Brocade Communications Systems Network Advisor 12.3.0, User Manual

Page: 784 / 1940

732 Brocade Network Advisor SAN User Manual
53-1003154-01
Steps for connecting to an ESKM/SKM appliance
20
Importing a signed KAC certificate into a switch
After a KAC CSR has been submitted and signed by a CA, the signed certificate must be imported
into the switch.
NOTE
This operation can be performed only after the switch is added to the encryption group.
1. Select Configure > Encryption from the menu task bar to display the Encryption Center
dialog box. (Refer to Figure 266 on page 694.)
1. Select a switch from the Encryption Center Devices table, then select Switch > Import
Certificate from the menu task bar.
The Import Signed Certificate dialog box displays. (Refer to Figure 280 .)
FIGURE 280
Import Signed Certificate dialog box
2. Browse to the location where the signed certificate is stored, then click OK.
The signed certificate is stored on the switch.
ESKM/SKM key vault high availability deployment
The ESKM/SKM key vault has high availability clustering capability. ESKM/SKM appliances can be
clustered together in a transparent manner to the end user. Encryption keys saved to one key vault
are synchronously hardened to the cluster pairs. Refer to the HP ESKM/SKM Appliance user
documentation for configuration requirements and procedures.
The configured primary and secondary HP ESKM/SKM appliances must be registered with the
encryption switch or blade to begin key operations. You can register only a single ESKM/SKM if
desired. In that case, the HA features are lost, but the archived keys are backed up to any other
non-registered cluster members. Beginning with Fabric OS 6.3.0, the primary and secondary
appliances must be clustered.
Both ESKM/SKM appliances in the cluster can be registered using the following command.
cryptocfg --reg -keyvault < cert label > < certfile > < hostname/ip address >
< primary | secondary >