Requesting and installing an externally signed partition certificate

You can request a new signed partition certificate from a third-party certificate authority. The externally signed partition certificate can be installed by using the management GUI or command-line interface (CLI).

Note: Before requesting and installing the partition certificates, take the following factors into consideration:
  • The certificate signing request must be generated on the system. IBM Storage Virtualize does not support certificate signing requests that are generated outside of the system.
  • The signed certificate must contain the following X509v3 Key Usage extensions: Digital Signature. It must also contain the following X509v3 Extended Key Usage Extensions: TLS Web Server Authentication and TLS Web Client Authentication. Ensure that the Certificate Authority (CA) used to sign the certificate includes these extensions.

In the management GUI, select Settings > Security > Certificates and select Replace from the overflow menu.

In the Certificates page, select externally signed certificate and complete the form to create a request for a signed certificate for specific partition. The resulting certificate signing request (CSR) should be exported to the third-party certificate authority so that it can be signed. After you receive the externally signed certificate from the third-party certificate authority, use the management GUI or command line interface (CLI) to upload and install the signed certificate on the system.

Using the management GUI

To configure an externally signed partition certificate, complete these steps:
  1. In the management GUI, select Settings > Security > Certificates.
  2. Click Create and then select the scope of the certificate as Partition from the drop-down menu.
  3. Select Externally Signed Certificate for the certificate type.
  4. If you are already using certificates, the Certificate Details are automatically populated. You can update the details. For more information on the certificate details, see step 6 in Updating or creating an internally signed partition certificate.
  5. Click Generate CSR. This action presents a dialogue window to download the file. Select a location on your local machine to save the file.
  6. If the signing request is generated, you have the option to cancel the outstanding signing request in case of an error. To cancel any outstanding signing request, complete these steps:
    1. Select Settings > Security > Certificates.
    2. Go to a specific certificate, select Cancel CSR and click Yes.
  7. Share the generated CSR file to the trusted third-party CA. If the CA is a public CA, then it can take some time for the CA to verify your identity before issuing the signed certificate. When it is ready, download the signed certificate file from the CA. You can also download any intermediate CA certificates that were used to sign the request. The files must all be in PEM format.
  8. If intermediate CAs are used to sign the certificate request, create a single file that contains the contents of the signed certificate and the contents of each intermediate CA certificate, concatenated together. The root CA certificate is not mandatory, but can optionally be included.
  9. Go to specific certificate, select Install certificate.
  10. On the Upload Signed Certificate page, select the new signed certificate that you downloaded to your device or laptop.
  11. Click Install. This action uploads the certificate onto the system. For more information, see Export partition certificate.

Using the command-line interface (CLI)

In the command-line interface, enter the following command to create a new partition certificate request and upload the new partition certificate:
  1. Enter the following command to create a new partition certificate request:
    svctask mkpartitioncertstore -externalsigned -partition partition0 -commonname BC30C5EB-FAB9-59FE-9880-5F7F479753B8 -keytype ecdsa521 -country GB -state Hampshire -locality Hursley -org MYCO -orgunit Storage -email admin@myco.com -subjectalternativename "IP:192.165.10.15"

    The certificate request is automatically written to /dumps/partition_certificate_slot_<partitionid>.csr.

  2. Use the Secure Copy (SCP) to copy the file /dumps/partition_certificate_slot_<partitionid>.csr from the system to your local machine. Share the generated CSR file to the trusted third-party CA. If the CA is a public CA, then it may take some time for the CA to verify your identity before issuing the signed certificate. When it is ready, download the signed certificate file from the CA. You should also download any intermediate CA certificates that were used to sign the request. The files must all be in PEM format.
  3. If the intermediate CA's are used to sign the certificate request, create a single certificate chain file that contains the contents of the signed certificate and the contents of each intermediate CA certificate, concatenated together. The root CA certificate is not mandatory, but can optionally be included.
  4. Use the SCP to copy the certificate back onto the system in the file /dumps/certificate.pem, where certificate.pem is the name of the certificate.
  5. After you copy the signed CA certificate to the system, enter the following command: 
    svctask chpartitioncertstore -install -partition partition0 -file /dumps/certificate.pem
    where /dumps/certificate.pem is the absolute path name of the signed certificate or certificate chain file.
For more information, see the chpartitioncertstore CLI command.