Brocade Communications Systems Network Advisor 12.0.0, User Manual

Page: 611 / 1505

Brocade Network Advisor SAN User Manual 563
53-1002696-01
Steps for connecting to an ESKM/SKM appliance
20
12. Paste the file contents that you copied in step 3 in the Certificate Request Copy area.
13. Select Sign Request.
14. Download the signed certificate to your local system as signed_kac_eskm_cert.pem or
signed_kac_skm_cert.pem, depending on your key vault type.
This file is ready to be imported to the encryption switch or blade.
Importing a signed KAC certificate into a switch
After a KAC CSR has been submitted and signed by a CA, the signed certificate must be imported
into the switch.
NOTE
This operation can be performed only after the switch is added to the encryption group.
1. Select Configure > Encryption from the menu task bar to display the Encryption Center
dialog box (Refer to Figure 185 on page 526).
1. Select a switch from the Encryption Center Devices table, then select Switch > Import
Certificate from the menu task bar.
The Import Signed Certificate dialog box displays ( Figure 199 ).
FIGURE 199
Import Signed Certificate dialog box
2. Browse to the location where the signed certificate is stored, then click OK.
The signed certificate is stored on the switch.
ESKM/SKM key vault high availability deployment
The ESKM/SKM key vault has high availability clustering capability. ESKM/SKM appliances can be
clustered together in a transparent manner to the end user. Encryption keys saved to one key vault
are synchronously hardened to the cluster pairs. Refer to the HP ESKM/SKM Appliance user
documentation for configuration requirements and procedures.
The configured primary and secondary HP ESKM/SKM appliances must be registered with the
encryption switch or blade to begin key operations. You can register only a single ESKM/SKM if
desired. In that case, the HA features are lost, but the archived keys are backed up to any other
non-registered cluster members. Beginning with Fabric OS 6.3.0, the primary and secondary
appliances must be clustered.
Both ESKM/SKM appliances in the cluster can be registered using the following command.
cryptocfg --reg -keyvault < cert label > < certfile > < hostname/ip address >
< primary | secondary >