Steps For Connecting To A Tklm Appliance; Exporting The Fabric Os Node Self-Signed Kac Certificates; Establishing A Default Key Store And Device Group On Tklm - Brocade Communications Systems Brocade 8/12c User Manual

Steps for connecting to a TKLM appliance

All switches you plan to include in an encryption group must have a secure connection to the Tivoli
Key Lifecycle Manager (TKLM). A local LINUX host must be available to transfer certificates.
NOTE
Ensure that the time zone and clock time setting on the TKLM server and Brocade encryption nodes
are the same. A difference of only a few minutes can cause the TLS connectivity to fail.
Repeat the same steps for configuring both the primary and secondary key vaults.
NOTE
The primary and secondary key vaults should be registered before you export the master key or
encrypting LUNs. If the secondary key vault is registered after encryption is done for some of the
LUNs, then the key database should be backed up and restored on the secondary TKLM from the
registered primary TKLM before registering the secondary TKLM.
The following is a suggested order for the steps needed to create a secure connection to TKLM:
•
•
•
•
•
•
•
•
•
•
•
These configuration steps are described in the following sections:
•
•
•
•
•

Exporting the Fabric OS node self-signed KAC certificates

Each Fabric OS node generates a self-signed KAC certificate as part of the node initialization
process as described under
certificates must be exported from each switch and stored on a local LINUX host to make them
available for importing to TKLM.
Brocade Network Advisor SAN User Manual
53-1002167-01
Initialize all Brocade encryption nodes to generate KAC certificates and export the signed KAC
certificates to a local LINUX host.
Obtain the necessary user credentials and log in to the TKLM server appliance from the TKLM
management web console.
Create a default key store on TKLM.
Create a device group named BRCD_ENCRYPTOR with device family LTO.
Add devices to the group.
Create a certificate for the TKLM server.
Import the Brocade node KAC certificates.
Export the server CA certificate to a LINUX or Windows host.
Add encryption group members as needed. The first node added to an encryption group
functions as the group leader. It is valid to have only one node in an encryption group.
Import the server CA certificate and register TKLM on the Brocade encryption group leader
nodes.
Enable the encryption engines.

"Establishing a default key store and device group on TKLM"

"Creating a self-signed certificate for TKLM"
"Importing the Fabric OS encryption node KAC certificates to TKLM"
"Exporting the TKLM self-signed server certificate"
"Importing the TKLM certificate into the group leader"
"Encryption node initialization and certificate

Steps for connecting to a TKLM appliance

on page 470
on page 471
on page 471
on page 472
18
on page 471
generation". These
469