Configuring TLS

To configure TLS between the Nutanix cluster and the CipherTrust Manager:

1. Generate CSR(s)

2. Get the CSR(s) signed from CA

Generate CSR(s)

1. On the Nutanix VCP UI, go to Settings > Data at Rest Encryption.

2. Click Edit Configuration.

3. Under Select Key Management Server, select An external KMS and click Save KMS Type.

4. In the Certificate Signing Request section:

   1. Specify Email, Organization, Organizational Unit, Country Code, City, and State.

      To create resources in the subdomain, use <domain>||<username> as Organizational unit

   2. Click Save CSR Info.

   3. Click Download CSRs.

   4. Download the desired CSRs. For cluster setups, click Download CSRs for all nodes.

Get the CSR(s) Signed from CA

In this section, we are using CipherTrust Manager as the CA. However, you can use any other CA as per your convenience.

1. Log on to the CipherTrust Manager.

2. Download the CA certificate.

3. Sign the CSRs and download the certificates for all the nodes.

4. Create a registration token in the domain where you want your resources to be created.

5. Turn ON Auto Registration.

   1. Go to Admin Settings > Interfaces.

   2. Click the overflow icon next to the kmip interface.

   3. Click Edit top open the Configure KMIP dialog box.

   4. Select Auto Registration.

   5. Paste the Registration Token.

   6. Select OU from the Username Location in Certificate drop-down list.

   7. Add the CA used to sign the CSRs from Nutanix to the trusted CAs list.

   8. Click Update.

6. Create a new user with the same name that was specified in the Organizational Unit field of the CSR created on Nutanix VCP. This user has to be assigned to the sub domain and present in the Key Users/Admins group in the sub domain where you want your resources are created.

7. Add the newly created user to the Key Users Group.

For more information on these steps, refer to CipherTrust Manager Administrator Guide and KMIP Reference Guide.