Skip to main content
Copy the contents of the FlashArray client certificate and the CA certificate to your clipboard for use in the following configuration tasks:
  1. Define the KMIP Server and import the KMIP Server CA certificate.
  2. Import the signed FlashArray certificate.
  3. Test connection and authentication from the FlashArray to the CryptoHub.

​
Define the KMIP Server and import the KMIP Server CA certificate

The purekmip create command enables the creation of a KMIP Server and provides a way to import the CA certificate for the KMIP server. After executing the command, you must paste in the KMIP server’s CA certificate when prompted. Be sure to copy the entire certificate, including the -----BEGIN and ----END lines. Perform the following step to define the KMIP Server and import the KMIP Server CA certificate:
1
Run the purekmip create command as shown in the following example:
In the uri field, specify the IP or hostname of the CryptoHub and the KMIP port number.
None
pureuser@purefa-ct0:# purekmip create kmip_srvr --uri 10.0.5.127:5696 --certificate
cert_1 --ca-certificate

Please enter CA certificate followed by Enter and then Ctrl-D:
-----BEGIN CERTIFICATE-----
MIIDEjCCAfoCCQD5SRlGfudwrzANBgkqhkiG9w0BAQsFADBLMRswGQYDVQQLDBJQ
---pasted lines omitted---
8mMBeuA8IYYihHIqd6nj03k0aESMtA==
-----END CERTIFICATE-----
If the command succeeds, the output shows the name and URI of the KMIP Server, the name of the FlashArray certificate associated with it, and a boolean value of True or False indicating whether the CA certificate is configured.

​
Import the signed FlashArray certificate

The purecert setattr command imports the signed FlashArray certificate. After executing the command, paste in the signed FlashArray certificate when prompted. Be sure to copy the entire certificate, including the -----BEGIN and ----END lines. Perform the following step to import the signed FlashArray certificate:
1
Run the purecert setattr command as shown in the following example:
Shell
pureuser@purefa-ct0:# purecert setattr --certificate cert_1

Please enter certificate followed by Enter and then Ctrl-D:
-----BEGIN CERTIFICATE-----
MIIDPDCCAiSgAwIBAgIIANgThwAAAIcwDQYJKoZIhvcNAQELBQAwDzENMAsGA1UE
---pasted lines omitted---
sQPNMlbDt1C7DN4yP0PK7g==
-----END CERTIFICATE-----
If the command succeeds, the output lists the certificate name, and the Status field shows Imported.

​
Test connection

The following purekmip test command verifies that the configured credentials successfully contact and authenticate FlashArray to the KMIP port on the CryptoHub:
None
pureuser@purefa-ct0:# purekmip test kmip_srvr
If the command succeeds, the output lists the name of the KMIP server, and the Status field displays OK.
Be sure to run the purekmip test command to test the server-array communication path before enabling RDL.