Skip to main content

## Manage KMIP Encryption

With the Key Management Interoperability Protocol (KMIP) Wizard, you can configure the use of KMIP key management servers with the library. Access the wizard from the Actions menu with Manage Encryption option. This requires that the Library Managed Encryption license has been activated on the Settings > Library > Licensed Features page.

For additional information on configuring KMIP servers for use with the library, see the KMIP server documentation.
Before running the wizard, verify that the KMIP server is available on the network and has been configured for use with this library.

I f Library Encryption settings are reset and the use of a self-signed certificate, you will be required to accept the new certificate on the KMIP server.

Using the KMIP Wizard

1. In the Actions menu, click Manage Encryption to start the wizard.
2. The Wizard Information screen displays information about the wizard. On this screen, it is also possible Reset Encryption Settings which can be done in the wizard. If the library configuration is complete and the KMIP server is available on the network, click Next.
3. On the Logical Library Selection screen, it is possilbe to choose the logical library for which the KMIP configuration should be done. The "Logical Library Default" will be used when creating a new logical library with Library Managed Encryption (KMIP) enabled.
   It is also possible to copy the settings from on logical library to another. After the copy process, it is possible to modify the settings.
   After selecting a logical library, click Next.
4. The Certificate Option screen displays the different certificate options which can be used to establish a secure communication to the KMIP server. You can select from the following options:

- Library Self-Signed Certificate (default option) - A self signed certificate generated in the library internally will be used.
- Uploaded Certificate - Upload a PCKS #12 file which includes a certificate and it's corresponding key.
- Generate Certificate Request (CSR) - A CSR is generated in the library which must be signed by a CA server. This method requires a CA certificate which must be provided during the wizard steps.

The next steps of the wizard depends on the selected certificate option.

Library Self-Signed Certificate

After choosing the "Use Library Self-Signed Certificate" option, click Next.

1. The KMIP Client Configuration screen provides options for two types of server authentication.

- If your KMIP server uses a client username and password for authentication, enter the username and password that were specified on the KMIP management console for the library.
- If your KMIP server uses only certificate validation for authentication, select Enable KMIP Certificate only authentication. Select this option only if you are using a KMIP server that does not support a client username and password. This is the default method and is required when using KMIP with the IBM Security Key Lifecycle Manager.

Click Next.

1. In the KMIP Server Configuration screen, enter the IP address or fully qualified hostname and port number for up to ten KMIP servers. Also choose which key server type will service the encryption keys. You can select from the following options:

- IBM SKLM - IBM Security Lifecycle Manager 2.6.0 or higher KMIP server.
- KMIP Compatible - Key server supporting the OASIS standard key management interoperability protocol (KMIP).

To verify access to the KMIP servers, click Connectivity Check. Check at the KMIP server side that the server accepts the certificate of the library.
To download the generated Self-Signed Certificate, click Download Self-Signed Certificate. The certificate will be downloaded in PEM format.

1. The Setup Summary screen displays the settings that are collected by the wizard. Verify that the settings are correct and that there are no errors in the Done column. If you need to modify any settings or fix any issues, either click Back to reach the applicable screen or Cancel to leave the wizard to fix the issues and return later.
   If the settings are correct and there are no errors, click Finish.

Uploaded Certificate

In case "Use Uploaded Certificate" is selected, an area to upload the PKCS #12 file is shown on the Certificate Option screen. If this file requires a password, it must be provided in the "Certificate Password" input field. In case of no password, the field can be left empty. After successfully upload of the certificate, click Next.

1. The KMIP Client Configuration screen provides options for two types of server authentication.
   If your KMIP server uses a client username and password for authentication, enter the username and password that were specified on the KMIP management console for the library.
   If your KMIP server uses only certificate passing for authentication, select Enable KMIP Certificate-only authentication. Select this option only if you are using a KMIP server that does not support a client username and password. This is the default method and is required when using KMIP with the IBM Security Key Lifecycle Manager.
2. Click Next.
3. In the KMIP Server Configuration screen, enter the IP address or fully qualified hostname and port number for up to 10 KMIP servers. Also choose which key server type will service the encryption keys. You can select from the following options:

- IBM SKLM - IBM Security Lifecycle Manager 2.6.0 or higher KMIP server.
- KMIP Compatible - Key server supporting the OASIS standard key management interoperability protocol (KMIP).

To verify the access to the KMIP servers, click Connectivity Check.Check at the KMIP server side that the server accepts the certificate of the library.

1. The Setup Summary screen displays the settings that are collected by the wizard. Verify that the settings are correct and that there are no errors in the Done column. If you need to modify any settings or fix any issues, either click Back to reach the applicable screen or Cancel out of the wizard to fix the issues and return later.
2. If the settings are correct and there are no errors, click Finish.

Generate Certificate Request (CSR)

After choosing the "Generate Certificate Request (CSR)" option, click Next.

1. The Certificate Authority Information screen displays prerequisites for using the KMIP certificate. When the prerequisites are met, click Next.
2. The Certificate Authority Certificate Entry screen displays instructions for obtaining the CA certificate for the KMIP server. Follow the instructions to copy the CA certificate from the management console. Paste the CA certificate into the wizard and then click Next.
3. The Library Certificate Information screen displays information about the next wizard steps. Click Next.
4. The KMIP Client Configuration screen provides options for two types of server authentication.
   If your KMIP server uses a client username and password for authentication, enter the username and password that were specified on the KMIP management console for the library.
   If your KMIP server uses only certificate passing for authentication, select Enable KMIP Certificate-only authentication. Select this option only if you are using a KMIP server that does not support a client username and password. This is the default method and is required when using KMIP with the IBM Security Key Lifecycle Manager.
5. Click Next.
6. The Certificate Generation screen displays the current library certificate, if one exists.
   To use the current certificate, select Keep Current Certificate and then click Next.
   To generate a new certificate, select Generate New Certificate. The wizard will generate and display a new library certificate. Click Select Certificate to copy the new certificate text to the clipboard and then click Next.
7. If you selected Generate New Certificate, the Sign Library Certificate screen displays the new certificate for the library. Sign the new library certificate with the certificate authority as a client certificate, paste the new KMIP certificate into the box, and click Next.
8. In the KMIP Server Configuration screen, enter the IP address or fully qualified hostname and port number for up to ten KMIP servers. Also choose which key server type will service the encryption keys. You can select from the following options:

- IBM SKLM - IBM Security Lifecycle Manager 2.6.0 or higher KMIP server.
- KMIP Compatible - Key server supporting the OASIS standard key management interoperability protocol (KMIP).

To verify access to the KMIP servers, click Connectivity Check. Check at the KMIP server side that the server accepts the certificate of the library.

1. The Setup Summary screen displays the settings that were collected by the wizard. Verify that the settings are correct and that there are no errors in the Done column. If you need to modify any settings or fix any issues, either click Back to reach the applicable screen or Cancel out of the wizard to fix the issues and return later.
2. If the settings are correct and there are no errors, click Finish.

Once the wizard has finished, the "Library Managed Encryption (KMIP)" encryption mode is selectable in the Logical Library Wizard (Expert Mode) on the Library > Logical Libraries page.