Your suggested change has been received. Thank you.

close

Suggest A Change

https://thales.na.market.dpondemand.io/docs/dpod/services/kmo….

Thales Logo

All

  • All
back

HPE StoreOnce

Integration with CipherTrust Manager

search

Integration with CipherTrust Manager

This section lists the steps to integrate Integration of HPE Primera with CipherTrust Manager.

Prerequisites

This section provides the prerequisites for integration of HPE StoreOnce with CipherTrust Manager.

  • Ensure that the CipherTrust Manager is installed and configured. For more details, refer to the CipherTrust Manager documentation.

  • HPE StoreOnce communicates with the CipherTrust Manager using the KMIP interface. Ensure that the KMIP interface is configured on the CipherTrust Manager. Refer to CipherTrust Manager Administration Guide for details.

  • IP address of the CipherTrust Manager and port of the KMIP interface must be accessible from the HPE StoreOnce system.

  • CipherTrust Manager recognizes only registered KMIP clients. Ensure that each node of the HPE StoreOnce cluster is registered as a KMIP client on the CipherTrust Manager. Refer to KMIP Client Registration for more details.

Configuration on CipherTrust Manager

To configure the CipherTrust Manager, you need to perform the following steps:

  1. Creating a Domain (optional)

  2. Creating a User

  3. Assigning User to a Group

  4. Registering a KMIP Client

  5. Configuring the KMIP Interface

Creating a Domain (Optional)

Perform the following steps on CipherTrust Manager:

Note

This step is optional and needs to be performed only if you want to integrate within a domain.

  1. Navigate to Admin Settings > Domains.

  2. Click Add Domain. The Add Domain page appears.

  3. Specify the following information:

    • Name - Enter the domain name.

    • Admins - Select the admins (one or more) from the list available in the drop down. For example, admin.

    • Parent CA - Select parent CA as root CA.

    • Allow Subdomain User Management - Select this check box if you want to enable user management in the subdomain through this domain.

  4. Click Save.

  5. Click the current domain name at the top right corner to switch to the newly created domain.

Creating a User

To create a user, perform the following steps:

  1. Log on to the CipherTrust Manager GUI.

  2. Navigate to Access Management > Users.

  3. On the Users page, click Add User.

  4. On the Add User screen, provide the following details:

    • Full Name

    • Username

    • Email

    • Password

    • Password Match

    For more information on creating a user depending on the selected connection type, refer to Managing Users.

  5. Click Add User. The newly created user is listed on the Users page.

To create a user, perform the following steps:

Note

You can only create users in sub domains if you have enabled Allow Subdomain User Management while creating a domain.

  1. Log on to the CipherTrust Manager GUI with the User you created within the Sub Domain.

  2. Navigate to Access Management > Users.

  3. On the Users page, click Create User.

  4. On the Create User screen provide the following details:

    • Enter Username.

    • Enter Password.

  5. Click Create. The newly created user is listed on the Users page.

Assigning User to a Group

Perform the following steps to add user to a group:

  1. Navigate to Access Management > Users.

  2. Select the required User from the list, the respective User details page appears.

  3. Click GROUPS. On the search bar, enter the Key Admins or Key Users group depending on the level of access you want to grant to the user.

  4. Click Add. User is now assigned to the selected Group .

Registering a KMIP Client

You can register a KMIP client on the CipherTrust Manager through:

  • Auto Registration

  • Manual Registration

  1. Create a Registration Token using the following steps:

    1. Log on to the CipherTrust Manager in the root domain.

    2. Go to Access Management > Registration Tokens.

    3. Click Add Registration Token.

    Copy the Registration Token once it is created.

  2. To enable Auto Registration perform the following steps:

    1. Go to Admin Settings > Interfaces.

    2. Select the desired KMIP interface from the list. The corresponding Interface Details page is displayed.

    3. On the Interface Details page, select Auto Registration checkbox to enable Auto Registration.

    4. Paste the Registration Token.

    5. Select the mode as TLS, verify client cert, user name taken from client cert, auth request is optional.

    6. Click Update.

  1. Log on to the CipherTrust Manager.

  2. Go to Products > KMIP.

  3. Create Client Profile using the following steps:

    1. Go to Client Profile and click Add Profile.

    2. Add a Profile Name.

    3. Select CN in Username Location in Certificate.

    4. Click Certificate Details.

    5. Paste the content of client.csr.

    6. Click Save.

  4. Create Registration Token using the following steps:

    1. Navigate to Registration Tokens under Access Management and click Add Registration Token > Begin.

    2. Add a Name Prefix.

    3. Specify a Token Lifetime value along with Certificate Duration, and Client Capacity for the token.

    4. Click Next. You can alternatively click Select CA to proceed further.

    5. Select the CA Type as Local or External depending on the type of CA required.

    6. Select the appropriate CA from the dropdown menu and click Select Profile.

    7. Select the Client Profile from the dropdown which you have created in the above step.

    8. Click Create Token.

    9. Copy the value of the Token created and click Add Token.

    Note

    If you are using External CA then you can select the external CA which was created using openssl and uploaded on the CipherTrust Manager.

  5. Go to Registered Clients and click Add Client.

    • Specify client name and paste the Registration Token generated in the above step.

      Note

      If you are using external CA then you need to paste the signed client certificate in the Client Certificate field.

    • Click Save to save the client certificate.

You can register a KMIP client on the CipherTrust Manager through:

  • Auto Registration

  • Manual Registration

  1. Create a Registration Token in the sub-domain using the following steps:

    1. Log on to the CipherTrust Manager in your specified subdomain.

    2. Go to Access Management > Registration Tokens.

    3. Click Add Registration Token > Begin.

    4. Add a Name Prefix.

    5. Specify a Token Lifetime value along with the Client Capacity for the token.

    6. Copy the value of the Registration Token once it is created.

  2. To enable Auto Registration perform the following steps:

    1. Log on to the CipherTrust Manager in the root domain.

    2. Go to Admin Settings > Interfaces.

    3. Select the desired kmip interface from the list. The respective Interface Detail page appears.

    4. elect Auto Registration.

    5. Paste the Registration Token.

    6. Select the mode as TLS, verify client cert, user name taken from client cert, auth request is optional.

    7. Click Update.

  1. Log on to the CipherTrust Manager into your domain.

  2. Go to Products > KMIP.

  3. Create Client Profile using the following steps:

    1. Go to Client Profile and click Add Profile.

    2. Add a Profile Name.

    3. Select CN in Username Location in Certificate.

    4. Expand the Certificate Details section.

    5. You can either paste the content of a generated client.csr or you can create one, by filling in the details.

      In case of domains, the format to enter the Common Name field for the CSR is: domainName||domainUser

    6. Click Save.

  4. Create a Registration Token using the following steps:

    1. Go to Registration Token and click New Registration Token > Begin.

    2. Add a Name Prefix.

    3. Specify a Token Lifetime value along with the Client Capacity for the token.

    4. Click Select CA.

    5. Select the CA type as Local/External depending on what you are using.

    6. Select the appropriate CA from the dropdown menu and click Select Profile.

    7. Select the Client Profile from the dropdown which you have created in the above step.

    8. Click Create Token.

    9. Copy the value of the Token created and click Done.

  5. If you are using External CA then you can select the external CA which was created using openssl and uploaded on the CipherTrust Manager.

  6. Go to Registered Clients and click Add Client.

    1. Specify client name and paste the Registration Token generated in the above step.

      Note

      If you are using external CA then you need to paste the signed client certificate in the Client Certificate field.

    2. Click Save to save the client certificate.

Configuring the KMIP Interface

The KMIP interface can be configured through:

  1. Go to Admin Settings > Interfaces.

  2. On the KMIP Interface, click the ellipsis button (...) and then click View/Edit.

  3. Select the Auto Registration checkbox if you auto-registered your KMIP client and paste the value of the registration token that you created.

    Note

    By default, Auto Registration is disabled.

  4. Select the mode as TLS, verify client cert, user name taken from client cert, auth request is optional.

  5. Specify selections for Local CA for Automatic Server Certificate Generation as desired.

    Note

    Local CA for Automatic Server Certificate Generation should be set to Turn off auto generation from Local CA in case of External CA.

  6. Select the CA according to your preference:

    • If you are using External CA then select the CA under External Trusted CAs

    • If you are using Local CA then select the CA under Local Trusted CAs

  7. If you are using an External CA, expand the Upload Certificate section:

    • In the Certificate field, paste the contents of Server Certificate, CA, and Server Key file in the same order. Do not introduce any space or character or symbol between the contents of these files.

    • Select certificate Format as PEM.

    • Password field is optional and can be skipped.

    • Click Update.

  1. Switch to Root Domain.

  2. Go to Admin Settings > Interfaces.

  3. On the KMIP Interface, click the ellipsis button (...) and then click View/Edit.

  4. Select the Auto Registration checkbox if you auto-registered your KMIP client and paste the value of the registration token that you created.

    Note

    By default, the Auto Registration is disabled.

  5. Select the mode as TLS, verify client cert, user name taken from client cert, auth request is optional.

  6. Specify selections for Local CA for Automatic Server Certificate Generation as desired.

    Note

    Local CA for Automatic Server Certificate Generation should be set to Turn off auto generation from Local CA in case of External CA.

  7. Select the CA according to your preference.

    1. Login to your sub-domain. Go to CA > Local. Click the ellipsis (...) and copy the contents of your CA Certificate.

    2. Logout of your sub-domain and now login to the root domain.

    3. Go to CA > External > Add External CA.

    4. Enter a name for this Domain CA and select the text radio button and paste the certificate contents.

    5. Click Add External CA.

    6. Go to Admin Settings > Interfaces.

    7. Click the Add icon to add the External CA.

    8. Click Update.

    Note

    If you are using an External CA in the root Domain, you need to add the CA as an External CA in both the root domain as well as the sub-domain and modify the interface accordingly.

    1. Go to Admin Settings > Interfaces.

    2. Click the Add icon to add the External CA.

    3. Click Update.

    4. On the KMIP interface, click the ellipsis (...) > Certificate Options > Upload New Certificate > Ok.

    5. Select the Certificate Chain option and click Build Certificate Chain.

    6. Click on Text and paste the contents of Server Certificate, CA, and Server Key file in the same order. Do not introduce any space, character or symbol between the contents of these files.

    7. Select certificate Format as PEM.

    8. Click on Upload Certificate.

Configuration on HPE StoreOnce

Perform the following steps to integrate HPE StoreOnce with the CipherTrust Manager (CM):

  1. Download the client certificate and corresponding CA from the CM and save them.

  2. Go back to StoreOnce and click Enroll.

  3. Click Backup the key manager configuration, add a password, and click Backup. A backup file gets downloaded.

  4. Click Configure External Key Manager Server and select SafeNet.

  5. Enter the IP address of CM with port and password and click OK.

  6. Click Import Root Certificate and paste the CA certificate that you have downloaded from the CM.

  7. Click Import Signed Certificate and paste the client certificate that you have downloaded from the CM.

  8. Click Enroll and a connection is created with the CM.

  9. On successful integration, two keys will be created on the CM.

On this page