Getting started with external key management

See ThinkSystem System Manager online help for conceptual information on using external key management servers and security keys. The following graphic shows the basic workflow for implementing external security keys:

Workflow steps

Both certificate management and external key management are new security features with the ThinkSystem SAN OS. To get started, use the following basic steps:

1. Generate a Certificate signing request using the

   save storageArray keyManagementClientCSR command. See Generate Key Management Certificate Signing Request (CSR) .

2. From the KMIP server, request a client and a server certificate.

3. Install the client certificate using the

   download storageArray keyManagementCertificate command with the certificateType parameter set to client . See Install storage array external key management certificate .

4. Install the server certificate using the

   download storageArray keyManagementCertificate command with the certificateType parameter set to server . See Install storage array external key management certificate .

5. Set the IP address and port number of the key management server using the

   set storageArray externalKeyManagement command. See Set external key management settings .

6. Test communication with the external key management server using the

   start storageArray externalKeyManagement test command. See Test external key management communication .

7. Create a security key using the

   create storageArray securityKey command. See Create storage array security key .

8. Validate the security key using the

   validate storageArray securityKey command. See Validate storage array security key .