Google Cloud Deployment

You can deploy a CipherTrust Manager instance in Google Cloud.

Minimum Requirements

To deploy a CipherTrust Manager instance, the following minimum requirements apply:

• System volume: 50 GB for evaluation, 100 GB for production

• Memory: 16 GB

• vCPUs: 2

• NICs: 1

Deploying in Google Cloud

This section provides the steps for deploying a Virtual CipherTrust Manager instance from the Google Cloud Marketplace. Refer to the Google Cloud Platform documentation for general information on launching a VM in Google Cloud.

Prerequisite

If you wish to set a static IP for your Virtual CipherTrust Manager instance, you must reserve a static external IP address for your project before launching the VM. Consult Google documentation to do so.

To launch a CipherTrust Manager instance

1. Using your gmail address, sign in to the Google Cloud Platform.

2. In the Google Cloud Platform top banner, select a project or create a new one.

   

   To create a New Project:

   1. Select New Project.

      

   2. Enter a Project Name and Project ID.

   3. Enter a Location if you already have a parent organization you want to use.

   4. Select Create.

      The project's DASHBOARD appears.

3. Navigate to the Google Cloud Marketplace and search for "CipherTrust Manager" images.

4. On the results, select CipherTrust Manager Community Edition.

5. Select Launch.

6. To create a CipherTrust Manager instance, review and modify these fields as needed:

   1. Enter a Deployment name for the instance.

   2. Select the Zone closest to your location.

   3. Review that the Machine type is e2-standard-4 (4vCPU, 16 GB memory), which is optimized for Virtual CipherTrust Manager. If you want to change the Machine type, make sure the selection is in keeping with the minimum requirements.

   4. Review Boot disk type and Boot disk size in GB. The default of Standard Persistent Disk and 100 fulfill the minimum requirements of the image.

   5. If desired, in the Network interface section External IP drop down, you can select any static IP which is reserved for your project. Consult Google documentation on reserving a static IP address for a project.

      Note

      After launching the VM, you can confirm the static IP was applied using the nmcli tool in an SSH session.

   6. In the Firewall section, ensure that checkboxes for Allow HTTP traffic and Allow HTTPS traffic are enabled.

   7. Enable the checkbox to accept the GCP Marketplace Terms of Service and Thales - European Union - Frankfurt Terms of Service.

7. Select Deploy to launch the instance.

   Your new virtual CipherTrust Manager is created and appears in Deployment Manager.

   

8. Click on the Site address for the newly created vCM.

   A new browser tab opens to this address and the CipherTrust Manager web page appears.

9. You are prompted to enter an SSH key to authenticate the ksadmin user in an SSH session.

   

   Note

   We support OpenSSH for the public key format. The corresponding private key can be OpenSSH, PKCS1, or PKCS8 format. You can generate this key pair using 'PuTTYgen' or similar utility. Save this SSH Public Key at a safe location. You will need this key for future SSH access.

   After replacing the default SSH Public Key, the Log In screen appears. For more options to replace the default SSH Public Key, see Starting Services After Deployment.

10. Log in using the initial default credentials for the root administrator: Username = admin, Password = admin

    The following notice is displayed:

    

    Note

    If the default credentials do not work, you may need to retrieve an autogenerated password, as described in Changing the Initial Password.

11. Enter a new password using this default Password Policy:

    Min length: 8
    Max length: 30
    Min number of upper cases: 1
    Min number of lower cases: 1
    Min number of digits: 1
    Min number of other characters: 1
    

    A new Login screen appears.

12. Using your new password, log in again. The CipherTrust Manager Web Page appears.

    

13. At this point, it's strongly recommended to configure an NTP server.

    1. Navigate to Admin Settings > NTP.

    2. Enter in an NTP Server hostname.

    3. For an authenticated NTP Server, enter in a symmetric key value in the NTP Key field.

    4. Click the +Add NTP Server button.

    See Network Time Protocol Server Configuration for more details.

Congratulations! You have successfully deployed a CipherTrust Manager instance.

SSH Access to the New Instance

If using a Windows client, use PuTTY or similar utility to SSH to your CipherTrust Manager instance as KeySecure Administrator (ksadmin). If needed, use PuTTYgen or similar utility to format the SSH Key Pair.

If using a Linux client use SSH to login as KeySecure Administrator (ksadmin).