Secrets manager - User Guide - BlueCat Edge

BlueCat Edge User Guide
ft:locale
en-US
Product name
BlueCat Edge
The BlueCat Edge secrets manager allows you to store sensitive credentials and certificates in a secure manner for reuse within Edge services without the need to manually enter in sensitive data in different fields. To use the secrets manager, you must first create a secrets profile that stores the sensitive data. Within the secrets profile, you can add a secret or certificate with a name that it will be referred by when managing Edge configurations and settings.
Note: Secrets manager encrypts sensitive data using AES in GCM mode with a 256-bit key.

To create a secrets profile

  1. In the top navigation bar, click and select Secrets manager.
  2. To add a new secrets profile, click New.
  3. Enter the name of the secrets profile.
  4. To add a secret, select Add and enter the following information:
    • Name: enter the name of the secret. This name will be used in fields where the associated sensitive data is required.
    • Data: enter the sensitive data to associate to the secrets name.
    • Click Save to add the secrets to the secrets profile
  5. To add a certificate, select Add and enter the following information:
    • Name: enter the name of the secret. This name will be used in fields where the associated sensitive data is required.
    • Certificate: drag and drop the certificate that you would like to upload to the secrets profile.
      Note: If you are uploading a certificate to use with DNS over HTTPS (DoH) or DNS over TLS (DoT) configurations, the following formats are supported for the certificate input data:
      • The certificate must be PEM-encoded DER format and contain a server certificate, optional intermediates, and private key
      • The PEM data of the certificate must not contain more than 10 intermediate certificates
      • The server and intermediate certificates must be X.509 format
      • The private key must be PKCS#8 encoded, and may be unencrypted or password encrypted
      • The following private key encryption algorithms are supported: AES128CBC, AES128GCM, AES192CBC, AES192GCM, AES256CBC, AES256GCM, and TripleDESCBC
      • The following private key signature algorithms are supported: RSA, ECDSA, and ED25519
    • Password: enter the password that was used to encrypt the private key.
    • Click Save to add the certificate to the secrets profile.
  6. Click Save.