.2 or later.

Entrust recommends that you allow only unprivileged connections unless you are performing administrative tasks.

High-availability considerations

The Entrust KeyControl Vault solution uses an active-active deployment, which provides high-availability capability to manage encryption keys. Entrust recommends this deployment configuration. In an active-active cluster, changes made to any KeyControl node in the cluster are automatically reflected on all nodes in the cluster. For information about the Entrust KeyControl solution, see the Entrust KeyControl Product Overview.

Product configuration

The integration between the Oracle MySQL Enterprise Server, Entrust KeyControl Vault, and nShield HSM has been successfully tested in the following configurations:

Product Version

Red Hat Linux 9

9.4 (Plow) - 5.14.0-427.35.1.el9_4.x86_64

Oracle MySQL Enterprise Server

8.4.2

Entrust KeyControl

10.3.1

MySQL Keyring_okv library

1.11