Your suggested change has been received. Thank you.

close
Thales Logo

All

  • All
  • CipherTrust Manager
  • CipherTrust Application Data Protection (CADP)
  • CipherTrust Application Key Management (CAKM)
  • CipherTrust Batch Data Transformation (BDT)
  • CipherTrust Cloud Key Management (CCKM)
  • CipherTrust Data Discovery and Classification (DDC)
  • CipherTrust Data Protection Gateway (DPG)
  • CipherTrust Database Protection (CDP)
  • CipherTrust Intelligent Protection (CIP)
  • CipherTrust Integrations
  • CipherTrust Migrations
  • CipherTrust RESTful Data Protection (CRDP)
  • CipherTrust Transparent Encryption (CTE)
  • CipherTrust Transparent Encryption Userspace (CTE-U)
  • CipherTrust Secrets Management (CSM)
  • CipherTrust Vaulted Tokenization (CT-V)
  • CipherTrust Vaultless Tokenization (CT-VL)
  • CTE-Linux
  • CTE-Windows
  • CTE-AIX
  • CTE-K8s
  • CTE-U
  • Crypto Command Center
  • Data Protection on Demand
  • Luna Cloud HSM
  • Luna Network HSM
  • Luna PCIe HSM
  • Luna USB HSM
  • OneWelcome Identity Platform
  • ProtectApp LUKS
  • ProtectServer 2 HSM
  • ProtectServer 3 HSM
  • SafeNet Trusted Access (STA)
  • SafeNet MobilePASS+
  • SafeNet MobilePASS+ for Android
  • SafeNet MobilePASS+ for Chrome
  • SafeNet MobilePASS+ for macOS
  • SafeNet MobilePASS+ for iOS
  • SafeNet MobilePASS+ for WatchOS
  • SafeNet MobilePASS+ for Windows
  • SafeNet Synchronization Agent
  • SafeNet Logging Agent
  • SafeNet Agent for FreeRADIUS
  • SafeNet Agent for NPS
  • SafeNet Agent for Windows Logon
  • SafeNet Authentication Service Private Cloud Edition (SAS PCE)
  • SafeNet Remote Logging Agent
  • SafeNet Keycloak Agent
  • SafeNet IDPrime Virtual (IDPV)
  • SafeNet FIDO Key Manager
  • SafeNet FIDO Key Manager for Android
  • SafeNet FIDO Key Manager for iOS
  • SafeNet FIDO Key Manager for Windows
back

HPE Primera/Alletra

Integration with CipherTrust Manager

search
printsuggest an editpdf paneldownload

Integration with CipherTrust Manager

This section lists the steps to integrate Integration of HPE Primera with CipherTrust Manager.

copy link to clipboardPrerequisites

This section provides the prerequisites for integration of HPE Primera with CipherTrust Manager.

  • Ensure that the CipherTrust Manager is installed and configured. For more details, refer to the CipherTrust Manager documentation.

  • HPE Primera communicates with the CipherTrust Manager using the KMIP interface. Ensure that the KMIP interface is configured on the CipherTrust Manager. Refer to CipherTrust Manager Administration Guide for details.

  • IP address of the CipherTrust Manager and port of the KMIP interface must be accessible from the HPE Primera system.

  • CipherTrust Manager recognizes only registered KMIP clients. Ensure that each node of the HPE Primera cluster is registered as a KMIP client on the CipherTrust Manager. Refer to KMIP Client Registration for more details.

copy link to clipboardConfiguration on CipherTrust Manager

To configure the CipherTrust Manager, you need to perform the following steps:

  1. Creating a Domain (optional)

  2. Creating a User

  3. Assigning User to a Group

  4. Creating or Adding a CA (optional)

  5. Registering a KMIP Client

  6. Configuring the KMIP Interface

copy link to clipboardCreating a Domain (Optional)

Perform the following steps to be performed on CipherTrust Manager:

  1. Navigate to Admin Settings > Domains.

  2. Click Add Domain. The Add Domain page appears.

  3. Specify the following information:

    • Name - Enter the domain name.

    • Admins - Select the admins (one or more) from the list available in the drop down. For example, admin.

    • Parent CA - Select parent CA as root CA.

    • Allow Subdomain User Management - Select this check box if you want to enable the sub-domain user management through this domain.

  4. Click Save.

  5. Switch to the newly created domain by clicking the top right on the current Domain Name.

copy link to clipboardCreating a User

To create a user, perform the following steps:

  1. Log on to the CipherTrust Manager GUI.

  2. Open the Access Management application.

  3. On the left navigation pane, click Users. The Users page is displayed.

  4. On the Users page, click Add User.

  5. On the Add User page, provide the following details:

    • Select the required Connection Type

    • Select the checkbox against the required Allowed Client Type.

    • Enter Full Name

    • Enter Username

    • Enter the desired Password. Re-enter the password in the Password Match field.

  6. Click Add User. The newly created user will now appear on the Users page.

Note

To create a user in sub-domain, you must enable Allow Subdomain User management.

To create a user, perform the following steps:

  1. Log on to the CipherTrust Manager GUI with the User you created within the sub-domain.

  2. Open the Access Management application.

  3. On the left pane, click Users. The Users page is displayed.

  4. On the Users page, click Add User.

  5. On the Add User page, provide the following details:

    • Select the required Connection Type

    • Select the checkbox against the required Allowed Client Type.

    • Enter Full Name

    • Enter Username

    • Enter Password. Re-enter the password in the Password Match field.

  6. Click Add User. The newly created user will now appear on the Users page.

copy link to clipboardAssigning User to a Group

Perform the following steps to add user to a group:

  1. Navigate to the Users page.

  2. Click the ellipsis button (...) corresponding to the user that you created in the previous step.

  3. Click Edit/View.

  4. Click Group Memberships > Add Group.

  5. In the search bar, enter the desired Group name and select the check box corresponding to it. For example, Key Admins or Key Users.

  6. Click Add Group.

copy link to clipboardCreating or Adding a CA (Optional)

To create/add a Self-signed local CA, perform the following steps:

  1. Navigate to CA > Local. Select Add Local CA, the Add Local CA page appears.

  2. Provide the required information and click Add Local CA. The created Local CA will appear under Pending CAs section.

  3. Click the ellipsis against the Local CA that you created and select the option Self-sign.

  4. Select a valid duration for the Local CA. Click Save.

To add an external CA, perform the following steps:

  1. Navigate to CA > External. The External Certificate Authorities page appears. Select Add External CA, the Add External Certificate page appears.

  2. Provide the required information.

  3. If you want to upload the external CA, select the File Upload option and click Upload Certificate. Browse and select the required External CA.

    OR

    Select Text and paste the contents of External Certificate.

  4. Click Add External CA.

copy link to clipboardRegistering a KMIP Client

You can register a KMIP client on the CipherTrust Manager through:

  • Auto Registration

  • Manual Registration

  1. Log on to the CipherTrust Manager.

  2. Go to Products > KMIP.

  3. Create Client Profile using the following steps:

    1. Navigate to Client Profile and click Add Profile.

    2. Add a Profile Name.

    3. Click Save. The new profile is created.

  4. Create Registration Token using the following steps:

    1. Go to Registration Token and click New Registration Token > Begin.

    2. Add a Name Prefix.

    3. Specify a Token Lifetime value along with the Client Capacity for the token.

    4. Click Select CA.

    5. Select the CA type as Local/External depending on what you are using.

    6. Select the appropriate CA from the dropdown menu and click Select Profile.

    7. Select the Client Profile from the dropdown which you have created in the above step.

    8. Click Create Token.

    9. Copy the value of the Token created and click Done.

    note

    Note

    If you are using External CA then you can select the external CA that you created and uploaded on the CipherTrust Manager.

  5. Turn ON Auto Registration using the following steps:

    1. Go to Admin Settings > Interfaces.

    2. Click the ellipsis button (...) corresponding to the kmip interface.

    3. Click View/Edit.

    4. On the Interface Detail window, perform the following:

      • Select the Interface Mode as TLS, verify client cert, user name taken from client cert, auth request is optional.

      • Select Auto Registration checkbox.

      • Paste the Registration Token.

      • Add the CA (Local or External) to the list of Trusted CAs. The CA will reflect uder the dropdown menu of Local/External Trusted CAs depending upon CA that you created.

      • Click Update.

  1. Log on to the CipherTrust Manager.

  2. Go to Products > KMIP.

  3. Create Client Profile using the following steps:

    1. Go to Client Profile and click Add Profile.

    2. Add a Profile Name.

    3. Select CN in Username Location in Certificate.

    4. Click Certificate Details.

    5. You can either paste the content of a generated client.csr or you can create one, by filling in the required details.

    6. Click Save.

  4. Create Registration Token using the following steps:

    1. Go to Registration Token and click New Registration Token > Begin.

    2. Add a Name Prefix.

    3. Specify a Token Lifetime value along with the Client Capacity for the token.

    4. Click Select CA.

    5. Select the CA type as Local/External depending on what you are using.

    6. Select the appropriate CA from the dropdown menu and click Select Profile.

    7. Select the Client Profile from the dropdown which you have created in the above step.

    8. Click Create Token.

    9. Copy the value of the Token created and click Done.

    note

    Note

    If you are using External CA then you can select the external CA that you created and uploaded on the CipherTrust Manager.

  5. Go to Registered Clients and click Add Client.

    • Specify client name and paste the Registration Token that you generated in the above step.

      note

      Note

      If you are using external CA then you either upload the file using Upload Certificate or paste the signed client certificate in the Client Certificate field.

    • Click Save to save the client certificate.

You can register a KMIP client on the CipherTrust Manager through:

  • Auto Registration

  • Manual Registration

  1. Log on to the CipherTrust Manager into your domain.

  2. Go to Products > KMIP.

  3. Create Client Profile using the following steps:

    1. Navigate to Client Profile and click Add Profile.

    2. Add a Profile Name.

    3. Click Save. The new profile is created.

  4. Create Registration Token using the following steps:

    1. Go to Registration Token and click New Registration Token > Begin.

    2. Add a Name Prefix.

    3. Specify a Token Lifetime value along with the Client Capacity for the token.

    4. Click Select CA.

    5. Select the CA type as Local/External depending on what you are using.

    6. Select the appropriate CA from the dropdown menu and click Select Profile.

    7. Select the Client Profile from the dropdown which you have created in the above step.

    8. Click Create Token.

    9. Copy the value of the Token created and click Done.

    note

    Note

    If you are using External CA then you can select the external CA that you created and uploaded on the CipherTrust Manager.

  5. Turn ON Auto Registration using the following steps:

    1. Go to Admin Settings > Interfaces.

    2. Click the ellipsis button (...) corresponding to the kmip interface.

    3. Click Edit.

    4. On the Interface Detail window, perform the following:

      • Select the Interface Mode as TLS, verify client cert, user name taken from client cert, auth request is optional.

      • Select Auto Registration checkbox.

      • Paste the Registration Token.

      • Add the CA (Local or External) to the list of Trusted CAs. The CA will reflect uder the dropdown menu of Local/External Trusted CAs depending upon CA that you created.

      • Click Update.

  1. Log on to the CipherTrust Manager into your domain.

  2. Go to Products > KMIP.

  3. Create Client Profile using the following steps:

    1. Go to Client Profile and click Add Profile.

    2. Add a Profile Name.

    3. Select CN in Username Location in Certificate.

    4. Expand the Certificate Details section.

    5. You can either paste the content of a generated client.csr or you can create one, by filling in the required details.

      For domain, the format to enter the Common Name field of the cert is always: domainName||domainUser

    6. Click Save.

  4. Create a Registration Token using the following steps:

    1. Go to Registration Token and click New Registration Token > Begin.

    2. Add a Name Prefix.

    3. Specify a Token Lifetime value along with the Client Capacity for the token.

    4. Click Select CA.

    5. Select the CA type as Local/External depending on what you are using.

    6. Select the appropriate CA from the dropdown menu and click Select Profile.

    7. Select the Client Profile from the dropdown which you have created in the above step.

    8. Click Create Token.

    9. Copy the value of the Token created and click Done.

  5. If you are using External CA then you can select the external CA which you created earlier. Refer to External CA under Creating or Adding a CA.

  6. Go to Registered Clients and click Add Client.

    1. Specify client name and paste the Registration Token generated in the above step.

      note

      Note

      If you are using external CA then you need to paste the signed client certificate in the Client Certificate field.

    2. Click Save to save the client certificate.

copy link to clipboardConfiguring the KMIP Interface

The KMIP interface can be configured through:

  1. Go to Admin Settings > Interfaces.

  2. On the KMIP Interface, click the ellipsis button (...) and then click View/Edit.

  3. Select the Auto Registration checkbox if you auto-registered your KMIP client and paste the value of the registration token that you created.

    Note

    By default, the Auto Registration is disabled.

  4. Select the mode as TLS, verify client cert, user name taken from client cert, auth request is optional.

  5. Specify selections for Local CA for Automatic Server Certificate Generation as desired.

    note

    Note

    Local CA for Automatic Server Certificate Generation should be set to Turn off auto generation from Local CA in case of External CA.

  6. Select the CA according to your preference:

    • If you are using Local CA then select the CA under Local Trusted CAs

    • If you are using External CA then select the CA under External Trusted CAs provided you have the external CA that you created and uploaded on the CipherTrust Manager. For more information on creating or uploading CA, refer to Creating or Adding a CA.

  1. Select the CA according to your preference.

    1. Login to your sub-domain. Go to CA > Local. Click the ellipsis (...) and copy the contents of your CA Certificate.

    2. Logout of your sub-domain and now login to the root domain.

    3. Go to CA > External > Add External CA.

    4. Enter a name for this Domain CA and select the text radio button and paste the certificate contents.

    5. Click Add External CA.

    6. Go to Admin Settings > Interfaces.

    7. Click the Add icon to add the External CA.

    8. Click Update.

    Note

    If you are using an External CA in the Sub-Domain, you need to add the CA as an External CA in both the root domain as well as the sub-domain and modify the interface accordingly.

    1. Login to your sub-domain. Go to CA > Local. Click the ellipsis (...) and copy the contents of your CA Certificate.

    2. Logout of your sub-domain and now login to the root domain.

    3. Go to CA > External > Add External CA.

    4. Enter a name for this Domain CA and select the text radio button and paste the certificate contents.

    5. Click Add External CA.

    6. Go to Admin Settings > Interfaces.

    7. Click the Add icon to add the External CA.

    8. Click Update.

    9. On the KMIP interface, click the ellipsis (...) > Certificate Options > Upload New Certificate > Ok.

    10. Select the Certificate Chain option and click Build Certificate Chain.

    11. Click on Text and paste the contents of Server Certificate, CA, and Server Key file in the same order. Do not introduce any space, character or symbol between the contents of these files.

    12. Select certificate Format as PEM.

    13. Click on Upload Certificate.

  2. On the KMIP Interface, click the ellipsis button (...) and then click View/Edit.

  3. Select the Auto Registration checkbox if you auto-registered your KMIP client and paste the value of the registration token that you created.

    Note

    By default, the Auto Registration is disabled.

  4. Select the mode as TLS, verify client cert, user name taken from client cert, auth request is optional.

  5. Specify selections for Local CA for Automatic Server Certificate Generation as desired.

    note

    Note

    Local CA for Automatic Server Certificate Generation should be set to Turn off auto generation from Local CA in case of External CA.

copy link to clipboardConfiguration on HPE Primera/Alletra

This section provides the steps to integrate HPE Primera/Alletra with the CipherTrust Manager.

  1. Log into the HPE Primera/Alletra using the CLI.

  2. Start importing your certs one by one using the following steps:

    • Import the CA used to sign the Client Certificate by using

      importcert ekm-client –ca stdin

    • Import the Client Certificate onto Primera by using the following command:

      importcert ekm-client stdin

    • Import the CA used to sign the Server Certificate by using the following command:

      importcert ekm-server -ca stdin

  3. Reply yes to the question about importing the signed certificate.

  4. Once all the certificates have been uploaded, run showcert again to verify.

  5. To enable encryption on the array, run the following command:

    controlencryption setekm
–setserver <IP of CipherTrustManager>
-port <Port being used for KMIP>
-ekmuser <User created on CipherTrustManager>
-kmipprotocols <KMIP Protocol Version>

  6. Navigate to the SSMC GUI and confirm that the EKM has been configured properly and the setting are correct. System > Actions > CheckEKM servers.

  7. If the setting are in order, you receive a pop-up confirming the same.

  8. Navigate to System > Actions > Enable Encryption.

  9. Enter the password to access the EKM.

  10. Accept the implications and click on Yes to enable encryption.

  11. You will find a new key created on CipherTrust Manager. You should also be able to see the creation of the key in the CipherTrust Manager Audit Logs.

This completes the integration of HPE Primera with CipherTrust Manager.

On this page