Using eMudhra DSC to sign VCs

[parthlawate]

Hello,

We see a potential use case that needs certificate generated through Sunbird RC to be digitally signed using emudra DSC.

What would be the approach to do this ?

@tejash-jl @dileepbapat @pramodkvarma

[pramodkvarma]

How's it different from any regular digital signature keys?

[pramodkvarma]

That's not meant for cloud scale signing.

[parthlawate]

OK.. In that case what is the alternative way to use it ?

[pramodkvarma]

Safely protected private key files or on cloud HSM. How did we do for CoWin? @dileepbapat should know. Also check with @vrayulu how we managed credential signing keys for DIKSHA?

[tejash-jl]

For cowin, we have manually mounted the private key file to the signing services.

[vrayulu]

In DIKSHA, the private key is injected as config into the service via environment variables. The private key is encrypted using ansible vault and stored (in encrypted form) in a private GitHub repo.

[parthlawate]

For the Multitenant Issuer portal for Sunbird RC, we would need to have a way to let issuers have their own Keys for signing. In such a scenario whats the best way to handle this ?

Linking another relevant discussion
https://github.com/orgs/Sunbird-RC/discussions/317#discussioncomment-4881809

[pramodkvarma]

We need a very secure process for tenants/issuers to provide their signing private key which can then be installed into a keystore on server (HSM, software keystore, etc). Can you also ping Sasi and get his suggestions?