The VMS can be configured to require clients invoking the VMS REST API to present a client certificate. The requirement applies to any client connections used to make REST API calls to the VMS, including those used for accessing the VAST Web UI.
To configure client certificate validation for VMS REST API calls, obtain a CA certificate (and a key) and upload it to VMS as the VMS mTLS certificate.
After uploading the VMS mTLS certificate, the clients are expected to present the same certificate as the one uploaded to the VMS, or a certificate signed by the uploaded root certificate.
Uploading a VMS mTLS Certificate via VAST Web UI
To upload a VMS mTLS certificate via VAST Web UI:
From the left navigation menu, select Settings and then Certificates to open the Certificates tab.
From the Certificate for dropdown, select VMS mTLS Auth.
Either paste the certificate file contents into the Certificate field or use the Upload button to upload the file, and paste or upload the key file content into the Key field.
When pasting the file content, include the "BEGIN CERTIFICATE", "END CERTIFICATE", "BEGIN PRIVATE KEY" and "END PRIVATE KEY" lines:
-----BEGIN CERTIFICATE----- <Certificate file content> -----END CERTIFICATE---------------BEGIN PRIVATE KEY----- <Key file content> -----END PRIVATE KEY-----Click Update.
Uploading a VMS mTLS Certificate via VAST CLI
To upload a VMS mTLS certificate via VAST CLI:
Run the
vms set_client_certificatecommand:vcli: admin> vms set_client_certificate --id 1 Please enter certificate AND private key (ALT+ENTER/option+ENTER to finish):Enter the certificate and key content one after the other, including the "BEGIN CERTIFICATE", "END CERTIFICATE", "BEGIN PRIVATE KEY" and "END PRIVATE KEY" lines:
-----BEGIN CERTIFICATE----- <Certificate file content> -----END CERTIFICATE---------- -----BEGIN PRIVATE KEY----- <Key file content> -----END PRIVATE KEY-----
Removing a VMS mTLS Certificate via VAST Web UI
To remove an uploaded VMS mTLS certificate:
From the left navigation menu, select Settings and then Certificates to open the Certificates tab.
From the Certificate for dropdown, select mTLS.
Click Remove.
Removing a VMS mTLS Certificate via VAST CLI
To remove a VMS mTLS certificate via VAST CLI, run the vms remove_client_certificate command.
vcli: admin> vms remove_client_certificate
This action will remove the client certificate from vms,
vms will no longer verify client requests after that.
Are you sure you want to proceed? [y/N] y
client certificate has been removed, please reconnect.