Installation

This guide explains how to integrate NetApp ONTAP with Securosys Primus HSMs via the Securosys KMIP Server.

integration scope

This guide assumes that you already have an ONTAP Cluster and will not go over how to setup ONTAP itself.
Instead, it will focus on how to add the Securosys KMIP Server to the cluster as the key-manager.

Prerequisites

To follow this guide, you need the following items:

1. Terminal access to the ONTAP on-premise / cloud server.
2. ONTAP version v9.17.1P1 or higher.
3. Securosys Primus HSM with firmware v3.2.11+ or CloudHSM (compatible)
4. CyberVault KMS v1.1.0 (includes the KMIP Server v1.1.0)
5. KMIP Server credentials (mTLS client keystore and server truststore). Learn how to issue them with CyberVault KMS.

Configure External KMS on ONTAP

note

For detailed setup instructions and troubleshooting please follow the NetApp's guide: Learn about ONTAP hardware-based encryption

1. A configured vserver admin and node are required in order to add an external key manager:

   Cluster01::> vserver show
                               Admin      Operational Root
   Vserver     Type    Subtype    State      State       Volume     Aggregate
   ----------- ------- ---------- ---------- ----------- ---------- ----------
   Cluster01    admin   -          -          -           -          -
   Cluster01-01 node    -          -          -           -          -
   
   2 entries were displayed.

2. Install the client key and certificate into the admin vserver (as seen in 'vserver show'). The KMIP Server will use this to authenticate ONTAP.

   Cluster01::> security certificate install -vserver Cluster01 -type client
   
   Please enter Certificate: Press <Enter> when done
   <Enter public key data>
   
   Please enter Private Key: Press <Enter> when done
   <Enter private key data>
   
   The certificate's generated name for reference: SECUROSYS-SHA2_037B

3. Likewise, install the KMIP Server certificate into the admin vserver (as seen in 'vserver show'). ONTAP will use this to authenticate the KMIP Server.

   Cluster01::> security certificate install -type server-ca -subtype kmip-cert -vserver <your_server_name>
   
   Enter certificate: Press <Enter> when done
   -----BEGIN CERTIFICATE-----
   MIIFnjCCA4agAwIBAgIUfTzi+UURzHAI8Log0Vb8Kf6DJXwwDQYJKoZIhvcNAQEL
   ...
   tgebYKM3RO0MyVREDZjJ2YCycD8PNglCrSisr6MT+bUbMKdZ6Nnh8hE0StKQ/QPC
   Iuk=
   -----END CERTIFICATE-----
   
   You should keep a copy of the CA-signed digital certificate for future
   reference.
   
   The installed certificate's CA and serial number for reference:
   CA: <CN_of_your_certificate>
   serial: ######
   The certificate's generated name for reference: <CN_of_your_certificate>

4. You can use the below to view installed certificates:

   Cluster01::> security certificate show Client*
   Vserver    Serial Number   Certificate Name                       Type
   ---------- --------------- -------------------------------------- ------------
   Cluster01   ######          Client1                                client
       Certificate Authority: Securosys SA
           Expiration Date: Tue Aug 22 04:43:03 2045
   
   Cluster01::> security certificate show Server*
   Vserver    Serial Number   Certificate Name                       Type
   ---------- --------------- -------------------------------------- ------------
   Cluster01   ######          Server1                                server-ca
       Certificate Authority: Securosys SA
           Expiration Date: Mon Apr 02 20:20:09 2035

info

Either choose a long certificate lifetime, or don't forget to renew and re-install your certificates!

Enable the External Key Manager

Specify which server to use as the external key manager for the admin vserver.

Cluster01::> security key-manager external enable -vserver Cluster01 -key-servers <IPAddress>:<Port> -client-cert Client1 -server-ca-cert Server1

Argument	Description
-vserver	Your OnTAP vServer name.
-key-servers	Domain/IP-Address and port of the KMIP Server. Default KMIP-Port is: 5696
-client-cert	Name of the client certificate as shown in the "Certificate Name" above.
-server-ca-certs	Name of the server certificate as shown in the "Certificate Name" above.

Verify the External Key Manager Connection

Cluster01::> security key-manager external show-status

                Node: securosys-01
             Vserver: securosys
     Key Server Port: 5696
 KMIP is operational: true

Key Server                  Role           Server Status     Reason
-------------------         ------------   ---------------   ------
kmip-server.cloudshsm.com   primary        available         -

Enable Volume Encryption

Enable encryption on one or more of your storage volumes (as seen in 'volume show') using:

Cluster01::> volume encryption conversion start -vserver Data01 -volume vol_2

Setup complete.

Verify volume encryption:

Cluster01::> volume show -volume vol_2 -fields is-encrypted,encryption-type
vserver        volume encryption-type is-encrypted 
-------------- ------ --------------- ------------ 
svm_securosys2 vol_2  volume          true

Another way to verify the external Key-Manager is through the ONTAP UI. Navigate to the Console Cluster Settings Security.

Configure a KMIP Cluster

ONTAP supports connecting to a cluster of KMIP Servers. This is done by defining a secondary-key-servers in your vserver. Ensure that you have already setup a primary key server in the previous section and run:

Cluster01::> security key-manager external modify-server -vserver <your_server_name> -key-servers kmip-server.cloudshsm.com -secondary-key-servers <list_of_key_servers>

list_of_key_servers accepts a comma-separated list of up to three servers, as DNS names or IP addresses.

Further Reading

• ONTAP external key management
• ONTAP clustered external key server