Configuring external key management

You can use one or more external key management servers to secure the keys that the cluster uses to access encrypted data. An external key management server is a third-party system in your storage environment that serves keys to nodes using the Key Management Interoperability Protocol (KMIP).

Installing SSL certificates on the cluster
The cluster and KMIP server use KMIP SSL certificates to verify each other's identity and establish an SSL connection. Before configuring the SSL connection with the KMIP server, you must install the KMIP client SSL certificates for the cluster, and the SSL public certificate for the root certificate authority (CA) of the KMIP server.
Enabling external key management in ONTAP 9.6 and later (HW-based)
You can use one or more KMIP servers to secure the keys the cluster uses to access encrypted data. You can connect up to four KMIP servers to a node. A minimum of two servers is recommended for redundancy and disaster recovery.
Enabling external key management in ONTAP 9.5 and 9.4
You can use one or more KMIP servers to secure the keys the cluster uses to access encrypted data. You can connect up to four KMIP servers to a node. A minimum of two servers is recommended for redundancy and disaster recovery.
Creating authentication keys in ONTAP 9.6 and later
You can use the security key-manager key create command to create the authentication keys for a node and store them on the configured KMIP servers.
Creating authentication keys in ONTAP 9.5 and earlier
You can use the security key-manager create-key command to create the authentication keys for a node and store them on the configured KMIP servers.
Assigning a data authentication key to a FIPS drive or SED (external key management)
You can use the storage encryption disk modify command to assign a data authentication key to a FIPS drive or SED. Cluster nodes use this key to lock or unlock encrypted data on the drive.

Give documentation feedback