Configuring TLS mutual authentication between FlashArray and CryptoHub
Before enabling RDL on the FlashArray, the array and the must establish a mutual trust relationship by validating their respective digitally signed certificates.
Notes about certificates:
- Certificates used on the FlashArray must be PEM formatted (Base64-encoded).
- Intermediary certificates are not supported for use with KMIP.
- Using the Purity internal management certificate for KMIP configuration is not supported.
Perform the following tasks to configure TLS mutual authentication:
Use the FlashArray Command Line Interface (CLI) to perform the following tasks to create a Certificate Signing Request (CSR):
Use the following purecert create CLI command to create a self-signed certificate:
Display the certificate by using the following purecert list command: (Copy the displayed certificate for use in a later step.)
Use the following purecert construct command to construct a CSR:
Copy the CSR that is displayed in the terminal and paste it into a file editor. Save the file with either the .pem or .csr extension. Then, move the file via SFTP or other means to the external storage device configured on the .
Refer to the User Guide for guidance on creating a certificate authority and issuing a certificate from the FlashArray CSR.
Copy the contents of the FlashArray and the CA certificates to your clipboard for use in the following configuration tasks:
The purekmip create command allows for the creating of a KMIP Server and provides a way for importing the CA certificate for the KMIP server. After executing the command, you are prompted to paste in the KMIP server's CA certificate. Be sure to copy the entire certificate including "-----BEGIN" and "----END" lines.
In the uri field, the IP or hostname of the and the KMIP port number must be specified.
If the command is successful, there will be output showing the name and URI of the KMIP Server, the name of the FlashArray certificate associated with it, and a boolean value of True or False for whether the CA certificate is configured.
The purecert setattr command will be used to import the signed FlashArray certificate. After executing the command, you are prompted to paste in the signed FlashArray certificate. Be sure to copy the entire certificate including "-----BEGIN" and "----END" lines.
If the command succeeds, the output lists the certificate name, and the Status field shows Imported.
The following purekmip test command verifies that the configured credentials successfully contact and authenticate to the KMIP port on the .
If the command succeeds, the output lists the name of the KMIP server, and the Status field displays OK.
Be sure to run the purekmip test command to test the server-array communication path before enabling RDL.