The following figure shows the SSL/TLS communication path for the VSP One Block storage system and the management PC. The maintenance PC (MPC) is used by the maintenance personnel to maintain the storage system. See "B" in the figure and the related description before maintenance work begins.
The cipher protocols used for SSL/TLS communication are TLS version 1.2 and TLS version 1.3.
A in the illustration indicates the following:
- Management tool communications between the management PC and the storage system
- Maintenance utility
- VSP One Block Administrator
- Built-in CLI (embedded CCI)
- Export Tool 2
- REST APIs
- Web server connection certificate
Upload the certificate (PEM or DER format) to the storage system.
- Cipher suites
For TLS version 1.3:
- TLS_AES_128_GCM_SHA256
- TLS_AES_256_GCM_SHA384
For TLS version 1.2:
- TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
- TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
- TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
- TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
- Key length
When the key exchange algorithm is DHE:
- 2,048 bits
- 3,072 bits
- 4,096 bits
When the key exchange algorithm is ECDHE:
- secp256r1
- secp384r1
- secp521r1
- Signature algorithm, key length, and hash algorithm
When the signature algorithm is RSA and the key length is 2,048, 3,072 or 4,096 bits:
- SHA-256
- SHA-384
- SHA-512
When the signature algorithm is ECDSA and the key length is secp256r1 (P-256):
- SHA-256
When the signature algorithm is ECDSA and the key length is secp384r1 (P-384):
- SHA-384
When the signature algorithm is ECDSA and the key length is secp521r1 (P-521):
- SHA-512
B in the illustration indicates the following:
- Management tool communications between the maintenance PC and the storage system
Maintenance operations by maintenance personnel using embedded management tools.
- Web server connection certificate
Upload the certificate (PEM or DER format) to the storage system.
- The number of certificate chain levels for the uploaded certificate is 20 or fewer, including the root CA certificate.
- When you upload a certificate, the following verification is performed only when Add validation item when uploading Certificate Files is enabled in the Set Up Common Criteria Certification window:
- All certificates in the certificate chain have correct signatures.
- The requirements for "Extended attributes (basicConstraints)" in "Target certificates" in SSL/TLS requirements are satisfied.
- If both of the following conditions are met, make sure that you upload the server certificate with 2 or more levels of chain:
- The server certificate to be uploaded is not a self-signed certificate.
- Add validation item when uploading Certificate Files is enabled.
- Certification verification is performed during SSL/TLS communication between the storage system and Export Tool 2. If the uploaded server certificate does not meet the requirements described in SSL/TLS requirements, the communication might fail.