Your suggested change has been received. Thank you.

close

Suggest A Change

https://thales.na.market.dpondemand.io/docs/dpod/services/kmo….

Thales Logo
back

NetApp ONTAP Data Management Software

Appendix

search

Appendix

Troubleshooting

This section describes the how to troubleshoot the issue that you may encounter while integrating CipherTrust Manager with ONTAP.

IssueError MessageRemediation
KMIP registration is not enabledThe following error message is displayed in CipherTrust Records:
"errorMessage": "Unregistered client, please register a new client from CLI or API or UI."		Check whether the KMIP registration is completed or not in Admin Settings > System > Interfaces > kmip.
If it is not completed, complete it by using the steps mentioned in Appendix.
User corresponding to username location in certificate (example: CN) has not been created
CN = Common Name		The following error messages are displayed in CipherTrust Records:
*"errorMessage": "username not found: "
"errorMessage": "Could not authenticate certificate user, *		Check whether the user corresponding to CN of the client certificates has been created in Keys & Access Management > Users.
If the user is not created, create a new user with the same name as the CN field of the client certificates. After creating the user, add this user to the Key Admins and Key Groups.
Refer to steps mentioned in
User has not been added to Key Admin groupThe following error message is displayed in CipherTrust Records:
"errorMessage": "authorization denied: verdict was deny: CreateKey"		Check whether the user corresponding to CN of the client certificates has been created under Keys & Access Management > Users.
If the user is not added, add the user to the Key Admins group.
The Username location in Certificate has been set incorrectlyThe following error messages are displayed in CipherTrust Records:
"errorMessage": "username not found: "
"errorMessage": "Could not authenticate certificate user,		Check whether the Username Location in the Certificate option is set correctly to CN in Admin Settings > System > Interfaces > kmip.
If it is not set correctly, set the correct value for the Username Location in the Certificate.

KMIP client Registration

Registering a KMIP Client

You need to switch the domain before performing this operation.

You can register a KMIP client on the CipherTrust Manager using:

Using Auto-Registration

  1. Create a registration token using the following steps:

    1. Log on to the CipherTrust Manager.

    2. Go to Access Management > Registration Tokens in the sidebar.

    3. Click Create New Registration Token.

  2. Copy the Registration Token once it is created.

  3. Turn ON Auto Registration using the following steps:

    1. Go to Admin Settings > Interfaces.

    2. Click the ellipsis icon corresponding to the KMIP interface.

    3. Click Edit.

    4. Under the Configure KMIP window, select Auto Registration.

    5. Paste the Registration Token.

    6. Select the mode as TLS, verify client cert, user name taken from client cert, auth request is optional.

    7. Click Update.

Using Manual Registration

  1. Log on to the CipherTrust Manager.

  2. Go to Products > KMIP.

  3. Create a Client Profile using the following steps:

    1. Go to Client Profile and click Add Profile.

    2. Add a Profile Name.

    3. Select CN in Username Location in Certificate.

    For Domain, the CN will be domain||username.

    1. Click Certificate Details.

    2. Paste the content of the generated client.csr.

    3. Click Save.

  4. Create a Registration Token using the following steps:

    1. Go to Registration Token and click New Registration Token > Begin.

    2. Add a Name Prefix.

    3. Click Select CA.

    4. Select the CA type as Local if you are using Local CA or select external if you are using External CA.

    5. Select appropriate CA from the dropdown menu and click Select Profile.

    6. Select the Client Profile from the dropdown which you have created.

    7. Click Create Token.

    8. Copy the Token value and click Done.

    If you are using an external CA then you can select the external CA which was created using openssl and uploaded on the CipherTrust Manager.

  5. Go to Registered Clients and click Add Client. Specify the client's name and paste the generated Registration Token.

    If you are using an external CA then you need to paste the signed client certificate in the Client Certificate field.

  6. Click Save > Save Certificate to save the Client Certificate.