Quantum scalar i40 User Manual page 220

Chapter 7: Encryption Key Management
Installing TLS Certificates on the Library
194
You must provide the following certificates:
Encryption System
SKM
KMIP Key Managers
These files must be in the proper format, as follows. If any of the
following requirements is not met, none of the certificates will be
imported.
• The Root Certificate must be 2048 bits and be in PEM format.
• Admin and Client certificates must be in pkcs12 (.p12) format, with
a separate certificate and private key contained in each.
• Admin and Client certificates must be 1024, 2048, or 4096 bits.
Note: SKM-attached Scalar libraries support communication
certificate key lengths of 1024 bits. Communication certificates
larger than 1024 bits, such as 2048 and 4096 bit key lengths,
are supported by the i40/i80 i6 (and later) release. (Refer to the
Scalar library release notes or contact Quantum/ technical
support for additional information and availability of required
library firmware). Note however, that the use of
communication certificates with key bit lengths larger than
1024 bits will affect library performance with respect to
encryption key retrieval times and encryption key generation,
import and export operations. While certificate key lengths of
2048 bits slightly slow operations in single and multi-library
attached SKM server environments, the use of communication
certificates with a key length of 4096 bits should be avoided in
SKM configuration environments where multiple Scalar tape
libraries are attached to a single SKM server pair.
• Admin and Client certificates must be signed by the Root Certificate.
Certificates Required
• Root Certificate (also called the
CA certificate, or Certificate
Authority Certificate)
• Client Certificate
• Admin Certificate
• Root Certificate (also called the
CA certificate, or Certificate
Authority Certificate)
• Client Certificate
Quantum Scalar i40 and Scalar i80 User's Guide