Signing The Brocade Encryption Node Kac Certificates - Brocade Communications Systems StoreFabric SN6500B Administrator's Manual

3
Steps for connecting to an SKM or ESKM appliance
6. Register the encryption engine by entering the cryptocfg
7.
8. Repeat the above steps on every node that is expected to perform encryption.

Signing the Brocade encryption node KAC certificates

The KAC certificate signing request generated when the encryption node is initialized must be
exported for each encryption node and signed by the Brocade local CA on SKM/ESKM. The signed
certificate must then be imported back into the encryption node.
1. Export the KAC sign request to an SCP-capable host.
2. Open the exported file and copy the contents, beginning with
3. Launch the SKM/ESKM administration console in a web browser and log in.
4. Select the Security tab.
5. Select Local CAs under Certificates & CAs.
6. Under Local Certificate Authority List, select the Brocade CA name.
7.
8. Select Sign with Certificate Authority using the Brocade CA name with the maximum of 3649
9. Select Client as Certificate Purpose.
10. Allow Certificate Duration to default to 3649 days.
11. Paste the file contents that you copied in step 3 in the Certificate Request Copy area.
144
SecurityAdmin:switch> cryptocfg --initEE
This will overwrite previously generated identification
and authentication data
ARE YOU SURE (yes, y, no, n): y
Operation succeeded.
number if the encryption engine is a blade. This step registers the encryption engine with the
CP or chassis. Successful execution results in a certificate exchange between the encryption
engine and the CP through the FIPS boundary.
SecurityAdmin:switch> cryptocfg --regEE
Operation succeeded.
Enable the encryption engine by entering the cryptocfg
SecurityAdmin:switch> cryptocfg --enableEE
Operation succeeded.
SecurityAdmin:switch> cryptocfg --export -scp -KACcsr
192.168.38.245 mylogin /tmp/certs/kac_skm.csr
and ending with
REQUEST---
extra characters.
The Certificate and CA Configuration page displays.
Select Sign Request.
The Sign Certificate Request page is displayed.
days option.
---END CERTIFICATE REQUEST---
Fabric OS Encryption Administrator's Guide (SKM/ESKM)
regEE command. Provide a slot
--
enableEE command.
--
---BEGIN CERTIFICATE
. Be careful not to include any
53-1002721-01