Keeper Encrypter
Deploy the Keeper Encrypter service for Keeper Cloud Security integrations.
Keeper Encrypter preserves Keeper's zero-knowledge architecture for Cloud Security integrations. It provides a secure, self-hosted path for CNAPP findings and remediation status.
Why Keeper Encrypter exists
CNAPP providers send findings into Keeper. Keeper returns remediation status after an admin takes action. Keeper Encrypter handles that exchange without moving customer decryption into Keeper's cloud.
How it works
It runs as a Docker container in your environment.
It receives inbound webhook traffic from the CNAPP provider.
It encrypts integration payloads with a customer-managed 256-bit key stored in Keeper.
The service authenticates with Keeper using the device configuration you generate during setup. It reads the CNAPP configuration it needs through Keeper Secrets Manager. This keeps the integration aligned with Keeper's zero-knowledge model.
Setup
Configure DNS, SSL/TLS for Encrypter
Encrypter must be reachable by a public DNS host (subdomain suggested) that is configured by the customer. Inbound HTTPS traffic from Keeper and CNAPP provider's webhook must be routed to Encrypter.
Customer configures a public DNS host/subdomain. For example:
https://encrypter.customer-domain.com/Customer configures a load balancer for SSL/TLS termination that forwards inbound traffic on port 443 (HTTPS) to Encrypter's default port 80 (HTTP).
Configure load balancer to use Encrypter's health check endpoint at
/health.
Provision a gateway for Encrypter
Select the same Keeper Secrets Manager application that is used by the PAM Configuration that's being linked to a CNAPP provider.
Select Gateways tab.
Click Provision Gateway button.
Enter the Gateway Name.
Select Configuration as the Gateway initialization method.
Select Linux configuration.
For Config Type, select Base64.
Save the configuration for use as
DEVICE_CONFIGbelow.
Last updated