So - I have been doing research regarding Salesforce platform encryption, and am struggling to find the actual "button pushing" steps to accomplish the BYOK plan. Please correct these following steps if I am misunderstanding:
Key Management --> Bring Your Own Key --> then either Create CA-Signed Certificate or Create Self-Signed Certificate. Assuming I select Create CA-Signed Certificate, I enter the information to generate a unique certificate, I then go to the certificates list, and download certificate signing request and send it to my CA.
Once I receive the signed certificate back, go back to Certificate and Key Management, click the name of the certificate, then click Upload Signed Certificate. I am getting this information Here, and this is where I begin to get confused. Do I need to upload this CA signed certificate to the Certificate and key management section, or do I take it, and use it to wrap an OpenSSL certificate, mentioned Here? , then upload it into the Key Management section
.Assuming I Opt out of key derivation, do I have to repeat this process each time I rotate the keys?
Any guidance/insight anyone can provide will be greatly appreciated. This Information can also be found here: https://blog.bessereau.eu/assets/pdfs/salesforce_platform_encryption_implementation_guide.pdf