As a first activity, create a wrapping key (certificate or AES key). If you are creating a certificate or certificate request, determine your site policy for the use of self-signed and certificates that are issued by a certificate authority.

About this task

You can use the Create Wrapping Key dialog box to create wrapping keys. Alternatively, you can use the following REST services:

• Create Certificate REST Service
• Certificate Generate Request REST Service
• Secret Key Create REST Service

Your role must have the permissions to the create action and to the appropriate device group. To make a wrapping key the default, your role must have permission to the modify action.

Procedure

1. Go to the appropriate page or directory.
   • Graphical user interface:
     1. Log in to the graphical user interface.
     2. In the Key and Device Management section on Welcome page, select 3592.
     3. Click Go to > Guided key and device creation.
     4. Alternatively, right-click 3592 and select Guided key and device creation.
   • REST interface:
     • Open a REST client.
2. Create a wrapping key.
   • Graphical user interface:
     1. On the Step 1: Create Wrapping Key page, click Create.
     2. On the Create Wrapping Key dialog box, select the wrapping key type, Certificate or AES Key.
     3. Click Create.
     4. Create a wrapping key.
        • Certificate:
          1. On the Create Certificate dialog box, select either a self-signed certificate, or a certificate request for a third-party provider.
          2. Specify values for the required and optional parameters. For example, you might optionally specify that this certificate is the default or the partner certificate. Then, click Create Certificate.
        • AES Key:

          On the Create AES Key dialog box, specify values for the required and optional parameters. For example, you might optionally specify that this AES key is the default or the partner AES key. Then, click Create.

     5. Click Close.
   • REST interface:
     1. Obtain a unique user authentication identifier to access IBM Security Guardium Key Lifecycle Manager REST services. For more information about the authentication process, see Authentication process for REST services.
     2. Create a wrapping key.
        • Certificate:

          Use the Create Certificate REST Service to create a certificate. For example, you can send the following HTTP request:

          POST https://localhost:port/SKLM/rest/v1/certificates
          Content-Type: application/json
          Accept : application/json
          Authorization: SKLMAuth authId=139aeh34567m
          Accept-Language : en
          {"type":"selfsigned","alias":"sklmCertificate1","cn":"sklm","ou":"sales",
          "o":"myCompanyName","usage":"3592","country":"US","validity":"999", "
          algorithm ": " RSA " }

        • Certificate request:

          Use the Certificate Generate Request REST Service to create a PKCS #10 certificate request file. For example, you can send the following HTTP request:

          POST https://localhost:port/SKLM/rest/v1/certificates
          Content-Type: application/json
          Accept : application/json
          Authorization: SKLMAuth authId=139aeh34567m
          {"type":"certreq","alias":"sklmCertificate1","cn":"sklm","ou":"sales","o":
          "myCompanyName","usage":"3592","country":"US","validity":"999","fileName":
          "myCertRequest1.crt","algorithm":"ECDSA"}

        • AES Key:

          Use the Secret Key Create REST Service to create symmetric keys. For example, you can send the following HTTP request:

          POST https://localhost:port/SKLM/rest/v1/keys
          Content-Type: application/json
          Accept: application/json
          Authorization: SKLMAuth userAuthId=139aeh34567m
          {"alias":"abc","numOfKeys":"1","usage":"3592"}

What to do next

Back up the new wrapping keys before they are served to devices. For a certificate request, the next step might be to import the signed certificate. You can go to the next step to define specific devices, and associate wrapping keys with the devices. Select Step 2: Identify Drives or click Go to Next Step.

For a 3592 tape drive, also specify values for the system default and partner wrapping keys in the IBM Security Guardium Key Lifecycle Manager database. Use the Device Group Attribute Update REST Service to set these values.

You can identify a 3592 tape drive for use with IBM Security Guardium Key Lifecycle Manager. Before you begin, create the wrapping keys that you want to associate with the devices that you are about to identify.

You can use the Add Tape Drive dialog box or the Device Add REST Service to add a device. Your role must have the permission to the create action and to the appropriate device group.

Additionally, if you want to associate a system default or partner wrapping key with the device you identify, you can use the following REST services:

• Device Group Attribute List REST Service
• Device Group Attribute Update REST Service

These values were previously stored in the drive.default.alias1 (for system default) or drive.default.alias2 (for system partner) properties.

You can make any of the following choices for serving wrapping keys to devices:

• Only accept manually added devices for communication

  All incoming devices are not added to the data store. You must manually specify key service to each device.

• Hold new device requests pending my approval

  All incoming devices of a valid device group are added to the device store, but are not automatically served keys upon request. You must accept or reject a device in the pending devices list before the device is served keys upon request.

• Automatically accept all new device requests for communication

  All new incoming devices of a valid device group are added to the data store and are automatically served keys upon request.

  Note: Do not use this setting if you intend to move the new device to another device group. Instead, select manual or pending approval mode to allow an opportunity to move the device into the appropriate device group before any keys are served.

1. Go to the appropriate page or directory.
   • Graphical user interface:
     1. Log in to the graphical user interface.
     2. In the Key and Device Management section on Welcome page, select 3592.
     3. Click Go to > Guided key and device creation.
     4. Alternatively, right-click 3592 and select Guided key and device creation.
   • REST interface:

     Open a REST client.

2. Skip Step 1: Create wrapping keys. Click the Go to Next Step link or click Step 2: Identify Drives.
3. You might specify that IBM Security Guardium Key Lifecycle Manager holds new device requests for your approval.
   • Graphical user interface:

     Select the Hold new device requests pending my approval option.

   • REST interface:
     1. Obtain a unique user authentication identifier to access IBM Security Guardium Key Lifecycle Manager REST services. For more information about the authentication process, see Authentication process for REST services.
     2. Use the Device Group Attribute Update REST Service to set the value of the device.AutoPendingAutoDiscovery attribute. For example, you can send the following HTTP request:

        PUT https://localhost:port/SKLM/rest/v1/deviceGroupAttributes
        Content-Type: application/json
        Accept : application/json
        Authorization: SKLMAuth authId=139aeh34567m
        {"name":"3592","attributes":"device.AutoPendingAutoDiscovery 2"}

4. Add a device.
   • Graphical user interface:
     1. On the Step 2: Identify Drives page, in the Devices table, click Add.
     2. On the Add Tape Drive dialog box, type the required and optional information.
     3. Click Add Tape Drive.
   • REST interface:

     You can use the Device Add REST Service to add a device. For example, you can send the following HTTP request:

     POST https://localhost:port/SKLM/rest/v1/devices
     Content-Type: application/json
     Accept : application/json
     Authorization : SKLMAuth userAuthId=37ea1939-1374-4db7-84cd-14e399be2d20
     Accept-Language : en
     {"type":"3592","serialNumber":"CDA39403AQJF","attributes":"worldwideName
     ABCdeF1234567890,description marketingDivisionDrive"}

What to do next

Next, use the 3592 Key and Device Management page to view all wrapping keys and devices.

What to do next

You can specify a wrapping key for future use as the system default or system partner wrapping key. 

About this task

You can use the Add Future Write Default dialog box to add a default wrapping key rollover for a specific date and device group. Alternatively, you can use the Add Key Default Rollover REST Service.

Procedure

1. Go to the appropriate page or directory.
   • Graphical user interface:
     1. Log in to the graphical user interface.
     2. In the Key and Device Management section on Welcome page, select 3592.
     3. Click Go to > Manage default rollover.
     4. Alternatively, right-click 3592 and select Manage default rollover.
     5. On the management page for 3592, click Add.
   • REST interface:
     Open a REST client.
2. Specify an existing wrapping key for future use as a system default or system partner wrapping key.
   • Graphical user interface:
     1. On the Add Future Write Default box, select the wrapping key.
     2. Specify whether the key becomes a partner or default wrapping key on the effective date.
     3. Select the effective date.
     4. Click Add Future Write Default.
     Note:

     • Do not specify two defaults for the same rollover date.
     • No validation occurs on whether the selected wrapping key is expired or expires at the time of the rollover.
     • If a wrapping key does not exist at the time of rollover, IBM Security Guardium Key Lifecycle Manager continues to use the current default wrapping key.
     • You can add or delete table entries, but cannot modify an entry.
   • REST interface:

     Use the Add Key Default Rollover REST Service to add a default wrapping key rollover for a specific date and device group. The rollover key takes the place of the previous default key.

     POST https://localhost:port/SKLM/rest/v1/rollover/3592
     Accept: application/json
     Accept-Language: en
     Authorization: SKLMAuth userAuthId=b27c9eaa-cef7-4a65-87f2-8a964ac5ace2
     Content-Type: application/json
     {
       "alias": "key2",
       "keyDefaultType": "1",
       "effectiveDate": "2021-11-05"
     }'

3. A success indicator varies, depending on the interface:
   • Graphical user interface:

     The wrapping key is added to the table of rollover certificates and keys on the 3592 page.

   • Rest interface:

     The status code 200 OK indicates success.

4. To delete a 3592 wrapping key context from the rollover table:
   • Graphical user interface:
     1. Select a 3592 wrapping key context and click Delete. Your role must have a permission to the delete action. Read the warning message. Then, click OK.
     2. The wrapping key is unmarked as a future system default or partner wrapping key, but is otherwise not changed or deleted.
   • REST interface:

     • Use the List Key Default Rollover REST Service to list key rollovers in a rollover list.

       GET https://localhost:port/SKLM/rest/v1/rollover/3592?usage=3592
       Content-Type: application/json
       Accept: application/json
       Authorization: SKLMAuth userAuthId=139aeh34567m

     • Use the Delete Key Default Rollover REST Service to remove a wrapping key rollover that is specified in a rollover list.

       DELETE https://localhost:port/SKLM/rest/v1/rollover/3592/ROLLOVER-d70d6f8-90409301-ecc7-4e3e-ad25-e687b8f9d5ee
       Content-Type: application/json
       Accept: application/json
       Authorization: SKLMAuth userAuthId=139aeh34567m

• Certificate Update REST Service
• Device Type Attribute Update REST Service

Your role must have the permissions to the modify action and to the appropriate device group.

Procedure

What to do next

Next, you might use the 3592 Key and Device Management page to associate wrapping keys with specific devices.

You can use the Server Configuration Wizard or the Advanced Configuration page to create a new self-signed certificate and set it for UI access. Alternatively, you can use the Add Server Certificate to Liberty Keystore REST Service.

Use any of the following methods:

• Using graphical user interface
• Using REST interface

Using graphical user interface

You can use the following UI options:

• Server Configuration Wizard
• Advanced Configuration page

Server Configuration Wizard

1. Log in to the graphical user interface.
2. On the Welcome page, click Configuration > TLS/KMIP > Launch Server Configuration Wizard.
3. To create a self-signed certificate, click Create TLS/KMIP Server Certificate. 
4. On the Add TLS/KMIP Certificate dialog box, select Create self-signed certificate.
5. Specify values for the parameters according to your requirements.
6. Select the Use this certificate for UI access checkbox. 
7. Click Create Certificate.
8. For this change to take effect, restart the server.

Advanced Configuration page

1. Go to Advanced Configuration > Server Certificates.
2. Click Add. 
3. On the Add TLS/KMIP Certificate dialog box, select Create self-signed certificate.
4. Specify values for the parameters according to your requirements.
5. Select the Use this certificate for UI access checkbox. 
6. Click Create Certificate.
7. For this change to take effect, restart the server.

Using REST interface

1. Open a REST client.
2. Create a self-signed certificate by using the Create Certificate REST Service. For example, you can send the following HTTP request:

   POST https://localhost:port/SKLM/rest/v1/certificates
   {"type":"selfsigned","alias":"sklmCertificate","cn":"sklm","ou":"sales",
   "o":"myCompanyName","usage":"3592","country":"US","validity":"999", " 
   algorithm ": " RSA "  }

3. Set the certificate that you created in Step 2 for UI access by using the Add Server Certificate to Liberty Keystore REST Service. For more information, see the Reference section.

You can use the Advanced Configuration page to set an existing certificate for UI access. Alternatively, you can use the Add Server Certificate to Liberty Keystore REST Service.

Use any of the following methods:

• Using graphical user interface
• Using REST interface

Using graphical user interface

Using REST interface

1. Open a REST client.
2. Run the Add Server Certificate to Liberty Keystore REST Service. For more information, see the Reference section.

You can use the Advanced Configuration page to set a signed third-party certificate for UI access. Alternatively, you can use the Add Server Certificate to Liberty Keystore REST Service.

Note: You can only use a signed TLS/KMIP certificate (self-signed or third-party) for UI access.

• Using graphical user interface
• Using REST interface

1. Import the CA-signed certificate you received from the third party. See, Importing a certificate.
2. On the Welcome page, go to Advanced Configuration > Server Certificates.
3. Select the imported certificate and click Modify. The Modify TLS/KMIP Certificate dialog box opens.
4. Select the Use this certificate for UI access checkbox and click Modify Certificate.
5. The TLS/KMIP server certificate is updated. For this change to take effect, restart the server.

Using REST interface

1. Open a REST client.
2. Import the CA-signed certificate by using the Certificate Import REST Service.
3. Run the Add Server Certificate to Liberty Keystore REST Service to set the imported certificate for UI access. For more information, see the Reference section.

You can use one of the following methods:

• Using graphical user interface
• Using REST interface

Using graphical user interface

1. Create a certificate request and manually send the certificate request to a certificate authority. See Creating a certificate request.
2. Import the returned leaf certificate. See Importing a certificate.
3. Import the intermediate and root certificates.
   1. Go to Advanced Configuration > Client Device Certificates.
   2. On the Client Device Certificates page, click Import.
   3. In the Import TLS/KMIP Certificate for Clients dialog box, specify the values:
      1. Enter the name of the certificate to be imported.
      2. Click Browse.
      3. If the certificate doesn't exist in the SKLM_DATA directory, upload the certificate by using the Upload option.
      4. Select the certificate file and click Open. 
      5. To allow the server to always trust this client certificate, select the Allow the server to trust this certificate and communicate with the associated client device checkbox. By default, the client certificate is not trusted.

Using REST interface

1. Create a certificate request by using the Certificate Generate Request REST Service.
2. Manually send the request to a certificate authority.
3. Import the returned leaf certificate by using the Certificate Import REST Service. For example, you can send the following HTTP request:

   POST https://localhost:port/SKLM/rest/v1/certificates/import
   Content-Type: application/json
   Accept: application/json
   Authorization: SKLMAuth userAuthId=139aeh34567m
   {"fileName":"/mycertfilenam.base64","alias":"newsklmCert","format":"base64",
   "usage":"SSLSERVER"}

4. Import the intermediate and root certificates by using the Certificate Import REST Service. For example, you can send the following HTTP request:

   POST https://localhost:port/SKLM/rest/v1/certificates/import
   Content-Type: application/json
   Accept: application/json
   Authorization: SKLMAuth userAuthId=139aeh34567m
   {"fileName":"/mycertfilenam.base64","alias":"newsklmCert","format":"base64",
   "usage":"SSLCLIENT"}

You can delete a selected certificate, which can be in any state, such as active or expired. You cannot delete a certificate that is in use.

In a certificate chain of trust, the root or intermediate certificates cannot be deleted until their leaf certificates are deleted. You can use the Delete menu item or the Delete Certificate REST Service to delete a certificate.

Before you begin, review the following considerations:

• Back up the keystore with the certificate that you intend to delete. See Configuring backup and restore.
• Verify that the certificate is not in use.
• Determine the current state of the certificate, and ensure that deleting a certificate in this state conforms with your site policies. 

• Using graphical user interface
• Using REST interface