The Bring Your Own Key (BYOK) model in Workspace ONE UEM Preferred SaaS allows organizations to generate and manage their own Key Encryption Key (KEK). The service ensures secure storage and controlled usage of the KEK. In this process, you download a temporary public key, wrap your locally generated key material with it, and then upload the wrapped key back into the system.
This approach ensures that your organization retains full control of the root of trust. At the same time, the platform provides secure handling, auditing, and complete lifecycle management of the encryption process. Once uploaded, the wrapped key material is activated for use in your environment, maintaining both security and compliance. You can rotate the keys at your own set schedule.
Configuring BYOK
- Go to Groups & Settings > All Settings > System > Key Management Service.
- If you are creating a new key, click ADD.
- Enter a Key Alias and Description for the key, then click Next.
- In the Public Key File section, download the wrapping public key file (for example,
key_alias_WrappingPublicKey.bin).
Note: Wrapping public keys are valid for 24 hours after download. Ensure you complete the upload within the key's validity period; otherwise, you will need to re-download a new public key to complete the upload. - Procure your pre-generated key material or generate your key material locally using your organization's key management tool. The following example shows how to generate a 4096-bit RSA private key and convert it to PKCS#8 DER format:
openssl genrsa -out rsa_private_key.pem 4096 openssl pkcs8 -topk8 -inform PEM -in rsa_private_key.pem -outform DER -out pkcs8_private_key.der -nocrypt - Wrap the generated key material using the downloaded public key. For more information, see Key wrapping process.
- In the Wrapped Key File section, click Upload and attach the wrapped key material file (for example,
wrappedKeyMaterial.bin). - After uploading the wrapped key file, click Save. After you refresh the grid, the key appears in the Enabled state.
- To activate the key, select the key on the grid and click Activate. After you confirm the activation in the browser, the system securely integrates the key material with AWS Key Management Service (KMS) for Data Encryption Key (DEK) and KEK operations.
- After activating the key, verify that the KEK is in an Active state in the console.
Key wrapping process
To wrap your key material, download the wrapKeyMaterial.py script from the WS1 UEM Seed Scripts page. The script accepts the following arguments:
| Argument | Description |
|---|---|
<private_key_path> | Path to the PKCS#8 DER-format private key file generated in step 5 |
<public_key_path> | Path to the wrapping public key file downloaded in step 4 |
<output_path> | Path where the wrapped key material file will be saved |
[password] | (Optional) Password, if one was used during private key creation |
Usage:
python wrapKeyMaterial.py <private_key_path> <public_key_path> <output_path> [password]
Example:
python wrapKeyMaterial.py C:\stash\pkcs8_private_key.der C:\stash\key_alias_WrappingPublicKey.bin C:\stash\wrappedKeyMaterial.bin
After the script completes, you can upload the output file (for example, wrappedKeyMaterial.bin) in step 7 of the configuration process.
Rotate Keys
Workspace ONE UEM allows you to stage additional key material for seamless rotation.
To rotate keys:
- Upload a new wrapped key file. For more information, see Configuring BYOK.
- Save the configuration and restart services as needed.
- Keys can be rotated based on your organization’s schedule and compliance requirements.
Troubleshooting
If errors occur during the BYOK process:
- Verify that the wrapping public key has not expired.
- Review console logs for upload or credential based issues.
Was this page helpful?