Signing key configuration file parameters
A signing key configuration file is a YAML file that defines the parameters to access one or more signing keys.
note
You can specify multiple key configurations in a single configuration file by adding a triple-dash
separator (---) between configurations.
Specify a maximum file size limit for your signing key configuration file with the
--key-store-config-file-max-size command line option.
The default size is 100 MB.
Raw unencrypted files
Stores the private key as an unencrypted value directly in the key configuration file.
type: "file-raw"
keyType: "SECP256K1"
privateKey: "0x25b1166a43c109cb330af8945d364722757c65ed2bfed5444b5a2f057f82d391"
| Key | Description |
|---|---|
| type | Type of configuration file. Use file-raw. |
| keyType | Signing key type. Valid options are BLS or SECP256K1. The default is BLS. |
| privateKey | Hexadecimal encoded private key string. |
Keystore file
Use the private key stored in a keystore file.
type: "file-keystore"
keyType: "SECP256K1"
keystoreFile: "95e57532ede3c1dd879061153f9cfdcdefa9dc5fb9c954a6677bc6641b8d26e39f70b660bbaa732c47277c0096e11400.json"
keystorePasswordFile: "95e57532ede3c1dd879061153f9cfdcdefa9dc5fb9c954a6677bc6641b8d26e39f70b660bbaa732c47277c0096e11400.password"
| Key | Description |
|---|---|
| type | Type of configuration file. Use file-keystore. |
| keyType | Signing key type. Valid options are BLS or SECP256K1. The default is BLS. |
| keystoreFile | Location of the keystore file. |
| keystorePasswordFile | Text file containing the password to decrypt the keystore file. |
HashiCorp Vault
Use the private key stored in HashiCorp Vault.
type: "hashicorp"
keyType: "SECP256K1"
tlsEnabled: "true"
keyPath: "/v1/secret/data/secretPath"
keyName: "secretName"
tlsKnownServersPath: "/Users/me/project/knownhosts"
serverHost: "localhost"
serverPort: "32895"
timeout: "10000"
token: "s.MuZwBqZ0iE1HzvD64v3HMlhT"
| Key | Description |
|---|---|
| type | Type of configuration file. Use hashicorp. |
| keyType | Signing key type. Valid options are BLS or SECP256K1. The default is BLS. |
| tlsEnabled | Enable or disable TLS. The default is true. |
| keyPath | Path to secret in the HashiCorp Vault containing the private key. Syntax is the same as the path used in HashiCorp KV Secrets Engine Version 2 HTTP API |
| keyName | Name of the key storing the private key in the vault. |
| tlsKnownServersPath | Path to the file containing a list of trusted HashiCorp Vault servers. |
| serverHost | Host of the HashiCorp Vault server. |
| serverPort | Port of the HashiCorp Vault server. |
| timeout | Timeout in milliseconds for requests to the HashiCorp Vault server. |
| token | The root token displayed by the HashiCorp Vault server. |
| httpProtocolVersion | Override HTTP protocol version that is used to connect to HashiCorp Vault. Valid values are HTTP_2 and HTTP_1_1. The default is HTTP_2. |
Azure Key Vault
Use the private key stored in Azure Key Vault. Supports two signing options:
azure-key- Performs the signing in Azure Key Vault. Supports SECP256K1 signing keys only.azure-secret- Web3Signer fetches the keys from the vault and signs locally. Supports SECP256K1 and BLS12-381 signing keys.
- azure-secret
- azure-key
type: "azure-secret"
keyType: "BLS"
authenticationMode: "USER_ASSIGNED_MANAGED_IDENTITY"
clientId: "***"
tenantId: "***"
vaultName: "AzureKeyVault"
secretName: "SecretName"
type: "azure-key"
clientId: "***"
clientSecret: "***"
tenantId: "***"
vaultName: "AzureKeyVault"
keyName: "KeyName"
| Key | Description |
|---|---|
| type | Type of configuration file. Use azure-secret or azure-key. |
| authenticationMode | Authentication type being used. Can only be used with the azure-secret type. Valid options are CLIENT_SECRET, SYSTEM_ASSIGNED_MANAGED_IDENTITY, and USER_ASSIGNED_MANAGED_IDENTITY. The default is CLIENT_SECRET. |
| keyType | Signing key type. Valid options are BLS or SECP256K1. The default is SECP256K1. |
| clientId | ID used to authenticate with Azure Key Vault. Required when using the azure-key type, or when using azure-secret with the CLIENT_SECRET or USER_ASSIGNED_MANAGED_IDENTITY authentication modes. |
| clientSecret | Secret used to access the vault. Required for the CLIENT_SECRET authentication mode. |
| tenantId | The tenant ID used to authenticate with Azure Key Vault. |
| vaultName | Name of the vault to access. Sub-domain of vault.azure.net. |
| secretName | Name of the key stored in the Azure Key Vault under Secrets settings. Required when using the azure-secret type. |
| keyName | Name of the key stored in the Azure Key Vault under Keys settings. Required when using the azure-key type. |
AWS Secrets Manager
Use the private key stored in AWS Secrets Manager. Supports BLS keys for consensus layer signing.
type: "aws-secret"
authenticationMode: "SPECIFIED"
keyType: "BLS"
accessKeyId: "foo"
secretAccessKey: "bar"
secretName: "SecretName"
region: "us-west-2"
| Key | Description |
|---|---|
| type | Type of configuration file. Use aws-secret. |
| authenticationMode | Authentication type being used. Valid options are ENVIRONMENT and SPECIFIED. If using ENVIRONMENT, credentials are authenticated using the default credential provider chain. The default authentication type is SPECIFIED. |
| keyType | Signing key type. Use BLS. |
| accessKeyId | Your access key ID. |
| secretAccessKey | Your secret access key. |
| secretName | Name of the secret. |
| region | Region to connect to. |
AWS Key Management Service
Use the private key stored in AWS Key Management Service (KMS). Supports SECP256K1 keys for execution layer signing.
type: "aws-kms"
authenticationMode: "SPECIFIED"
accessKeyId: "acc_key_id"
secretAccessKey: "foo"
sessionToken: "sess_token"
kmsKeyId: "bar"
region: "us-east-2"
endpointOverride: "http://localhost:4566"
| Key | Description |
|---|---|
| type | Type of configuration file. Use aws-kms. |
| authenticationMode | Authentication type being used. Valid options are ENVIRONMENT and SPECIFIED. If using ENVIRONMENT, credentials are authenticated using the default credential provider chain. The default authentication type is SPECIFIED. |
| accessKeyId | Access key ID. |
| secretAccessKey | Secret access key. |
| sessionToken | Token provided by AWS Security Token Service (STS). Optional depending on AWS configuration. |
| kmsKeyId | AWS Access Key ID to authenticate AWS KMS. |
| region | Region to connect to. |
| endpointOverride | Endpoint override for AWS KMS. Useful for local testing against LocalStack. |