Procedures

Download the KeyControl software from https://my.hytrust.com/s/software-downloads. This software is available both as an OVA or ISO image. The OVA installation method in VMware is used in this guide for simplicity.

Install KeyControl as described in KeyControl OVA Installation.

Configure the first KeyControl node as described in Configuring the First KeyControl Node (OVA Install).

Add second KeyControl node to cluster as described in Adding a New KeyControl Node to an Existing Cluster (OVA Install).

Install the KeyControl license as described in Managing the KeyControl License.

Create a single DNS record named EntrustKeyControl in the domain.

Assign this record as many IPs as nodes in the cluster created above, two in this integration.

Log into the KeyControl webGUI using an account with Security Admin privileges.

Select KMIP in the menu bar in the KeyControl webGUI. Then select the Settings tab.

For State, select Enable. Take the default for all other parameters. Then select Apply.

In the Overwrite all existing KMIP Server settings? dialog, select Proceed.

Log into the KeyControl webGUI using an account with Security Admin privileges.

Select KMIP in the menu bar in the KeyControl webGUI. Then select the Tenants tab.

Select Actions > Create a KMIP Tenant. The Create a KMIP Tenant dialog appears

On the About tab, enter the name and description. Then select Next.

On the Authentication tab, select Local User Authentication, see Authentication. Then select Next.

On the Admin tab, enter the Administrator information. Then select Create.

Select the newly-created tenant and scroll down to see the tenant information. To test the tenant, select the Tenant Login URL and log in with the credentials above.

Log into the Alletra 6030 webGUI using an account with Security Admin privileges.

Select Administration in the toolbar. Then select Security > SSL Certificates.

Select the + icon to add a certificate.

Select Generate a certificate signing request (CSR) in the Select and action drop-down text box.

Enter the Name and other required information. All defaults were selected in this integration. Then select GENERATE.

Select the certificate created. Then select View.

Select Copy PEM in the Confirmation dialog.

Create a .csr file type with a text editor containing the copied certificate request. If you use the Notepad text editor, you may need to rename the file using the Windows CLI to get the correct file type extension.

Log into the KeyControl webGUI using an account with Security Admin privileges.

Select KMIP in the menu bar in the KeyControl webGUI. Then select the Tenants tab.

Highlight the required tenant. Scroll down and select the link on Tenant Login. A new tab opens in the browser.

Log in with the tenant credentials.

Select Security > Client Certificates.

Select the + icon on right top corner to create new client certificate.

Check Add Authentication for Certificate in the Create Client Certificate dialog.

Enter the authentication credentials and Certificate Expiration date. Upload the .csr file created in Create the HPE Alletra certificate request. Then select Create.

Select the certificate bundle created and select Download.

Extract the two files from the zip bundle.

Log into the Alletra 6030 webGUI using an account with Security Admin privileges.

Select Administration in the toolbar. Then select Security > SSL Certificates.

Select Input a CA signed certificate in the Select and action drop-down text box.

Paste the content of the extracted cacert.pem file from Create the tenant client certificate bundle in the Paste the CA Certificate Chain in PEM format text box.

Paste the content of the extracted HPEAlletra6030User.pem file from Create the tenant client certificate bundle in the Paste the Signed Certificate in PEM format text box. Then select Save.

Log into the Alletra 6030 webGUI using an account with Security Admin privileges.

Select Administration in the toolbar. Then select Security > Encryption.

Select the External Key Manager radio button. Then select Add Key Manager.

Enter Name, Description, KeyControl cluster Hostname, and the credential for the certificate authentication in Create the tenant client certificate bundle. Then select Save.

Power down the KeyControl nodes one at a time and verify the External Key Manager still shows Connected + Active as above.

Power down both KeyControl nodes and verify the External Key Manager shows Disconnected + Active.