> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Test and verify the integration

> Validate the Nutanix AOS and CryptoHub KMIP integration using ncli commands, NCC health checks, and key verification on the CryptoHub.

*Verify the integration using Nutanix command-line tools, NCC health checks, and the CryptoHub key inventory. This page also covers key rotation, troubleshooting, and log file locations.*

## Verify encryption status with ncli

SSH to any CVM in the cluster and run the following commands to confirm encryption is active and the KMS is configured correctly.

Run these commands to check overall encryption status:

```bash theme={null}
# Check cluster encryption status
ncli data-at-rest-encryption get-status

# List all configured key management servers
ncli key-management-server list

# List containers and confirm "Software Encryption: on"
ncli container list
```

Run these commands to test the KMIP connection and review certificate test results:

```bash theme={null}
# Test the KMIP configuration and connectivity
ncli data-at-rest-encryption test-configuration

# Retrieve results of the most recent certificate test
ncli data-at-rest-encryption get-recent-certificate-test-results
```

## Verify keys on the CryptoHub

Log in to the CryptoHub management interface and confirm that new AES-256 symmetric key objects have been created. Nutanix creates Key Encryption Keys (KEKs) on the CryptoHub when encryption is first enabled.

In the Nutanix AOS service on the CryptoHub, confirm that key objects appear in the key inventory of the service.

## Run NCC health checks

Run the full NCC health check suite to validate KMS configuration, connectivity, and certificate validity.

```bash theme={null}
# Run all NCC health checks (includes key_manager_checks)
ncc health_checks run_all
```

The `key_manager_checks` health check (Nutanix KB-8223) specifically validates KMS configuration and certificate status. Address any FAIL results before considering the integration production-ready.

## Rotate encryption keys

Nutanix supports both automatic and on-demand key rotation. To manually rotate encryption keys via the CLI, run the following command:

```bash theme={null}
ncli data-at-rest-encryption rekey-disks
```

To rotate keys from Prism Element, navigate to **Settings** > **Data-at-rest Encryption** and click **Rekey**.

During re-keying with an external KMS, Nutanix requests new keys from the CryptoHub. Old keys are retained on the CryptoHub until all data is re-encrypted with the new keys.

## Troubleshooting

| Symptom                                             | Likely cause                              | Resolution                                                                                  |
| --------------------------------------------------- | ----------------------------------------- | ------------------------------------------------------------------------------------------- |
| Node status shows **Uploaded** but not **Verified** | CVM cannot reach CryptoHub on port 5696   | Verify firewall rules allow TCP 5696 from all CVM IPs to the CryptoHub                      |
| Cluster data inaccessible after cold boot           | CryptoHub unreachable at boot time        | Restore CryptoHub connectivity; verify the CryptoHub is not hosted on the encrypted cluster |
| Certificate test fails with TLS error               | TLS inspection proxy intercepting traffic | Exempt CryptoHub IP or FQDN from TLS inspection on all network path devices                 |

## Log files

| Log            | Location on CVM              | Contents                                      |
| -------------- | ---------------------------- | --------------------------------------------- |
| Mantle INFO    | `~/data/logs/mantle.INFO`    | Normal KMIP operations and key retrievals     |
| Mantle WARNING | `~/data/logs/mantle.WARNING` | Warning-level key management events           |
| Mantle ERROR   | `~/data/logs/mantle.ERROR`   | Errors in key retrieval or KMIP communication |

The Mantle service handles all encryption key management operations on Nutanix. Run `genesis status` on any CVM to check the status of the encryption service, and `cluster status` for overall cluster health.