Mantieni tutto organizzato con le raccolte
Salva e classifica i contenuti in base alle tue preferenze.
Questo argomento descrive come recuperare la chiave di verifica (EKPub) da un'istanza VM schermata.
Puoi recuperare la chiave di approvazione sia per la chiave di crittografia che per la chiave di firma. Puoi utilizzare la chiave di crittografia per criptare i dati in modo che solo il vTPM sia in grado di leggerli, oppure la chiave di firma per verificare le firme eseguite dal vTPM. Puoi anche utilizzare la chiave per accertare l'identità di un'istanza VM prima di inviare ad essa informazioni sensibili.
Devi disporre dell'autorizzazione getShieldedInstanceIdentity per recuperare le chiavi di verifica.
Recupero delle chiavi di verifica mediante Google Cloud CLI
Utilizza il comando gcloud compute instances get-shielded-identity per recuperare la porzione pubblica della chiave di verifica da un'istanza VM schermata.
encryptionKey:
ekPub: |
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4ucWqhLjIkcEJyqc8KJM
12345678abcdefghijklmnopqrstuvwxyz12345678abcdefghijklmnopqrstu
oBSrm0swIu3x4LWR/Ebl5KA0EKe9YFGaS9Pguun1m6X8Ld2zAqmoIwnxDiOqxQEU
mx2wxkjf0bbjxG5ZI1i3t/c/QzeaE2WWTlKdgnUDyxSloDBq63yywtoIrp1nbDLj
X8qdBymixu8jXXp1iGwmEUltnEnx779JKTpKgKTEednri+NcfRmXHrnPCxfiPudQ
4wIDAQAB
-----END PUBLIC KEY-----
kind: compute#shieldedInstanceIdentity
signingKey:
ekPub: |
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzQvcD+2LAnsXAgdsVYAc
12345678abcdefghijklmnopqrstuvwxyz12345678abcdefghijklmnopqrstu
V/7WHasUuGlkbqiDOuDWgb15FAn35PU64HGey67McZTUT9EvrkT/ryXi4kZgBtoM
lQIDAQAB
-----END PUBLIC KEY-----
Recupero delle chiavi di verifica mediante l'API di Compute Engine
Puoi utilizzare l'API Compute Engine per visualizzare le informazioni relative alla chiave di verifica. Per ulteriori informazioni su come utilizzare l'API, consultare le guide illustrative .
[[["Facile da capire","easyToUnderstand","thumb-up"],["Il problema è stato risolto","solvedMyProblem","thumb-up"],["Altra","otherUp","thumb-up"]],[["Difficile da capire","hardToUnderstand","thumb-down"],["Informazioni o codice di esempio errati","incorrectInformationOrSampleCode","thumb-down"],["Mancano le informazioni o gli esempi di cui ho bisogno","missingTheInformationSamplesINeed","thumb-down"],["Problema di traduzione","translationIssue","thumb-down"],["Altra","otherDown","thumb-down"]],["Ultimo aggiornamento 2025-09-04 UTC."],[[["\u003cp\u003eThis guide outlines the process of retrieving the endorsement key (EKPub) from a Shielded VM instance, including both encryption and signing keys.\u003c/p\u003e\n"],["\u003cp\u003eThe encryption key obtained can be used to encrypt data readable only by the vTPM, while the signing key can verify vTPM-generated signatures, and both keys can verify VM instance identity.\u003c/p\u003e\n"],["\u003cp\u003eRetrieving these endorsement keys requires the \u003ccode\u003egetShieldedInstanceIdentity\u003c/code\u003e permission.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003egcloud compute instances get-shielded-identity\u003c/code\u003e command can be used via the Google Cloud CLI, or alternatively the Compute Engine API can be leveraged to retrieve the endorsement keys, both returning similar results.\u003c/p\u003e\n"]]],[],null,["# Retrieving endorsement keys\n\nThis topic describes how to retrieve the endorsement key (EKPub) from a\nShielded VMinstance.\n\nYou can retrieve the endorsement key for both the encryption key and the signing\nkey. You can use the encryption key to encrypt data so that only the vTPM can\nread it, or the signing key to verify signatures that the vTPM makes. You can\nalso use the key to ascertain the identity of a VM instance before sending\nsensitive information to it.\n\nYou must have the `getShieldedInstanceIdentity` permission to retrieve\nendorsement keys.\n\nRetrieving endorsement keys using the Google Cloud CLI\n------------------------------------------------------\n\nUse the `gcloud compute instances get-shielded-identity` command to retrieve\nthe public portion of the endorsement key from a Shielded VM instance. \n\n gcloud compute instances get-shielded-identity [INSTANCE_NAME]\n\nThe results returned look similar to the following: \n\n```\nencryptionKey:\n ekPub: |\n -----BEGIN PUBLIC KEY-----\n MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4ucWqhLjIkcEJyqc8KJM\n 12345678abcdefghijklmnopqrstuvwxyz12345678abcdefghijklmnopqrstu\n oBSrm0swIu3x4LWR/Ebl5KA0EKe9YFGaS9Pguun1m6X8Ld2zAqmoIwnxDiOqxQEU\n mx2wxkjf0bbjxG5ZI1i3t/c/QzeaE2WWTlKdgnUDyxSloDBq63yywtoIrp1nbDLj\n X8qdBymixu8jXXp1iGwmEUltnEnx779JKTpKgKTEednri+NcfRmXHrnPCxfiPudQ\n 4wIDAQAB\n -----END PUBLIC KEY-----\nkind: compute#shieldedInstanceIdentity\nsigningKey:\n ekPub: |\n -----BEGIN PUBLIC KEY-----\n MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzQvcD+2LAnsXAgdsVYAc\n 12345678abcdefghijklmnopqrstuvwxyz12345678abcdefghijklmnopqrstu\n V/7WHasUuGlkbqiDOuDWgb15FAn35PU64HGey67McZTUT9EvrkT/ryXi4kZgBtoM\n lQIDAQAB\n -----END PUBLIC KEY-----\n```\n\nRetrieving endorsement keys using the Compute Engine API\n--------------------------------------------------------\n\nYou can use the Compute Engine API to view endorsement key information. For\nmore information on how to use the API, see the [How-to guides](/compute/docs/api/how-tos/how-tos). \n\n GET /compute/v1/projects/[PROJECT_ID]/zones/[ZONE]/instances/[INSTANCE_NAME]/getShieldedInstanceIdentity\n\n {\n \"signingKey\": {\n \"ekPub\": [PEM-formatted key]\n },\n \"encryptionKey\": {\n \"ekPub\": [PEM-formatted key]\n },\n \"kind\": \"compute#shieldedInstanceIdentity\"\n }\n\nWhat's next\n-----------\n\n- Learn about [modifying options on a Shielded VM instance](/compute/shielded-vm/docs/modifying-shielded-vm).\n- Learn about one approach to [automating responses to integrity monitoring events](/compute/shielded-vm/docs/automating-responses-integrity-failures)."]]
