Adding an external key management service (KMS)
If your appliance has self-encrypting drives (SEDs), it uses an internal key management service (KMS) by default to manage the encryption keys. If you prefer, you can add an external KMS and use it instead. An external KMS provides enhanced control and security because you manage it outside of the appliance.
Flex Appliance supports the KMIP 1.4 protocol for communication with the external KMS.
Note:
To add an external KMS, the storage shelf firmware must be on version I200R005-08 or later. You can check the version with the show hardware-health primaryshelf component=firmware command.
Use the following procedure to add an external KMS.
To add an external KMS
- Sign in to the Flex Appliance Console as a security administrator and click the gear icon in the upper-right corner of the page, then click Key management service.
- Click Add KMS.
Fill in the required information and click Add.
Note:
Intermediate CA certificates are not supported.
- Once the KMS has been added successfully, click Actions > Test KMS connection to verify the connection.
You can now switch to use the new KMS to manage the encryption keys.
See Changing an SED key.