SSL/TLS requirements

The following tables describe the specifications and requirements for SSL/TLS communications between the storage system and the external server and certificate validation.

Cipher suites

You can change the cipher suites for a protocol. For details, see Change the TLS security settings.

Key exchange algorithm and key length

You can change the key length and algorithm for key exchange. For details, see Change the TLS security settings.

Signature algorithms, key lengths, and hash algorithms

You can change the signature algorithm, key length, and hash algorithm. For details, see Change the TLS security settings.

Target certificates

Validation targets and items

The storage system verifies the validity of the certificate chain when uploading the certificate (that is performed in the external server settings, such as syslog server settings) or when communicating with the external server.

Validation targets

• Syslog server
  • If the number of certificate chain levels of the client certificate is 3 or more, add all intermediate certificates and the root certificate into the trust store of the syslog server.
  • The URL of CRLs must be specified in HTTP format.
  • Multiple CRLDP entries are not supported.
• External authentication server
  • The URL of CRLs must be specified in HTTP format.
  • Multiple CRLDP entries are not supported.
• Key management server (KMS)

  Revocation verification using CRLs cannot be performed. To confirm revocation of certificates, perform revocation verification using OCSP, or contact the administrator of the connected server.

  If the DKCMAIN microcode version is earlier than A0-05-41, revocation verification using CRLs cannot be performed. To confirm revocation of certificates, perform revocation verification using OCSP, or contact the administrator of the connected server.

• REST API server for external storage system

  Revocation verification using CRLs or OCSP cannot be performed. To confirm revocation of certificates, contact the administrator of the connected server.

Validation items when the certificate is verified during upload

When the root certificate or client certificate is uploaded to the storage system, the validity of the certificate chain is verified. The following validation items are verified:

• The requirements of the certificate are satisfied.

  (Among the requirements of certificate in the table "Target certificates" above, the requirements for the items "Format" and "Signature algorithm / key length / hash algorithm" are verified.)

• All certificates in the certificate chain have correct signatures, and the requirements for "Extended attributes (basicConstraints)" in "Target certificates" above are satisfied.
  • The verification is performed only when Add validation item when uploading Certificate Files is enabled in the Set Up Common Criteria Certification window.
  • If both of the following conditions are met, make sure that you upload the client certificate with a two or more levels of chain:
    • The client certificate to be uploaded is not a self-signed certificate.
    • Add validation item when uploading Certificate Files is enabled.
  • When the DKCMAIN microcode version is earlier than A0-05-41 and Add validation item when uploading Certificate Files is enabled, use a certificate with a two or more levels of chain as the server certificate to be set for the connection-target server. If you use a self-signed certificate, communication might fail.
  • This validation item is not subject to verification for the key management server.
• The private key in the storage system and the uploaded certificate are correctly paired.

  This item is verified only when the client certificate file is uploaded in PEM or DER format.

Validation items when the certificate is verified during communication with the external server

When the storage system communicates with an external server, the storage system verifies validation of the certificate chain received from the server. The following validation items are verified:

• The requirements of the certificate are satisfied.
• The certificate is valid.
• The certificate has not expired.
• All certificates in the certificate chain have correct signatures.
• The certificate chain must have no more than 20 tiers.

Security warning

If you are connecting to a storage system using VSP One Block Administrator or maintenance utility that is configured for SSL/TLS and a security warning about the certificate appears, the security certificate was not issued by a trusted certificate authority, or the IP address or hostname specified in the URL does not match the Common Name (CN) listed on the security certificate. If this warning appears, you can proceed with the connection: click Advanced, and then select Proceed to <IP address> (the display differs depending on the web browser).

Notes

• Server certificate revocation verification methods include CRL and OCSP.
• When performing revocation verification using CRLs, the URI (Uniform Resource Identifier) of the CRL repository must be set to the cRLDistributionPoint (CRL) of the intermediate certificate and the server certificate. In addition, cRLSign must be set to the extended attribute (keyUsage) of the intermediate certificate and the root certificate.
• When performing revocation verification using OCSP, the URI of the OCSP responder must be set to authorityInfoAccess (authority access information) of the intermediate certificate and the server certificate. Also, the OCSP certificate presented in the OCSP response must have the OCSP Signing Purpose (1.3.6.1.5.5.7.3.9) set.
• For revocation validation of a server certificate, ensure that the CRL repository or OCSP responder is on a network accessible to the storage system and can communicate with the storage system. If the storage system cannot communicate with the CRL repository or OCSP responder, it cannot connect to the external server.
• The URI of the CRL repository must be set in HTTP format.
• Multiple CRLDP entry is not supported.