Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.futurex.com/llms.txt

Use this file to discover all available pages before exploring further.

Verify the integration using Storage Navigator connection tests, CryptoHub key verification, and audit log review.

​
Verify the KMIP connection

The primary verification tool is the Server Configuration Test within Storage Navigator.
1
In Storage Navigator, navigate to Administration > Encryption Keys.
2
Select Edit Encryption Environmental Settings.
3
Under Server Configuration Test, select the Check button. This performs a live TLS handshake and KMIP protocol negotiation with both the primary and secondary servers.
4
A successful test confirms that the network path, certificates, and KMIP protocol are all working correctly. If the test fails, the error message identifies the specific problem (certificate mismatch, network unreachable, authentication failure, etc.).

​
Verify encryption keys on the CryptoHub

1
Log in to the CryptoHub web UI.
2
Navigate to the Key Management section and select Key Database.
3
Verify that new symmetric key objects have been created by the Hitachi VSP.
4
Check the CryptoHub’s KMIP activity logs for Create, Get, and Activate operations originating from the SVP IP address.

​
Check the audit log

1
In Storage Navigator, access the Audit Log to review all interactions between the VSP and the CryptoHub.
2
Confirm that key generation events, backup operations, and KEK retrievals are being recorded successfully.

​
Troubleshooting

If the connection test or encryption operations fail, check the following:
SymptomProbable causeResolution
Certificate silently rejectedClient certificate missing x509v3 extensionsRe-generate the client certificate with a configuration file that includes req_extensions and x509_extensions sections. Re-export as PKCS #12 and re-import.
Connection test fails with TLS errorTLS version mismatch or inspection proxyEnsure the CryptoHub’s KMIP listener has TLS 1.2 enabled. Exempt CryptoHub traffic from TLS inspection.
Connection timeoutNetwork connectivity issueConfirm TCP port 5696 is open between the SVP and the CryptoHub. Test with telnet <CryptoHub-IP> 5696 from the SVP.
DNS resolution failureHostname used but DNS not configured on SVPConfigure DNS on the SVP’s OS network settings, or use the CryptoHub IP address instead.
Self-signed certificate rejectedVSP does not support self-signed certificatesEnsure all certificates are signed by a trusted CA.
Certificate expiredClient certificate past its validity periodGenerate a new client certificate, convert to PKCS #12, and re-import into Storage Navigator. Back up encryption keys immediately after the certificate change.