Exchanging certificates with a KMS server

Before you can configure a connection to an external KMS server, the HCP for cloud scale system and an external server must exchange SSL certificates to establish mutual trust.

To enable data-at-rest encryption with keys managed by an external key management system (KMS) that supports the Key Management Interoperability Protocol (KMIP), you need to exchange SSL certificates between the HCP for cloud scale system and the KMS so that they can establish mutual transport layer security (mTLS). HCP for cloud scale supports mTLS v1.3 and, for backward compatibility, v1.2. Both systems need to have certificates granted by a certificate authority (CA).

Before you begin, you must have entered a serial number in your HCP for cloud scale and then uploaded a digital license to use the encryption feature. For information on entering a serial number, see Entering your serial number. For information on uploading a license, see Uploading a license.

The following workflow uses Thales CipherTrust Manager as an example of an external KMS, but you can use any third-party product that supports the KMIP protocol. Some steps in the workflow are performed on the Thales system. Before you begin the workflow, you need the following information:

• The certificate of the certificate authority that signed the HCP for cloud scale system certificate
• The URL and login credentials for the Thales system
• The HCP for cloud scale certificate signing request and signed system certificate