Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.futurex.com/llms.txt

Use this file to discover all available pages before exploring further.

Sign each per-node CSR from Nutanix using the CryptoHub Certificate Authority. Export the signed certificates and the CA certificate — you will upload all of these to Prism Element in the next step.

​
Sign a node CSR

Repeat the following steps for each CSR file downloaded from Prism Element.
1
In the CryptoHub web UI, go to PKI and CA > Certificate Management.
2
Expand the Client App TLS CA tree for the Generic KMIP service you deployed.
3
Right-click the CA certificate under the Generic KMIP service and select Add Certificate > From Request.
4
In the CSR dialog, click Browse and select the .csr file for the node you are signing.
5
In the Subject DN tab, verify the Common Name reflects the node identifier from the CSR.
6
In the Basic Info tab, leave all default values.
7
In the V3 Extensions tab, select the TLS Client Certificate profile.
8
Click [ OK ] to issue the certificate.
Repeat these steps for every CSR file in the csrs.zip archive. Each CVM node requires a separately signed certificate.

​
Export signed node certificates

Export each signed certificate individually in PEM format.
1
In PKI and CA > Certificate Management, locate a signed node certificate you issued.
2
Right-click the certificate and select Export > Certificate(s).
3
Set the encoding to PEM.
4
Click [ Browse ], enter a filename that identifies the node (for example, node1-signed.pem), and click [ OK ].
5
Click [ OK ] to download the file.
Repeat for each signed node certificate. Keep track of which certificate corresponds to which CVM node — you will upload them individually in Prism Element.

​
Export the CA certificate

Export the CA certificate that signed the node certificates. Nutanix uses this certificate to validate the CryptoHub’s identity during the mTLS handshake.
1
In PKI and CA > Certificate Management, locate the CA certificate under the Generic KMIP service.
2
Right-click the CA certificate and select Export > Certificate(s).
3
Set the encoding to PEM and save the file as cacert.pem.
4
Click [ OK ] to download the file.
After completing these steps, you should have the following files ready for upload to Nutanix:
  • One signed .pem certificate per CVM node
  • One cacert.pem CA certificate
If you deployed a client endpoint in the previous step, the KMIP server root CA certificate (Futurex Test Root CA (ECC).cer or Futurex Test Root SSL CA.cer) is already included in the endpoint zip. You can use either that file or the cacert.pem exported here when configuring the Certificate Authority in Prism Element.