Preparing a certificate bundle for unlock recovery
If your appliance uses an external key management service (KMS), it contacts the KMS during a restart to obtain the keys that unlock its drives. If the KMS client certificates on the appliance have expired, the KMS refuses the connection and the drives cannot be unlocked automatically.
To recover from this situation, you can supply a temporary certificate bundle that the appliance retrieves from a remote host with SCP. The appliance uses the temporary certificates only to obtain the encryption key for the current unlock operation. It does not add them to the appliance configuration.
Prepare the bundle in advance and keep it ready, so that a failed restart does not become a recovery project. The appliance cannot help you create the bundle, and the console gives you no way to author a file.
The bundle is a single file, in PEM format, that contains all of the following:
The private key for a KMS client identity, in a supported format
The client certificate for that identity. The bundle must contain exactly one client certificate.
The CA certificate
To prepare a certificate bundle
- On your management host, issue a KMS client certificate that your external KMS accepts for this appliance.
Give the certificate a short validity period. The appliance uses it once, for a single unlock operation, and then discards it. Treat the certificate and its key as compromised from the moment you create them, because they pass through an operator's hands.
- Combine the private key, the client certificate, and the CA certificate into a single PEM file. For example:
openssl pkcs12 -export -inkey client.key -in client.crt -certfile ca.crt -out bundle.p12 openssl pkcs12 -in bundle.p12 -nodes -out bundle.pem
The first command prompts you for an export password. Enter the same password when the second command prompts for it. The password protects only
bundle.p12. Thebundle.pemfile is not encrypted, and the appliance does not ask for the password. You can deletebundle.p12after you createbundle.pem. - Copy
bundle.pemto a host that the appliance can reach over SSH, and note the full path to the file.The appliance connects outbound to this host. You do not need to open any inbound access to the appliance.
- Make sure that you can supply the following when you start the recovery, and that you can verify the last of them without using the appliance:
The host name or IP address of the remote host
A user name and password for that host
The full path to the bundle file
The SHA-256 fingerprint of the SSH host key of the remote host. The appliance displays the fingerprint of the host that answers and asks you to confirm it before it transfers anything. Obtain the expected fingerprint from the host itself beforehand, by a route that does not depend on the appliance.
Warning:
The bundle contains an unencrypted private key. Anyone who obtains the file can present that identity to your KMS. Keep it only for as long as the recovery requires, restrict access to it on the remote host, and delete it afterwards.
Note:
The appliance validates the bundle after it transfers it, and rejects a bundle that is malformed, that does not contain exactly one client certificate, or that contains an expired certificate. If validation fails, the appliance reports the reason and prompts you again, so that you can correct the bundle and retry.