Unlocking the storage with a certificate bundle
The storage shelves have their own encryption key. If the shelves are secured and locked and the appliance cannot obtain their key from the external KMS because its KMS client certificates have expired, use the following procedure to unlock them.
Before you start, prepare the certificate bundle and place it on a host that the appliance can reach.
See Preparing a certificate bundle for unlock recovery.
To unlock the storage with a certificate bundle
- Sign in to the Flex Appliance Shell and run the following command:
system sed unlock-storage
- If the appliance cannot unlock the storage automatically because the certificates have expired, it prompts you to choose a recovery option. Select the option to retrieve certificates from a remote host.
- Enter the host name or IP address of the remote host, a user name and a password for that host, and the full path to the bundle file.
The password is not displayed as you type it.
- Compare the SHA-256 fingerprint of the SSH host key that the appliance displays with the fingerprint of the remote host, and confirm that it matches.
The appliance does not transfer the bundle until you confirm the fingerprint.
- The appliance retrieves the bundle, validates it, uses the temporary certificates to obtain the encryption key from the external KMS, and unlocks the shelves.
If any of these steps fails - for example, the path to the bundle file is wrong, the user name or the password is incorrect, the bundle does not pass validation, or the certificates in the bundle have expired - the appliance displays the reason as an error message and prompts you again. Correct the detail that was wrong and continue.
- After the storage is unlocked, import valid long-term certificates for the external KMS if you have not already done so.
Note:
This command unlocks the storage only when the shelves are secured and locked. Otherwise, it behaves as follows:
If the shelves are not secured, the command reports an error and exits with status 1.
If the shelves are secured but already unlocked, the command exits with status 0 without making any changes.
If a previous rekey operation did not complete, the command fails with the following message:
Storage is in an inconsistent state due to a partially successful rekey operation. Contact Technical Support for assistance.