Any KMIP client can connect to the Cryptographic Security Platform Vault KMIP server and perform all standard KMIP operations with the following restrictions:

  • The Cryptographic Security Platform Vault for KMIP KMIP server supports KMIP versions 1.0, 1.1,1.2,1.3,1.4, 2.0, 2.1, and 3.0. The KMIP server protocol version is configured automatically and set between 1.0 to 3.0, as requested by the client.
  • The object count (for example, keys) has a limit of 1 million KMIP objects per KeyControl Vault cluster. This limit includes all of the Cryptographic Security Platform Vault for KMIP instances in that cluster. If you exceed this limit, the KMIP server will still create and maintain the objects but the Cryptographic Security Platform Vault for KMIP webGUI may not display those objects correctly.

Important: Cryptographic Security Platform Vault includes a component for creating a Root Certificate Authority (CA) that can generate digital certificates. When the first Cryptographic Security Platform Vault node is installed, it creates a Public CA that it also stores in the Cryptographic Security Platform Vault object store. For more information, see CSP Vault Certificates.
By default, the KMIP server uses a default certificate signed by the CA inside Cryptographic Security Platform Vault. This can be changed by installing a custom SSL certificate for the KMIP server. To generate a custom SSL certificate, you can use a CSR created from Cryptographic Security Platform Vault for the KMIP server (see Creating a Certificate Signing Request for KMIP Server) or you can use your own CSR. If you use your own CSR, you must upload a private key for that custom certificate.

For details about the standard KMIP operations and configuration settings, see the Oasis KMIP Technical Committee page or the KMIP wikipedia page.

When a KMIP client connects to the Cryptographic Security Platform Vault for KMIP KMIP server, the client must use the certificates associated with a KMIP server user account. The KMIP server does not support username/password login credentials. For details about downloading a user account certificate bundle, see Creating a KMIP Client Certificate.

Note:  

  • If you are configuring a KMIP server to use with VMware vSphere encryption or VSAN encryption, see the Entrust KeyControl with VMware VSAN and vSphere VM Encryption guide.

  • If you are using a KMIP server with KEK enabled, please ensure that the KEK cache timeout is enabled. Set the value to anything other than 0.

Procedure

  1. Log into the Cryptographic Security Platform Vault Management webGUI.
  2. Select the Settings icon at the top right of the vault page.

  3. On the KMIP Vault Settings page, complete the following:

    Option

    Description

    State

    If set to Enabled, clients can connect to this KMIP server.

    Port

    The server port number. The default port is 5696.

    Verify

    If set to Yes, the KMIP client identity is verified before the server handles its request. We recommend that you do not turn this option off.

    Log Level

    The lowest level of log messages that will be saved in the audit log. The options are:

    • All—Logs all requests to the KMIP server and responses from the KMIP server.
    • Create-Modify—Logs object creation, object modify requests, and object delete requests and responses. This is the default.
    • Create-Get—Logs object creation messages, object fetch requests, and object fetch responses.
    • Create—Logs object creation request and response messages.
    • Get—Logs object fetch and object locate requests and responses.
    • Off—No log messages are stored in the audit log.

    TLS

    Choose which version of TLS you want to support. If set to TLS 1.3, all clients must connect to this KMIP server using TLS 1.3. By default, both TLS 1.2 and TLS 1.3 are supported.

    Note: The TLS setting applies to the KMIP server only and affects the entire cluster.

    Timeout

    The length of time, in minutes, after which a client request will time out. If No is selected, client requests never time out. This is the default.

    To change this option, select Yesand select the number of minutes before the requests times out. This can be from 1 to 60 minutes.

    KMIP Locate Operation: Maximum Items Default

    Choose the maximum number of items to be returned from the KMIP server Locate operation.

    Note: The KMIP client allows you to set an offset items value (the record number the return starts with) and a maximum items value (how many items are returned) when you run the KMIP locate operation.

    The maximum number of items depends on both the choice that you set in the webGUI and the value that you set in the KMIP Client. 

    For example: 

    • If you choose the default value in the webGUI, and you DO set a max value in the KMIP Client, it returns up to 1000 UUIDs.

    • If you choose the default value in the webGUI, and you do NOT set a max value in the KMIP Client, it returns up to 100 UUIDs.

    • If you choose the value set to the maximum items value from the KMIP client in the webGUI, and you DO set a max value, it returns the maximum value of UUIDs that is set in the KMIP Client.

    • If you choose the value set to the maximum items value from the KMIP client in the webGUI, and you do NOT set max value, it returns all the UUIDs found in the locate operation.

    For more information on the KMIP Locate command, see https://docs.oasis-open.org/kmip/kmip-spec/.

    SSL/TSL Ciphers

    Enter the SSL ciphers in a comma-separated list that you want the KMIP server to use.

    Note: The following ciphers are not supported:  DHE-DSS-AES128-256 and DHE-DSS-AES128-SHA256.

    Certificate Types

    This can be one of the following: 

    If set to Default, the KMIP server uses a default certificate.

    If set to Custom, you must have a custom SSL certificate generated from Cryptographic Security Platform Vault or from your own CSR, and then provide the following: 

    • SSL Certificate—Upload the SSL certificate file in Base64-encoded pem format. It should be able to function as a server certificate.

    • CA Certificate—Upload the certificate for the CA that signed the custom SSL certificate in Base64-encoded pem format.

      If you want to use the CA certificate to verify the KMIP client certificate select Yes. The default is No.

      Important: If you select Yes, you will need to upload a KMIP client certificate for every Cryptographic Security Platform Vault for KMIP.

    • Private Key—Optionally upload the private key file in Base64-encoded pem format. This is required if you used your own CSR and not the CSR generated on the KMIP page.
    • Password—Optionally enter the password for the custom certificate.


  4. Click Apply and confirm your changes when prompted.