This command configures and enables an external key manager for data encryption on a cluster that has encryption enabled. If encryption was not previously enabled on the cluster, use cluster modify to enable internal encryption, then use this command to configure an external key manager (EKM).
Note
Requirements for enabling encryption after installation:
Only one EKM is supported per cluster.
If no encryption was enabled at the time of installation, you must first enable internal encryption.
You can switch from internal encryption to an external encryption, but not between EKM types.
Usage
add-ekm --encryption-type ENCRYPTION_TYPE
[--ekm-servers EKM_ADDRESS1[:PORT1][,EKM_ADDRESS2[:PORT2][,EKM_ADDRESS3[:PORT3][,EKM_ADDRESS4[:PORT4]]]]]
[--ekm-certificate CERTIFICATE]
[--ekm-private_key PRIVATE_KEY]
[--ekm-ca-certificate CA_CERTIFICATE]
[--ekm-certificate-file CERTIFICATE_FILE]
[--ekm-private-key-file PRIVATE_KEY_FILE]
[--ekm-ca-certificate-file CA_CERTIFICATE_FILE]
[--ekm-bypass-validation]
[--ekm-auth-domain AUTH_DOMAIN]
[--ekm-domain DOMAIN]
[--ekm-proxy-address PROXY_ADDRESS]Required Parameter
| Specifies the type of key management:
|
Options
| Specifies the IP addresses or DNS names and port numbers for up to four EKM servers. Valid port range: 1024 - 65535. Default: 5696. Example: |
| Specifies the proxy address when connecting to the Thales CipherTrust Manager via a proxy. The format of the proxy address is: https://proxy-address:port. Example: |
| Specifies the SSL certificate for the connection to the EKM servers. Enter the certificate content encapsulated in quotation marks (""). Include the "-----BEGIN CERTIFICATE-----" and "-----END CERTIFICATE-----" lines from the certificate file content. |
| Specifies the SSL certificate file for the connection to the EKM servers. Place the file on the CNode host from which you are running the VAST CLI under Example: |
| Specifies the private key of the SSL certificate for connecting to the EKM servers. Enter the private key content encapsulated in quotation marks (""). Include the "-----BEGIN EC PRIVATE KEY-----" and "-----END EC PRIVATE KEY-----" lines from the private key file content. |
| Specifies the private key file of the SSL certificate for connecting to the EKM servers. Place the private key file on the CNode host from which you are running the VAST CLI under Example: |
| Specifies the CA certificate file for the connection to the EKM servers. Place the file on the CNode host from which you are running the VAST CLI under |
| Specifies the CA certificate file for the connection to the EKM servers. Place the file on the CNode host from which you are running the VAST CLI under Example: |
| Include this option to bypass certificate validation. |
| For use with Thales CipherTrust Manager. Specify the CipherTrust authentication domain of the user. This is the domain where the user was created. The default is an empty string, which is equivalent to the root domain. For example, if you created the domain "vastdomain" on the Thales CipherTrust manager, you should include |
| When using Thales CipherTrust Manager, specify a child domain name for use when logging in. New keys will be created inside the domain. |
Thales Domain Usage
When using the --ekm-auth-domain and --ekm-domain parameters for Thales, their effects on authentication and key storage is as follows:
auth-domain | domain | effect |
|---|---|---|
(empty) | (empty) | Authenticates as a user created in the root domain. Keys will be created within the root domain. |
|
| Authenticates as a user created in |
(empty) |
| Authenticates as a user from the root domain. Keys will be created in |
| (empty) | As when both are set to |
|
| Authenticates as a user created in |
Example
vcli: admin> cluster add-ekm --encryption-type CIPHER_TRUST_KMIP --ekm-servers 192.0.2.0,192.0.2.1,192.0.2.2,192.0.2.3 -
-ekm-proxy-address https://squid:squid@10.27.103.73:3128 --ekm-certificate-file "/vast/bundles/cert.pem" --ekm-private-k
ey-file "/vast/bundles/tmp/cert.key" --ekm-ca-certificate-file "/vast/bundles/ca-cert.pem"