Test and verify the integration - Futurex Documentation

Verify the integration using Nutanix command-line tools, NCC health checks, and the CryptoHub key inventory. This page also covers key rotation, troubleshooting, and log file locations.

Verify encryption status with ncli

SSH to any CVM in the cluster and run the following commands to confirm encryption is active and the KMS is configured correctly. Run these commands to check overall encryption status:

# Check cluster encryption status
ncli data-at-rest-encryption get-status

# List all configured key management servers
ncli key-management-server list

# List containers and confirm "Software Encryption: on"
ncli container list

Run these commands to test the KMIP connection and review certificate test results:

# Test the KMIP configuration and connectivity
ncli data-at-rest-encryption test-configuration

# Retrieve results of the most recent certificate test
ncli data-at-rest-encryption get-recent-certificate-test-results

Verify keys on the CryptoHub

Log in to the CryptoHub management interface and confirm that new AES-256 symmetric key objects have been created. Nutanix creates Key Encryption Keys (KEKs) on the CryptoHub when encryption is first enabled. In the Nutanix AOS service on the CryptoHub, confirm that key objects appear in the key inventory of the service.

Run NCC health checks

Run the full NCC health check suite to validate KMS configuration, connectivity, and certificate validity.

# Run all NCC health checks (includes key_manager_checks)
ncc health_checks run_all

The key_manager_checks health check (Nutanix KB-8223) specifically validates KMS configuration and certificate status. Address any FAIL results before considering the integration production-ready.

Rotate encryption keys

Nutanix supports both automatic and on-demand key rotation. To manually rotate encryption keys via the CLI, run the following command:

ncli data-at-rest-encryption rekey-disks

To rotate keys from Prism Element, navigate to Settings > Data-at-rest Encryption and click Rekey. During re-keying with an external KMS, Nutanix requests new keys from the CryptoHub. Old keys are retained on the CryptoHub until all data is re-encrypted with the new keys.

Troubleshooting

Symptom	Likely cause	Resolution
Node status shows Uploaded but not Verified	CVM cannot reach CryptoHub on port 5696	Verify firewall rules allow TCP 5696 from all CVM IPs to the CryptoHub
Cluster data inaccessible after cold boot	CryptoHub unreachable at boot time	Restore CryptoHub connectivity; verify the CryptoHub is not hosted on the encrypted cluster
Certificate test fails with TLS error	TLS inspection proxy intercepting traffic	Exempt CryptoHub IP or FQDN from TLS inspection on all network path devices

Log files

Log	Location on CVM	Contents
Mantle INFO	`~/data/logs/mantle.INFO`	Normal KMIP operations and key retrievals
Mantle WARNING	`~/data/logs/mantle.WARNING`	Warning-level key management events
Mantle ERROR	`~/data/logs/mantle.ERROR`	Errors in key retrieval or KMIP communication

The Mantle service handles all encryption key management operations on Nutanix. Run genesis status on any CVM to check the status of the encryption service, and cluster status for overall cluster health.

​Verify encryption status with ncli

​Verify keys on the CryptoHub

​Run NCC health checks

​Rotate encryption keys

​Troubleshooting

​Log files