Skip to main content
The Hitachi VSP requires a PKCS #12 client certificate with x509v3 extensions and a root CA certificate in X.509 format. The client certificate must be signed by a CA trusted by the CryptoHub. Follow the steps below to generate and prepare these certificates.
The client certificate must include x509v3 extensions. Certificates without these extensions will be silently rejected by the VSP. Ensure your OpenSSL configuration includes req_extensions and x509_extensions sections.

​
Generate a private key and CSR

1
On the SVP or a management workstation with OpenSSL installed, generate a 2048-bit RSA private key:
Bash
2
Create an OpenSSL configuration file (for example, openssl-vsp.cnf) that includes x509v3 extensions. At minimum, the configuration should include:
openssl-vsp.cnf
3
Generate a CSR using the configuration file:
Bash

​
Sign the CSR on the CryptoHub

1
Submit the client.csr to the CryptoHub’s Certificate Authority for signing.
2
The CryptoHub returns a signed client certificate (for example, client.crt) in PEM format.
3
Export the root CA certificate (cacert.pem) from the CryptoHub. This is the CA certificate that the VSP will use to verify the CryptoHub’s identity during the KMIP TLS handshake.
If you deployed a client endpoint, the KMIP server root CA certificate (Futurex Test Root CA (ECC).cer or Futurex Test Root SSL CA.cer) is already included in the endpoint zip. You can use either that file or the exported cacert.pem.

​
Convert the signed certificate to PKCS #12

1
Convert the signed certificate and private key into PKCS #12 format:
Bash
2
Set a password when prompted. You will need this password when importing the certificate into Storage Navigator.
After completing this step, you should have:
  • client.p12 — Client certificate in PKCS #12 format (required by the VSP)
  • cacert.pem — CryptoHub root CA certificate in X.509 PEM format