Test the integration by enabling data-at-rest encryption

Log into the Nutanix Prism Element web UI.

Select the Settings pull-down menu in the toolbar, scroll down, and select Settings again. The Gear icon in the top right of the toolbar does the same operation.

Select Data-at-rest Encryption under Security on the Settings left pane. Then select Edit Configuration or Continue Configuration.

Select An external KMS.

Scroll down to Certificate Signing Request Information. Fill the request form, then select Save CSR Info.

Select Download CSRs. When the Certificate Signing Request form appears, select Download CSRs for all nodes.

The compressed csrs.zip file is created. Save the file locally. Extract the files. Notice that a certificate request was created for each node in the Nutanix AHV cluster.

Log into the Entrust KeyControl vault created in section [create-keycontrol-vault].

Select the Security incon, and then the Client Certificates icon.

Select Create a Client Certificate Now.

Enter the Certificate Name in the text box. Choose a name unique per a given node in the Nutanix cluster, for example the last octet of the node’s IP address as part of the name.

Select Load File and choose the certificate request from section Select KeyControl as the KMIP Server and generate the certificate requests corresponding to the given node. These certificates are not .csr type. You may need to allow All file types for them to show in the file manager window. Then select Create.

Create certificates for the other nodes.

Select one of the certificates created above. Then select Download.

Notice the download file name <username_datetimestamp>.zip. Unzip the file. It contains a user certification/key file called username.pem and a server certification file called cacert.pem.

Repeat the step above for the other certificates.

Log into the Nutanix Prism Element web UI.

Select the Settings icon to the right of the toolbar to bring up the Settings menu.

Select Data-at-rest Encryption under Security on the Settings left pane.

Select Continue Configuration. Then scroll down and select Add New Key Management Server.

Enter a name for the Entrust KeyContol cluster, and the IP address of all the nodes in the cluster. The default port is 5696. Then select Save.

Select Add New Certificate Authority further down. Name the CA, then select Upload CA Certificate, and choose one of the cacert.pem files created above. All cacert.pem files are identical. Then select Save.

Log into the Nutanix Prism Element web UI.

Select the Settings icon to the right of the toolbar to bring up the Settings menu.

Select Data-at-rest Encryption under Security on the Settings left pane.

Select Continue Configuration. Then scroll down to the Key Management Server section.

Select the Manage Certificates hyperlink of the EntrustKeyControl cluster. This hyperlink is below Actions.

Select Upload Files, and choose a username.pem created above, then select Submit.

Notice the status for the node corresponding to the selected certificate displaying Uploaded. Select Test CS and the status changes to Verified.

Repeat the above for the other nodes.

Log into the Nutanix Prism Element web UI.

Select the Settings icon to the right of the toolbar to bring up the Settings menu.

Select Data-at-rest Encryption under Security on the Settings left pane.

Select Enable Encryption.

Enter the word ENCRYPT to confirm encryption in the pop-up window. Then select Encrypt.