---
alias: operation-guide-global-data-orchestrator-encryption
description: "Configure encryption keys and Secrets for Global Data Orchestrator package publication and deployment across Customer Environments"
tags: 
- Global Data Orchestrator
- Change Package
---

# Global Data Orchestrator Package Encryption

Before publishing or deploying packages through [Global Data Orchestrator](https://portal.criticalmanufacturing.com/Help/global-data-orchestrator/), a system administrator must generate an encryption key pair and configure Secrets for the source and destination Customer Environments. The installer does not generate the keys.

**Global Data Orchestrator** uses elliptic-curve Diffie–Hellman (ECDH) key agreement to protect package encryption keys. The source Customer Environment uses the public key during package encryption. Each destination uses the corresponding private key during package decryption.

## EC Key Requirements

The elliptic curve (EC) key pair must meet the following requirements:

| **Parameter** | **Required Value** |
|---|---|
| Key type | Elliptic Curve (EC), usable for ECDH |
| Curve | NIST P-256 |
| Equivalent curve names | `prime256v1`, `secp256r1` |
| Curve object identifier (OID) | `1.2.840.10045.3.1.7` |
| Curve parameter encoding | Named curve |
| Public-key format | SubjectPublicKeyInfo (SPKI), PEM encoded |

Table: Global Data Orchestrator EC Key Requirements

The public-key PEM must include these delimiters:

```text
-----BEGIN PUBLIC KEY-----
...Base64-encoded public key...
-----END PUBLIC KEY-----
```

## Generate a Key Pair with OpenSSL

Before starting, make sure OpenSSL is available.

1. Generate an EC private key using the required curve and named-curve encoding:

    ```bash
    openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:prime256v1 -pkeyopt ec_param_enc:named_curve -out private-key.pem
    ```

    This command produces an unencrypted PKCS#8 PEM private key, delimited by `-----BEGIN PRIVATE KEY-----` and `-----END PRIVATE KEY-----`.

1. Extract the corresponding public key in SPKI PEM format:

    ```bash
    openssl pkey -in private-key.pem -pubout -out public-key.pem
    ```

1. Validate the key pair and public key:

    ```bash
    openssl pkey -in private-key.pem -check -noout
    openssl pkey -pubin -in public-key.pem -pubcheck -noout
    ```

1. Inspect the public key to confirm the curve:

    ```bash
    openssl pkey -pubin -in public-key.pem -text -noout
    ```

    The output should include:

    ```text
    ASN1 OID: prime256v1
    NIST CURVE: P-256
    ```

For command details, see the OpenSSL documentation for [openssl genpkey](https://docs.openssl.org/3.0/man1/openssl-genpkey/) and [openssl pkey](https://docs.openssl.org/3.0/man1/openssl-pkey/).

## Configure the Secrets

1. Open the source **Customer Environment** page and locate its **Definition Id**.
1. Use the key pair generated in [Generate a Key Pair with OpenSSL](#generate-a-key-pair-with-openssl).
1. Create a Kubernetes Secret named `{CoE.DefinitionId}-globaldataorchestrator` in the namespace of the source **Customer Environment** and each destination **Customer Environment**. Use the source **Customer Environment**'s **Definition Id** when naming every Secret. For instructions, see [Kubernetes Sensitive Data](https://portal.criticalmanufacturing.com/Help/devops-center/deployment-targets/kubernetes-section/kubernetes_sensitive_data/) in Customer Portal.
1. Populate the Secret entries with the complete PEM contents, including the delimiters. Use `public-key.pem` for `public-key` and `private-key.pem` for `private-key`. By convention, each Secret contains both `public-key` and `private-key`. The entry used by each environment is shown in the table below.

    | **Environment** | **Entry Used** | **Value** |
    |---|---|---|
    | Source **Customer Environment** | `public-key` | The public key used during package encryption. |
    | Destination **Customer Environment** | `private-key` | The corresponding private key used during package decryption. |

1. Confirm that each destination's private key belongs to the same key pair as the source's public key.

## Automatic Key References

Critical Manufacturing MES setup calculates the source public-key reference automatically. The destination deployment process derives the private-key reference from the source **Customer Environment**'s **Definition Id**. Administrators must still provide the key material in the required Secrets.