Skip to main content

Introduction

This document describes the integration of the Hewlett Packard Enterprise (HPE) Alletra 9000 Storage Array (referred to as Alletra in this guide) with the Entrust KeyControl 10.0 (formerly HyTrust KeyControl) key management solution using the open standard KMIP protocol. Entrust KeyControl (referred to as KeyControl in this guide) serves as a key manager for encryption keys by using various protocols, including KMIP.

Product configurations

Entrust has successfully tested the integration of KeyControl with HPE Alletra 9000 in the following configurations:

System Version

Entrust KeyControl

10.0

Requirements

Before starting the integration process, familiarize yourself with:

Note
 Entrust recommends that you allow only unprivileged connections unless you are performing administrative tasks.

Procedures

Follow these steps to install and configure KeyControl:

  1. Deploy a KeyControl cluster

  2. Additional KeyControl cluster configuration

  3. Authentication

  4. Create DNS record for KeyControl cluster

  5. Enable KMIP

  6. Create tenant

  7. Create the HPE Alletra certificate request

  8. Create the tenant client certificate bundle

  9. Import tenant client certificate into Alletra

  10. Register the Entrust KeyControl KMS

  11. Execute tests

Deploy a KeyControl cluster

This deployment consists of two nodes.

  1. Download the KeyControl software from https://my.hytrust.com/s/software-downloads. This software is available both as an OVA or ISO image. The OVA installation method in VMware is used in this guide for simplicity.

  2. Install KeyControl as described in KeyControl OVA Installation.

  3. Configure the first KeyControl node as described in Configuring the First KeyControl Node (OVA Install).

  4. Add second KeyControl node to cluster as described in Adding a New KeyControl Node to an Existing Cluster (OVA Install).

    Note
    		 Both nodes need access to an NTP server, otherwise the above operation will fail. Log in the console to change the default NTP server if required.
    keycontol cluster

  5. Install the KeyControl license as described in Managing the KeyControl License.

Additional KeyControl cluster configuration

After the Entrust KeyControl cluster is deployed, additional system configuration can be done as described in KeyControl System Configuration.

Authentication

For simplicity, local account authentication is used in this integration. For AD-managed Security groups, configure the LDAP/AD Authentication Server as described in Specifying an LDAP/AD Authentication Server.

Create DNS record for KeyControl cluster

  1. Create a single DNS record named EntrustKeyControl in the domain.

  2. Assign this record as many IPs as nodes in the cluster created above, two in this integration.

Enable KMIP

  1. Log into the KeyControl webGUI using an account with Security Admin privileges.

  2. Select KMIP in the menu bar in the KeyControl webGUI. Then select the Settings tab.

  3. For State, select Enable. Take the default for the other parameters. Then select Apply.

    enable kmip

  4. In the Overwrite all existing KMIP Server settings? pop-up window, select Proceed.

Create tenant

Entrust KeyControl 10.0 supports multi-tenancy. Therefore, a tenant must be created before setting up any KMIP services.

  1. Log into the KeyControl webGUI using an account with Security Admin privileges.

  2. Select KMIP in the menu bar in the KeyControl webGUI. Then select the Tenants tab.

  3. Select Actions > Create a KMIP Tenant. The Create a KMIP Tenant dialog appears

  4. On the About tab, enter the name and description. Then select Next.

    Note
    		 The tenant name cannot be changed after the tenant is created.
    create kmip tenant 1

  5. On the Authentication tab, select Local User Authentication. See Authentication for reason. Then select Next.

  6. On the Admin tab, enter the Administrator information. Then select Create.

    create kmip tenant 2

  7. Select the newly created tenant and scroll down to see the tenant information. Test the tenant by selecting the Tenant Login URL, and log in with the credentials above.

    create kmip tenant 3
    Note
    		 The Tenant Login URL is used later, to [enable-kmip-key-wrapping] and [establish-trust-alletra-keycontrol]

See the following link for additional information Creating a KMIP Tenant.

Create the HPE Alletra certificate request

  1. Log into the Alletra 9060 webGUI using an account with Security Admin privileges.

  2. Select Settings in the toolbar. Then select Array certificates.

  3. Select the + icon to add a certificate.

  4. Select Create a certificate signing request for the Certificate type.

  5. Select ekm-client for Array service and enter the Common name and other information. Then confirm the checkbox to proceed and select Add.

    create certificate 9060

  6. Select the certificate created.

  7. Copy the PEM in the newly created certificate window.

    copy PEM 9060

  8. Create a csr file type with a text editor containing the copied certificate request. May need to rename the file using the Windows CLI to get the correct file type extension if using Notepad text editor.

    create csr file 9060

Create the tenant client certificate bundle

  1. Log into the KeyControl webGUI using an account with Security Admin privileges.

  2. Select KMIP in the menu bar in the KeyControl webGUI. Then select the Tenants tab.

  3. Highlight the desired tenant. Scroll down and select the link on Tenant Login. A new tab in the browser opens.

  4. Log in with the tenant credentials.

  5. Select Security > Client Certificates.

  6. Select the + icon on right top corner to create new client certificate.

  7. Check Add Authentication for Certificate in the Create Client Certificate pop-up window.

  8. Enter the authentication credentials and Certificate Expiration date. Upload the csr file created in Create the HPE Alletra certificate request. Then select Create.

    create client certificate 9060

  9. Select the certificate bundle created and select Download.

  10. Extract the two files from the zip bundle.

    certificate extracted 9060

See the following link for additional information KMIP Tenant Client Certificates.

Import tenant client certificate into Alletra

  1. Log into the Alletra 9060 webGUI using an account with Security Admin privileges.

  2. Select Settings in the toolbar. Then select Array certificates.

  3. Select the certificate that was created in Create the HPE Alletra certificate request. In this case HPEAlletra9060User and select Import Signed CSR in the Actions tab.

    import signed csr 9060

  4. Paste the content of the extracted cacert.pem file from Create the tenant client certificate bundle in the Authority chain text box. When pasting the content, only include the certificate section of the file starting from -----BEGIN CERTIFICATE----- and ending with -----END CERTIFICATE-----.

  5. Paste the content of the extracted HPEAlletra9060User.pem file from Create the tenant client certificate bundle in the Certificate text box. Only paste the certificate section starting from -----BEGIN CERTIFICATE----- and ending with -----END CERTIFICATE-----. Then select Add.

    signed csr certificate 9060

  6. Notice the new status of the Certificate along with the Root Certificate now showing up beside our created certificate.

    certificate sign request 9060

  7. Launch the Alletra 9060 CLI using an account with Security Admin privileges.

  8. Verify that the certificates were created with the showcert command.

    Alletra-9060 cli% showcert
Service         Commonname                               Type   Enddate                  Fingerprint
ekm-client      HPEAlletra9060User                       cert   Jan 13 20:14:56 2024 GMT c93bb1e83381573626dd56366252fec7842781d7
ekm-client*     HyTrust KeyControl Certificate Authority rootca Dec 31 23:59:59 2049 GMT fe6391cfa9dfc185026f301b3c9306d1afdb761f

  9. Import an ekm-server in the CLI, by pasting the content extracted from the cacert.pem file from Create the tenant client certificate bundle with the importcert ekm-server command. Only paste the certificate section starting from -----BEGIN CERTIFICATE----- and ending with -----END CERTIFICATE-----. Then continue.

    Alletra-9060 cli% importcert ekm-server -ca stdin
Please paste the CA bundle for ekm-server. Once finished, please press Enter twice.
-----BEGIN CERTIFICATE-----
MIID9TCCAt2gAwIBAgIEY5jLbzANBgkqhkiG9w0BAQsFADBXMQswCQYDVQQGEwJV
UzEVMBMGA1UEChMMSHlUcnVzdCBJbmMuMTEwLwYDVQQDEyhIeVRydXN0IEtleUNv
bnRyb2wgQ2VydGlmaWNhdGUgQXV0aG9yaXR5MB4XDTExMDYwMTAwMDAwMFoXDTQ5
MTIzMTIzNTk1OVowVzELMAkGA1UEBhMCVVMxFTATBgNVBAoTDEh5VHJ1c3QgSW5j
LjExMC8GA1UEAxMoSHlUcnVzdCBLZXlDb250cm9sIENlcnRpZmljYXRlIEF1dGhv
cml0eTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAN8ujGo8vM61rgIe
iry2NEYmqns6C6RkTJbl9j+QsBB8JTUx0AeQA1b8/0eLQ3u6xbjmSDco1K1ISdkZ
u3vkfj2TunyMY2pPxCXGWkk5B/J9JOluTZRAzkJMhfE6oBfv70xoBthxDKMY9/r3
K8cHTDira4OMHd65n9ISg65+2IH9n+4OG83VAk+9aYQHYLMh3y+bR0m7Ss/dcbLP
ggQ1Ib1Cpln8mtRkWF1YsfVOxuNYazi+O5aP0lJ5k4jPfSJPbNJoXon9ZyBDrbH9
jK6e34BU8QQDS62dSGM8DlVETtgVO8AldSrpv9RiuBUdxcj0qlSzw33rFfg4GGDV
1z+9MdUCAwEAAaOByDCBxTAdBgNVHQ4EFgQU/m8a+5IuIULlMiEj4mq6Q71JbX8w
gYIGA1UdIwR7MHmAFP5vGvuSLiFC5TIhI+JqukO9SW1/oVukWTBXMQswCQYDVQQG
EwJVUzEVMBMGA1UEChMMSHlUcnVzdCBJbmMuMTEwLwYDVQQDEyhIeVRydXN0IEtl
eUNvbnRyb2wgQ2VydGlmaWNhdGUgQXV0aG9yaXR5ggRjmMtvMA8GA1UdEwEB/wQF
MAMBAf8wDgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4IBAQC4/AB/lf2z
XhhyOWMEAiaBRPjYiRgaPW68gRh7RTvu2BTcN50BnI2V9xE3WBq/JpRlDMg3XtCR
Sq5xepWyOfjCFdjtd6f2nAFI/J6gTm1mUwmP883Q9pciW47ozNTZVGvGzCG+JwZE
Js4CFkBEhfPERM8+66+fqb2aSxytECSeQx/pron8oahW9X4mxX3NYkOBWBS+zI00
FQiWaJMbbhq+GLJeTy+hdL8OY8L8crRC7fV3BFCKKxU9u4QwJOJcjNY9P1Yz2Xcb
3Jy8rK4D/V/2vDNWoeeOY/9PXe2rBj4RkC8X9vcBHn5itdM+Z1VKYVRTafrFQJAj
7ueQc/tJLADf
-----END CERTIFICATE-----
Do you want to import these certificate(s) for ekm-server service?
* stdin certificate authorities?
Continue importing signed certificate(s) (yes/no)?

  10. Verify that the ekm-server certificate was created with the showcert command. Notice the newly created ekm-server below.

    Alletra-9060 cli% showcert
Service         Commonname                               Type   Enddate                  Fingerprint
ekm-client      HPEAlletra9060User                       cert   Jan 13 20:14:56 2024 GMT c93bb1e83381573626dd56366252fec7842781d7
ekm-client*     HyTrust KeyControl Certificate Authority rootca Dec 31 23:59:59 2049 GMT fe6391cfa9dfc185026f301b3c9306d1afdb761f
ekm-server*     HyTrust KeyControl Certificate Authority rootca Dec 31 23:59:59 2049 GMT fe6391cfa9dfc185026f301b3c9306d1afdb761f

Register the Entrust KeyControl KMS

  1. Launch the Alletra 9060 CLI using an account with Security Admin privileges.

  2. Create an External Key Manager Server with the controlencryption setekm command in the CLI. Include all of the configuration parameters listed below. Then proceed to create a password

    Alletra-9060 cli% controlencryption setekm -setserver EntrustKeyControl.epl2.net -ekmuser HPEAlletra9060User -kmipprotocols 1.3

  3. Verify that the external key manager has been created with the controlencryption status -d command.

    Alletra-9060 cli% controlencryption status -d
Licensed Enabled BackupSaved State  SeqNum Keystore
yes      yes     yes         normal      1 LKM

Number of EKM servers defined: 1
EKM servers: EntrustKeyControl.epl2.net
EKM server port: 5696
EKM username: HPEAlletra9060User
KMIP Protocols: 1.3

  4. Verify communication with the newly created External Key Management server with the controlencryption checkekm command to show that EKM settings are correct.

    Alletra-9060 cli% controlencryption checkekm
EKM settings are correct

  5. Power down the KeyControl nodes one at a time and verify the communication with the External Key Management server with the controlencryption checkekm command to show that EKM settings are correct.

    Alletra-9060 cli% controlencryption checkekm
EKM settings are correct

Execute tests

Execute the test as described in the HPE Alletra internal documentation.

Integrating with an HSM

For guidance on integrating the Entrust KeyControl with a Hardware Security Module (HSM), consult with your HSM vendor. If you are using an Entrust nshield HSM, refer to the Entrust KeyControl nShield HSM Integration Guide available at Entrust documentation library.

RESOURCES