When you configure the FICON® encryption functions by using Fibre Channel Endpoint Security for Mainframe, make sure to connect the storage system to key management servers used by the host. This allows the server key for authentication and encryption to be shared between the host and the storage system. For key management, a multi-node configuration consisting of two through four key management servers is required. For this reason, the priorities for the key management servers must be set.
The security administrator registers the connection configuration information about the key management servers on the storage system when installing Fibre Channel Endpoint Security for Mainframe or when changing the configuration information about key management servers.
The connection between the storage system and the key management servers can be configured using the detailed API or VSP One Block Administrator. For operations using VSP One Block Administrator, refer to the VSP One Block Administrator User Guide.
- Obtain the client certificate. See Obtaining a client certificate.
- Obtain the root certificate for the key management servers from the key management server administrator.
- When specifying the host names instead of the IP addresses to connect to the key management servers, verify that a DNS server is configured in the network settings of the storage system management port.