Updates

Author: msmbaldwin

articles/key-vault/managed-hsm/tls-offload-library.md

@@ -18,9 +18,9 @@ For more information, see [Azure Managed HSM TLS Offload Library GitHub](https:/
 
 The TLS Offload Library internally uses the Azure Key Vault REST API to interact with Azure Managed HSM.
 
-## Get Started
+## Get started
 
-### PKCS#11 Attributes
+### PKCS#11 attributes
 
 To properly integrate with PKCS#11, generating keys (via C_GenerateKeyPair) and locating key objects (via C_FindObjectsInit/C_FindObjects) requires a solution for storing PKCS#11 attributes on the Azure Key Vault key object. The TLS Offload Library converts these necessary PKCS#11 attributes into Azure Key Vault Tags.
 
@@ -35,7 +35,7 @@ Applications that use the TLS Offload Library use one or more PKCS#11 attributes
 > [!WARNING]
 > Keys generated by the TLS Offload Library and their Tags are accessible over Azure Key Vault REST API. Manipulating these P11 Attribute Tags using Azure Key Vault REST API may break the TLS Offload Library applications.
 
-### Key Generation
+### Key generation
 
 The TLS Offload Library includes a key creation tool, mhsm_p11_create_key. Running the tool without any command line arguments shows the correct usage of the tool.
 
@@ -61,7 +61,7 @@ The `--label` argument to the key creation tool specifies the desired CKA_LABEL
 
 You need the key name for any role assignment changes via the Azure CLI.
 
-### Access Control
+### Access control
 
 The TLS Offload Library translates the C_FindObjectsInit into an Azure Key Vault REST API call, which operates at the /keys scope. The MHSM service requires the Read permission at this scope for the TLS Offload Library User to authorize the find operation for the keys created via the key creation tool.
 
@@ -91,9 +91,9 @@ The key generation service principal is used with the key creation tool (mhsm_p1
 
 #### Azure CLI
 
-Azure CLI can be used to perform tasks such as Role Assignment.
+Azure CLI can be used to perform tasks such as role assignment.
 
-### Permissive Approach
+### Permissive approach
 
 The permissive approach is simpler, and suitable when the Azure Managed HSM is exclusively used for TLS offloading.
 
@@ -106,13 +106,13 @@ az keyvault role assignment create --hsm-name ContosoMHSM \
 --scope /keys
 ```
 
-### Granular Approach
+### Granular approach
 
 The granular approach implements fine grained access control. It requires two service principals (TLS Offload service principal and Key Generation service principal) and an Admin User.
 
 The objective is to restrict the TLS Offload service principal's permissions to support the minimum required for TLS offload. The user must have the Read permission for other keys to support the library's C_FindObject* function.
 
-#### TLS Offload Library User Read Role
+#### TLS Offload Library User Read role
 
 The first step in implementing the granular approach is to create a custom role. This operation only needs to be done once.
 
@@ -129,11 +129,11 @@ az keyvault role definition create --hsm-name ContosoMHSM --role-definition '{ \
 }'
 ```
 
-#### Generate Keys
+#### Generate keys
 
 Keys can be generated using the Key Generation service principal with the key creation tool (mhsm_p11_create_key).
 
-#### Grant Permission
+#### Grant permission
 
 The Admin User assigns the following roles to the TLS Offload service principal.
 - Assign "TLS Library User Read Role" role at the "/keys" scope
@@ -153,11 +153,11 @@ az keyvault role assignment create --hsm-name ContosoMHSM  \
 --scope /keys/p11-6a2155dc40c94367a0f97ab452dc216f
 ```
 
-## How To
+## Using the TLS Offload Library
 
-### How to generate keys using the TLS Offload Library
+### Generate keys
 
-The TLS Offload Library includes a key creation tool -  mhsm_p11_create_key. Running the tool without any command line arguments shows the correct usage of the tool.
+The TLS Offload Library includes a key creation tool, mhsm_p11_create_key. Running the tool without any command line arguments shows the correct usage of the tool.
 
 The key creation tool requires a service principal, which is assigned to the "Managed HSM Crypto User" role at the "/keys" scope.
 
@@ -181,7 +181,7 @@ The `--label` argument to the key creation tool specifies the desired CKA_LABEL
 
 The key name is required if you're planning to implement granular access to keys.
 
-### How to implement keyless TLS
+### Implement keyless TLS
 
 There are two approaches to generating a key and using the key for the Key Less TLS: a simpler, more permissive approach, and a granular approach, which offers better security. The approaches differ in implementation effort and security enforcement.