Skip to main content

Securing MarkLogic Server

Add Encryption Configuration Settings to MarkLogic Server

To add encryption configuration settings to MarkLogic Server, follow these steps in the MarkLogic Server Admin Interface:

  1. Click Clusters in the left navigation bar.

  2. Click the Keystore tab. The Edit Keystore Configuration page appears:

    Screenshot illustrating the Edit Keystore Configuration page

  3. In kms type, select external.

  4. Click the External KMS tab.

  5. Enter the following information to identify the Azure Key Vault and the required encryption key identifiers, adding the appropriate encryption key ID to each field:

    • Set host name using DNS Name from the Azure Key Vault (without the beginning https:// and the ending /, and ending with vault.azure.net).

    • Set port to 443.

    • Copy the encryption key IDs for the Azure Key Vault into the external data encryption key id, external config encryption key id, and external logs encryption key id fields.

  6. Click OK to configure encryption.

Note

We recommend that you create three separate encryption key IDs (one for data, one for configuration, and one for logs). Give each a descriptive name in order to help distinguish between them.

Setting

Description

host name

The host name of the external Key Vault.

port

The external Key Vault client socket port number.

external data encryption key id

The identifier of the encryption key from the external KMS that is to be used to encrypt data files.

external config encryption key id

The identifier of the encryption key from the external KMS that is to be used to encrypt config files.

external logs encryption key id

The identifier of the encryption key from the external KMS that is to be used to encrypt log files.

For more about roles and privileges, see the MarkLogic Server on Microsoft® Azure® Guide.

In this section: