Launchnodes KMS driver for Canton: Azure and GCP integration
Hey all — releasing something to support your Canton operations: An audited Launchnodes KMS driver for Canton, supporting Azure Key Vault and Google Cloud KMS.
Your Canton Participant relies on cryptographic keys for its network identity, authentication, transaction signing, and encryption. With external KMS integration, these private keys remain in your KMS and cryptographic operations are performed without exposing them to the Participant node.
What the Launchnodes driver does:
- Signing keys live in Azure Key Vault or Google Cloud KMS. Keys are generated there, non-exportable, and never written to the node’s disk or database
- The participant only ever sees public keys and signatures
- Installs via the Splice Helm charts: Drops into an existing deployment, replaces nothing
Why it’s worth 10 minutes of your time:
- Nothing on disk to leak or rotate
- Audit trail lives in your cloud account, using controls and services your security team already trusts
- Survive a cluster rebuild with no key ceremony
Audited by Nullreturn. Free to use on TestNet/DevNet with no time limit. Paid commercial licence for MainNet.
Want a walkthrough? DM me or any other member of our team and we’ll grab time. Keen to help support your Canton operations.
launchnodes.com/launchnodes-kms-driver-canton
Originally shared in the Canton Foundation Slack (#cf-outreach).