> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Configure TLS certificates
> Step-by-step guide to generate, sign, and configure TLS certificates for mutual trust between NetApp ONTAP and KMES Series 3.
Before KMIP connections can occur, the NetApp ONTAP instance and KMES Series 3 must establish a mutual trust relationship by validating their respective digitally signed certificates.
The following sections demonstrate how to generate and sign certificates for NetApp ONTAP and the KMIP server connection pair on the KMES Series 3. The certificates are registered in both NetApp ONTAP and the KMIP server connection pair on the KMES Series 3 and are used each time a TCP/IP session secured by TLS is established.
## Generate and sign the NetApp ONTAP certificate
There are two optional methods for generating and signing the NetApp ONTAP and KMIP server certificates:
1. Use an external CA
2. Use the KMES Series 3 as the CA
It's also possible to use one method for the NetApp ONTAP certificate and the other method for the KMIP server certificate.
### Method 1: Use an external CA
For this method, import the external CA certificates into an empty certificate container on the KMES. Then, generate a Certificate Signing Request (CSR), which the external CA uses to issue a TLS client certificate for the NetApp ONTAP instance. Finally, import the certificate into the certificate container on the KMES that contains the external CA certificate.
Log in to the KMES Series 3 application interface with the default administrator identities.
Go to **PKI**> **Certificate Authorities** and select **\[ Add CA ]** at the bottom of the page.
Specify a **name** for the certificate container, such as `Externally Issued`, and select **\[ OK ]**\*.
The new certificate container displays in the Certificate Authorities window.
Right-click the newly created certificate container and select **Import**> **Certificate(s)**.
In the **Import Certificates** window, select **\[ Add ]** and find and select the external CA certificate that issues the NetApp ONTAP TLS certificate. The CA certificates populate in the **Verified** section of the **Import Certificates** window.
Select **\[ OK ]** to save.
The external CA certificates now display in tree form under the certificate container.
Next, create a placeholder TLS client certificate to generate a CSR. Right-click the lowest-level CA certificate in the tree and select **Add Certificate**> **Pending**.
On the **Subject DN** tab of the **Create X.509 Certificate** window, set a **Common Name** for the certificate, such as `NetApp ONTAP`.
Leave all other settings set to the default values and select **\[ OK ]**.
Right-click the placeholder NetApp ONTAP certificate and select **Export**> **Signing Request**.
Leave all of the settings on the **Subject DN** tab of the **Create PKCS #10 Request** window as the default values.
On the **V3 Extensions** tab, select the **TLS Client Certificate** profile.
On the **PKCS #10 Info** tab, specify a save location for the CSR and select **\[ OK ]**.
A message states the certificate signing request was successfully written to the location you specified.
Then, send the CSR file to an external certificate authority. The external CA uses the CSR to issue a TLS client certificate.
After the external CA issues the TLS client certificate, copy it to the storage medium configured on the KMES.
Go to **PKI**> **Certificate Authorities**, right-click the placeholder NetApp ONTAP certificate, and select **Replace**> **With Signed Certificate**.
In the **Import Certificates** window, select **\[ Add ]**. Then, find and select the externally signed TLS client certificate in the file browser. The certificate displays under the CA certificates in the **Verified** section of the **Import Certificates** window.
Select **\[ OK ]** to save.
The remaining steps in this procedure involve exporting the NetApp ONTAP certificate as a PKCS #12 file. To do this, go to **Administration**> **Configuration**> **Options** and enable **Allow export of certificates using passwords**. After enabling this option, select **\[ Save ]**.
Go to **PKI**> **Certificate Authorities**, right-click the NetApp ONTAP certificate, and select **Export**> **PKCS12**.
In the **Export PKCS12** window, select **Export Selected** and change the **Cipher Options** to **AES-256**. Note and optionally modify the file name, and select **\[ Next ]**.
Set a password for the PKCS #12 file and select **\[ Next ]**.
Select **\[ Finish ]** to save the PKCS #12 file to the specified location.
This PKCS #12 file contains the signed NetApp ONTAP client certificate, associated private key, and the root certificate, all encrypted under the password set for the file.
### Method 2: Use the KMES Series 3 as the CA
Perform the following steps to use the KMES Series 3 as the CA:
Log in to the KMES Series 3 application interface using the default Admin identities.
Go to **PKI** > **Certificate Authorities** and select **\[ Add CA ]** at the bottom of the window.
Specify a name for the certificate container, such as `KMES Issued`, and select **\[ OK ]**.
The new certificate container displays in the Certificate Authorities menu.
Right-click the newly created certificate container and select **Add Certificate** > **New Certificate**.
On the **Subject DN** tab, set a **Common Name** for the certificate, such as `Root`.
On the **Basic Info** tab, change the key size to `4096`. Leave all other settings set to the default values.
On the **V3 Extensions** tab, select the **Certificate Authority** profile and select **\[ OK ]**.
The Root CA certificate now displays under the KMES-issued certificate container.
Right-click the Root CA certificate you created and select **Add Certificate** > **New Certificate**.
On the **Subject DN** tab, set a **Common Name** for the certificate, such as `NetApp ONTAP`.
On the **V3 Extensions** tab, change the profile to **TLS Client Certificate** and select **\[ OK ]**.
The remaining steps in this procedure involve exporting the NetApp ONTAP certificate as a PKCS #12 file. To do this, perform the following steps:
1\. Go to **Administration**> **Configuration**> **Options**.
2\. Enable **Allow export of certificates using passwords**.
3\. Select **\[ Save ]**.
Go to **PKI**> **Certificate Authorities,** right-click on the NetApp ONTAP certificate, and select **Export**> **PKCS12**.
In the **Export PKCS12** window, select **Export Selected** and change the **Cipher Options** to **AES-256**. Note and optionally modify the file name and select **\[ Next ]**.
Set a password for the PKCS #12 file and select **\[ Next ]**.
Select **\[ Finish ]** to save the PKCS #12 file to the specified location.
This PKCS #12 file contains the signed NetApp ONTAP client certificate, associated private key, and the root certificate, all encrypted under the password set for the file.
### Create and configure the KMIP server certificate
Perform the following tasks to create and configure a TLS server certificate for the KMIP connection pair on the KMES Series 3:
1. Generate a private key and construct a CSR.
2. Sign the KMIP connection pair CSR using an external CA or CA generated on the KMES.
3. Get all certificates in the CA tree.
4. Configure the KMIP connection pair to use the signed certificate and CA chain.
#### Generate a private key and CSR
Perform the following steps to generate a private key and construct a CSR:
Log in to the KMES Series 3 application interface with the default Admin identities.
Go to **Administration** > **Configuration** > **Network** **Options** and go to the **TLS/SSL Settings** tab.
Select the **Connection** drop-down option and select the **KMIP** connection pair.
**Enable** the KMIP connection pair if it is not already enabled.
Uncheck the **Use System/Host API SSL Parameters** checkbox if it is selected.
In the **User** **Certificates** section, select **\[ Edit ]** next to **PKI** **Keys**.
In the **Application Public Keys** window, select **\[ Generate ]**.
When prompted that *SSL will not be functional until new certificates are imported*, select **\[ Yes ]** to continue.
In the **PKI Parameters** window, leave all fields set to the default values and select **\[ OK ]**.
The Application Public Keys window now shows that a PKI Key Pair is Loaded.
Select **\[ Request ]**.
In the **Subject DN** tab, select **Classic** from the **Preset** drop-down list and specify the hostname or IP address of the KMES in **Common** **Name**.
On the **V3 Extensions** tab, set the profile to **TLS Server Certificate**.
On the **PKCS #10 Info** tab, specify a save location and name for the CSR file and select **\[ OK ]**\*.
When prompted that *the certificate signing request was successfully written to the specified location*, select **\[ OK ]**.
Select **\[ OK ]** again in the **Application Public Keys** window to finish.
#### Sign the CSR
Perform the following steps to sign the KMIP connection pair CSR:
Go to **PKI** > **Certificate** **Authorities**.
Right-click the Root CA certificate and select **Add Certificate** > **From Request**.
In the file browser, select the KMIP connection pair CSR.
Certificate information populates in the Create X.509 From CSR window.
Leave all settings exactly as they are and select **\[ OK ]** to save.
The signed KMIP connection pair certificate now displays under the Root CA certificate in the CA tree.
#### Export all certificates
If you signed the KMIP server certificate with an external CA, download each individual CA certificate in the CA tree using a mechanism supported by the external CA. If you signed the KMIP server certificate using a KMES-hosted CA, perform the following steps to export each CA certificate in the tree:
Right-click the certificates in the certificate tree and select **Export** > **Certificate(s)**.
On the **Export** **Certificate** window, change the encoding to **PEM** and specify a save location for the file.
#### Configure the KMIP connection pair
Perform the following steps to configure the KMIP connection pair to use the signed certificate and CA chain:
Log in to the KMES Series 3 application interface with the default Admin identities.
Go to **Administration** > **Configuration** > **Network** **Options** and go to the **TLS/SSL Settings** tab.
Select the **Connection** drop-down option and select the **KMIP** connection pair.
In the **User** **Certificates** section, select **\[ Edit ]** next to **Certificates**.
On the **Certificate** **Authority** window, right-click the **KMIP SSL CA** X.509 certificate container and select **\[ Import ]**.
On the **Import** **Certificates** window, select **\[ Add ]** at the bottom of the window.
In the file browser, select the signed KMIP server certificate and every CA certificate in the CA tree, then select **\[ Open ]**.
The certificates now display in the Verified section of the Import Certificates window.
Select **\[ OK ]** to save.
You now see Signed loaded next to Certificates in the User Certificates section of the Network Options window under the KMIP connection pair.
Select **\[ OK ]** to save and finish.
## Create a role and identity
This section covers the following tasks to create a role and identity on the KMES Series 3 for NetApp ONTAP:
1. Add a PKI Identity Provider.
2. Create a NetApp ONTAP role.
3. Create a NetApp ONTAP identity.
### Add a PKI identity provider
Perform the following steps to add a **PKI** identity provider (IdP) configured with the **TLS** authentication mechanism:
Log in to the KMES Series 3 application interface with the default Admin identities.
Go to **Identity** **Management** > **Identity** **Providers**.
Right-click anywhere in the window and select **Add** > **Provider** > **PKI**.
On the **Info** tab of the **Identity Provider Editor** window, specify a **name** for the Identity Provider and uncheck **Enforce Dual Factor**.
On the **PKI** **Options** tab, select **\[ Select ]**.
In the **Certificate** **Selector** window, expand the certificate tree you created for mutual authentication, select the root CA certificate for the CA that issued the NetApp ONTAP certificate, and select **\[ OK ]**.
Select **\[ OK ]** to finish creating the PKI IdP.
Right-click the identity provider you just created and select **Add** > **Mechanism** > **TLS**.
On the **Info** tab, specify a name for the authentication mechanism.
On the **PKI** tab, leave all fields set to the default values.
Select **\[ OK ]** to save.
### Create a role
Perform the following steps to create a role for NetApp ONTAP:
Go to **Identity** **Management** > **Roles** and select **\[ Add ]**.
On the **Info** tab of the **Role** **Editor** window, set the **Type** to **Application**, set any **name**(the role name does not matter), and **Logins** **Required** to `1`.
On the **Permissions** tab, enable all of the following permissions (including their sub-permissions):
* **Certificate Authority**
* **Cryptographic Operations**
* **Keys**
On the **Advanced** tab, set **Allowed** **Ports** to **KMIP** only.
Select **\[ OK ]** to finish creating the role.
### Create an identity
Perform the following steps to create an identity for NetApp ONTAP:
Go to **Identity** **Management** > **Identities**.
Right-click anywhere in the window and select **Add** > **Client** **Application**.
On the **Info** tab of the **Identity** **Editor** window, select **Application** for the storage location and specify `NetApp ONTAP` as the identity name.
The identity name MUST match the Common Name of the NetApp ONTAP TLS client certificate. If it does not, TLS authentication fails.
On the **Assigned** **Roles** tab, select the role you created for NetApp ONTAP.
On the **Authentication** tab, remove the default API Key mechanism and select **\[ Add ]**.
In the **Configure** **Credential** window, select the **TLS** **Certificate** drop-down option in **Type** and select the Provider and Mechanism you created. Select **\[ OK ]** to finish configuring the credential.
Select **\[ OK ]** to finish creating the identity.