Brocade Network Advisor SAN + IP User Manual v12.1.0 - Manual (Page 952)

898 Brocade Network Advisor SAN + IP User Manual
53-1002949-01
Steps for connecting to a TKLM appliance
25
8. Import the node KAC certificates. Refer to “Importing the Fabric OS encryption node KAC
certificates to TKLM” on page 899.
9. Export the server CA certificate to a LINUX or Windows host. Refer to “Exporting the TKLM
self-signed server certificate” on page 900.
10. Add encryption group members as needed. The first node added to an encryption group
functions as the Group Leader. It is valid to have only one node in an encryption group.
11. Import the server CA certificate and register TKLM on the encryption Group Leader nodes.
Refer to “Importing the TKLM certificate into the group leader” on page 901.
12. Enable the encryption engines.
Exporting the Fabric OS node self-signed KAC certificates
Each Fabric OS node generates a self-signed KAC certificate as part of the node initialization
process as described under
“Encryption node initialization and certificate generation” . These
certificates must be exported from each switch and stored on a local LINUX host to make them
available for importing to TKLM.
1. Select a switch from the Encryption Center Devices table, then select Switch > Export
Certificate from the menu task bar.
The Export Signed Certificate dialog box displays.
2. Select Signed switch certificate, then click OK.
A dialog box displays allowing you to save the signed certificate in .pem format in My
Documents on your work station. Make a note of this location.
Converting the KAC certificate format
The KAC certificate exported from the encryption switch is in .pem format. It is automatically
converted to a .der format during the export process; however, if you need to manually convert the
file before importing it to the TKLM server, you can do so by completing the following steps:
1. Go to openssl utility.
2. Run
openssl x509 -outform der -in KAC_Certificate_Name.pem -out
KAC_Certificate_Name.der
.
Establishing a default key store and device group on TKLM
To establish a default key store and Fabric OS device group on TKLM, complete the following steps:
1. Obtain the necessary user credentials, then log in to the TKLM user interface.
2. Select Advanced Configuration > Keystore.
The Keystore page displays.
3. Click OK to accept the default keystore settings.