Employ MTG KMS as external Key Server in Nutanix Cloud

To install the KMS Server as an external Key Manager for your Nutanix Cluster, follow the steps below.

Create Node Certificates

  1. Navigate to Settings and then Data-at-Rest Encryption

    1Settings
    2Data at Rest

  2. Click on Edit Configuration

  3. Select the external KMS option

    3externalsKMS

  4. Further down go to Certificate Signing Request Information.

    4 0 1CSR

  5. Here Fill out the Information and press Save. Create a CSR for every node and then Download the CSRs

    4 1CSR

  6. Extract the CSR from the zip file.

  7. Use the CARA Certification Manager to create each Node’s certificate from the CSRs.
    When creating the certificate it is required to insert the name of the KMS-Tenant-Client, which is going to be used for the connection, in the CN (Common Name) of the certificate.

CARA/CLM guide

docs.mtg.de/enterprise-resource-security/5.1.0/guide/issue-your-first-certificate.html

During this guide the choice for the source of the certificate would be the 1.3.1 PKCS10 Request to use the CRS downloaded earlier to let CARA issue the certificate.

Add KMS to the Cluster

  1. Within the Settings > Data-at-Rest Encryption > Edit Configuration scroll down to the "Add a new Key Management Server" option

    5 0 0Fillledkms

  2. Enter a name and the IP-Addresses of all the Nodes in the Cluster (Default Port is 5696) then Save

  3. Now Select Add New Certificate Authority
    Give a name, then select Upload CA Certificate and choose the cacert.pem created by CARA. Save.

    6AddCA

    This step has to be done before we can upload the nodes' certificates

Add the User Certificates to the Nodes

In order for the communication between the cluster’s nodes and the KMS Server to be established securely, each node needs to have a certificate assigned to them.

  1. For that, again go to Settings > Data-at-Rest Encryption > Edit Configuration

  2. In the Key Management Server section click on Manage Certificates

    5 0 0Fillledkms

  3. Upload the Users' Certificates and Submit

  4. Click Test CS to verify

  5. Repeat for all nodes/certificate pairs

Enable Encryption

99vorende

Finally Select Enable Encryption on the Data-at-Rest Encryption Settings Page. Enter the word ENCRYPT into the text box and press the Encrypt button. The Encryption may take a while, the status can be seen in the tasks registry. image::999nachende.PNG[]