Integrate Entrust KeyControl with HPE StoreOnce

Follow these steps to register Entrust KeyControl as a KMS in HPE Alletra 5000.

Follow these steps to install and configure KeyControl.

  1. Create the HPE Alletra certificate request.

  2. Create the client certificate bundle.

  3. Import tenant client certificate into Alletra.

  4. Register the Entrust KeyControl KMS.

Create the HPE Alletra certificate request

  1. Log into the Alletra 5030 webGUI using an account with Security Admin privileges.

  2. Select Administration in the toolbar.

  3. Select the Security tab and then SSL Certificates from he left-hand menu.

  4. Select the + icon to add a certificate.

  5. Select Generate a certificate signing request (CSR) from the Select an action drop-down list.

    create csr 5030

  6. Enter the Name and other required information. You can leave all the other values as the defaults.

  7. Select GENERATE.

  8. Select Copy PEM in the Confirmation dialog.

    copy pem 5030

  9. Create a .csr file type with a text editor containing the copied certificate request. If you are using Notepad as your text editor, you might need to rename the file using the Windows CLI to get the correct file type extension.

    create csr file 5030

Create the client certificate bundle

  1. Sign in to the KMIP Vault with the URL and credentials from Create a KMIP Vault in teh Entrust KeyControl.

  2. Select Security, then Client Certificates.

    kc securityclientcert

  3. In the Manage Client Certificate page, select the + icon on the right to create a new certificate. The Create Client Certificate dialog box appears.

  4. In the Create Client Certificate dialog box:

    1. Check Add Authentication for Certificate.

    2. Enter the User Name on Certificate.

    3. Enter the User Password on Certificate.

    4. Enter the Certificate Expiration.

    5. Upload the certificate request created in Create the HPE Alletra certificate request.

    6. Select Create.

    For example:

    kc create cert 5030

    The new certificates are added to the Manage Client Certificate pane.

    kc new cert 5030

  5. Select the certificate and select the Download icon to download the certificate.

  6. Unzip the downloaded file. It contains the following:

    • A certname.pem file that includes both the client certificate and private key. In this example, this file is called HPEAlletra5030User.pem.

      The client certificate section of the certname.pem file includes the lines -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- and all text between them.

      The private key section of the certname.pem file includes the lines -----BEGIN PRIVATE KEY----- and -----END PRIVATE KEY----- and all text in between them.

    • A cacert.pem file which is the root certificate for the KMS cluster. It is always named cacert.pem.

    kc new cert unzipped 5030

See the following link for additional information Managing KMIP Tenant Client Certificates.

Import tenant client certificate into Alletra

To import tenant client certificate into Alletra:

  1. Log into the Alletra 5030 webGUI using an account with Security Admin privileges.

  2. Select Administration in the toolbar. Then select Security > SSL Certificates.

  3. Select the + icon to add a certificate.

  4. Select Input a CA signed certificate in the Select and action drop-down text box.

  5. Paste the content of the extracted cacert.pem file from Create the client certificate bundle in the Paste the CA Certificate Chain in PEM format text box.

    paste ca cert chain 5030

  6. Paste the content of the extracted HPEAlletra5030User.pem file from Create the client certificate bundle in the Paste the Signed Certificate in PEM format text box. Then select Save.

    paste signed cert 5030

    The custom and custom-ca certificates are added.

    custom ca 5030

Register the Entrust KeyControl KMS

To register the Entrust KeyControl KMS:

  1. Log into the Alletra 5030 webGUI using an account with Security Admin privileges.

  2. Select Administration in the toolbar. Then select Security > Encryption.

  3. Select the External Key Manager radio button. Then select Add Key Manager.

  4. Enter Name, Description, KeyControl cluster Hostname, and the credential for the certificate authentication in Create the client certificate bundle. Then select Save.

    Notice the DNS entry created in Create DNS record for Entrust KeyControl cluster in Hostname of IP Address text box.
    register cluster 5030

    The external key manager is added.

    external key manager 5030