Home » HP Manuals » Servers » HP Brocade 8/12c » Manual Viewer

HP Brocade 8/12c Brocade Network Advisor SAN User Manual v11.1x (53-1002167-01 - Page 515

Creating a self-signed certificate for TKLM

Add to My Manuals
Save this manual to your list of manuals

Page 515 highlights

Steps for connecting to a TKLM appliance 18 Creating a self-signed certificate for TKLM You must create a self-signed certificate for TKLM that can be downloaded to the Fabric OS encryption engines to verify the authenticity of TKLM. 1. Select Tivoli Key Lifecycle Manager > Configuration. The Configuration page displays. 2. Select Create self-signed certificate. 3. Under Certificate label in key store, enter a certificate label. 4. Under Certificate description (common name), enter a descriptive name. 5. Under Validity period of new certificate, enter the desired life time for the certificate. 6. Select Tivoli Key Lifecycle Manager > Advanced Configuration > Server Certificates to verify that the certificate label is listed on Administer Server Certificates under Certificates. 7. Reboot the TKLM server. Importing the Fabric OS encryption node KAC certificates to TKLM The KAC certificates previously exported from the Fabric OS encryption nodes to an external LINUX host must now be imported into the TKLM server file system. You must import the KAC certificate in .der format. To do this, refer to "Converting the KAC certificate format" on page 470. 1. Import the KAC certificate from the external host into the TKLM server file system using a binary file transfer mechanism using FTP, USB, or SCP. 2. Select Tivoli Key Lifecycle Manager > Advanced Configuration > Client Certificates. The Client Certificates page displays. 3. Select Import > SSL Certificate. The Import SSL/KMIP Certificates for Clients page displays. 4. Enter the Fabric OS KAC certificate name in the Certificate field. 5. Under File name and location, enter or browse to the location where the imported KAC certificate is stored. 6. Select Trust. 7. Select Import. 8. Verify that the imported certificate is valid and active. Exporting the TKLM self-signed server certificate The TKLM self-signed server certificate must be exported in preparation for importing and registering the certificate on a Fabric OS encryption group leader node. 1. Enter the TKLM server wsadmin CLI. For Linux (in ./wsadmin.sh): /IBM/tivoli/tiptklmV2/bin/wsadmin.sh -username TKLMAdmin -password -lang jython Brocade Network Advisor SAN User Manual 471 53-1002167-01

Section	Page
Contents	3
About This Document	35
Getting Started	45
In this chapter	45
User interface components	45
Dashboard tab	47
SAN tab	52
Icon legend	61
SAN product icons	61
Host product icons	62
SAN group icons	63
Host group icons	63
SAN port icons	63
SAN product status icons	64
Event icons	65
Management server and client	66
Logging into a server	71
Launching a remote client	71
Clearing previous versions of the remote client	72
Launching the Configuration Wizard	72
Changing the database user password	76
Viewing active sessions	77
Disconnecting users	77
Viewing server properties	78
Viewing port status	78
Supported open source software products	79
SAN feature-to-firmware requirements	82
Accessibility features for the Management application	84
Keyboard shortcuts	84
Look and Feel	85
Setting the look and feel	85
Licenses	87
In this chapter	87
Overview	87
Managed count	88
Managed SAN port count calculation	88
Entering the license key	88
Upgrading the application	89
Discovery	91
In this chapter	91
SAN discovery overview	91
FCS policy and seed switches	92
Discovering fabrics	93
Editing the password for multiple devices	97
Configuring SNMP credentials	98
Reverting to a default SNMP community string	99
Removing a fabric from active discovery	99
Rediscovering a previously discovered fabric	100
Deleting a fabric	100
Viewing the fabric discovery state	100
Troubleshooting fabric discovery	101
M-EOSn discovery troubleshooting	102
Virtual Fabric discovery troubleshooting	103
SAN Fabric monitoring	104
Monitoring discovered fabrics	105
Stop monitoring of a discovered fabric	105
SAN Seed switch	106
Seed switch requirements	107
Seed switch failover	108
Changing the seed switch	109
Host discovery	110
Discovering Hosts by Network address or host name	110
Importing Hosts from a CSV file	112
Importing Hosts from a Fabric	113
Importing Hosts from a VM manager	115
Editing Host adapter credentials	116
Removing a host from active discovery	116
Rediscovering a previously discovered fabric	117
Deleting a host adapter from discovery	117
Viewing the host discovery state	118
Troubleshooting host discovery	118
VM Manager Discovery	119
Discovering a VM manager	119
Editing a VM manager	121
Excluding a host from VM manager discovery	121
Including a host in VM manager discovery	122
Removing a VM manager from active discovery	122
Rediscovering a previously discovered VM manager	122
Deleting a VM manager from discovery	123
Viewing the VM manager discovery state	123
Troubleshooting VM manager discovery	124
Application Configuration	125
In this chapter	125
Server Data backup	126
What is backed up?	126
Management server backup	126
Configuring backup to a writable CD	127
Configuring backup to a hard drive	128
Configuring backup to a network drive	129
Enabling backup	131
Disabling backup	131
Viewing the backup status	131
Changing the backup interval	132
Starting immediate backup	132
Reviewing backup events	133
Server Data restore	133
Restoring data	134
Restoring data to a new server	134
SAN Display	135
Setting your FICON display	135
Resetting your display	136
SAN End node display	137
Displaying end nodes	137
SAN Ethernet loss events	138
Enabling SAN Ethernet loss events	138
Disabling SAN Ethernet loss events	138
Event storage	139
Configuring event storage	139
Storing historical events purged from repository	140
Flyovers	140
Configuring flyovers	140
Turning flyovers on or off	143
Viewing flyovers	143
SAN Names	143
Setting names to be unique	144
Setting names to be non-unique	145
Fixing duplicate names	145
Viewing names	146
Adding a name to an existing device	146
Adding a name to a new device	147
Applying a name to a detached WWN	147
Removing a name from a device	148
Editing names	148
Exporting names	148
Importing Names	149
Searching for a device by name	149
Searching for a device by WWN	150
Security	151
Configuring the server name	151
Setting the CHAP secret	152
Configuring login security	152
Configuring the login banner display	153
Disabling the login banner	153
Syslog Registration	154
Registering a server as a Syslog recipient automatically	154
Configuring the Syslog listing port number	154
SNMP Trap Registration	155
Registering a server as a SNMP trap recipient automatically	155
Configuring the SNMP trap listing port number	155
SNMP Trap Forwarding Credentials	156
Configuring SNMP v1 and v2c credentials	156
Configuring SNMP v3 credentials	156
Software Configuration	157
Client export port	157
Configuring the client export port	157
Client/Server IP	159
Memory allocation	163
Configuring memory allocation settings	163
Product communication	166
Configuring SAN communication	166
FTP/SCP	167
Accessing the FTP server folder	167
Server port	171
Configuring the server port	171
Support mode	172
Configuring support mode settings	172
Fabric tracking	174
Enabling fabric tracking	174
Disabling fabric tracking	175
Accepting changes for a fabric	175
Accepting changes for all fabrics	176
Accepting changes for a switch, access gateway, or phantom domain	176
User Account Management	179
In this chapter	179
Users overview	179
Configuration requirements	179
User accounts	180
Creating a new user account	180
Copying a user account	181
Editing a user account	182
Assigning roles and areas of responsibility to a user account	183
Removing roles and areas of responsibility to a user account	183
Disabling a user account	184
Enabling a user account	184
Deleting a user account	185
Unlocking a user account	185
Password policies	186
Configuring a password policy	186
Viewing password policy violators	188
User profiles	188
Viewing your user profile	189
Editing your user profile	189
Changing your password	190
Viewing your password policy	190
Resetting optional messages	191
Configuring e-mail notification	191
Roles	192
Creating a new role	192
Adding privileges to a role	192
Removing privileges from a role	193
Copying a role	194
Editing a role	194
Deleting a role	195
Areas of responsibility	195
Creating an AOR	195
Assigning products to an AOR	196
Removing products from an AOR	196
Copying an AOR	197
Editing an AOR	197
Deleting an AOR	198
LDAP authorization	198
Loading an Active Directory group	198
Assigning roles and AORs to an Active Directory group	199
Removing roles and AORs from an Active Directory group	199
Deleting an Active Directory group	200
Call Home	201
In this chapter	201
About call home	202
System requirements	203
Showing a call home center	204
Hiding a call home center	205
Editing a call home center	205
Editing the Brocade International or IBM call home center	205
Editing the Brocade North America call home center	207
Editing an E-mail call home center	208
Editing the EMC call home center	209
Editing the HP LAN call home center	210
Enabling a call home center	211
Enabling support save	211
Testing the call home center connection	212
Disabling a call home center	212
Viewing Call Home status	213
Assigning a device to the call home center	214
Removing a device from a call home center	214
Removing all devices and filters from a call home center	215
Defining an event filter	215
Call Home for virtual switches	215
Assigning an event filter to a call home center	216
Assigning an event filter to a device	216
Overwriting an assigned event filter	217
Removing an event filter from a call home center	217
Removing an event filter from a device	218
Removing an event filter from the Call Home Event Filters table	218
Searching for an assigned Event Filter	218
View Management	219
In this chapter	219
View management overview	219
Creating a customized view	220
Editing a customized view	221
Deleting a customized view	223
Copying a view	223
SAN topology layout	224
Customizing the layout of devices on the topology	225
Customizing the layout of connections on the topology	226
Changing a group background color	226
Reverting to the default background color	227
Changing the product label	227
Changing the port label	228
Changing the port display	228
Grouping on the topology	229
Collapsing groups	229
Expanding groups	229
Viewing connections	229
Configuring custom connections	230
Saving a custom connection configuration	230
Deleting a custom connection configuration	231
Customizing the main window	231
Zooming in and out of the Connectivity Map	231
Zooming in	231
Zooming out	232
Showing levels of detail on the Connectivity Map	232
Viewing fabrics	232
Viewing groups	232
Viewing products	232
Viewing ports	232
Exporting the topology	232
Customizing application tables	233
Changing the order of columns	234
Resizing the columns	235
Sorting table information	235
Search	236
Searching for a device	237
Restricting a search by node	237
Searching for an exact match	238
Clearing search results	238
Third-party tools	239
In this chapter	239
About third-party tools	239
Starting third-party tools from the application	240
Launching a Telnet session	240
Launching an Telnet session from the SAN tab	240
Launching an Element Manager	241
Launching Web Tools	242
Launching FCR configuration	243
Launching Name Server	244
Launching HCM Agent	245
Launching Fabric Watch	246
Adding a tool	247
Entering the server IP address of a tool	248
Adding an option to the Tools menu	248
Changing an option on the Tools menu	250
Removing an option from the Tools menu	250
Adding an option to a device’s shortcut menu	251
Changing an option on a device’s shortcut menu	252
Removing an option from a device’s shortcut menu	253
Microsoft System Center Operations Manager (SCOM) plug-in	253
SCOM plug-in requirements	254
Registering a SCOM server	254
Editing a SCOM server	255
Removing a SCOM server	255
Server Management Console	257
In this chapter	257
Server Management Console overview	257
Launching the SMC on Windows	257
Launching the SMC on Linux	258
Services	258
Monitoring and managing Management application services	258
Refreshing the server status	259
Stopping all services	259
Stopping the CIMOM services	259
Starting all services	260
Restarting all services	260
Changing server port numbers	261
AAA Settings	261
Configuring a Radius server	261
Configuring an LDAP server	264
Configuring a TACACS+ server	266
Configuring switch authentication	267
Configuring Windows authentication	268
Configuring local database authentication	268
Displaying the client authentication audit trail	269
Restoring the database	269
Capturing technical support information	271
Upgrading HCM on the Management server	272
Defining the performance data aging interval	273
SMI Agent configuration	274
Launching the SMIA configuration tool on Windows	274
Launching the SMIA configuration tool on Unix	275
Launching a remote SMIA configuration tool	276
Service Location Protocol (SLP) support	276
SLP support includes the following components:	277
Home tab	280
Accessing Management application features	281
Authentication	281
Enabling or disabling CIM client and indication mutual authentication	281
CIMOM configuration	283
Configuring the SMI Agent port number	284
Certificate management	287
Importing a certificate	287
Viewing the configuration summary	289
SAN Device Configuration	293
In this chapter	293
Configuration repository management	293
Saving switch configurations	294
Restoring a switch configuration for a selected device	295
Backing up a switch configuration	296
Restoring a configuration from the repository	298
Viewing configuration file content	299
Searching the configuration file content	300
Deleting a configuration	301
Exporting a configuration	301
Importing a configuration	301
Keeping a copy past the defined age limit	302
Replicating configurations	302
Replicating security configurations	302
Enhanced group management	303
Firmware management	303
Displaying the firmware repository	304
Importing a firmware file and release notes	305
Deleting a firmware file	305
Download firmware	306
Properties	308
Viewing Fabric properties	308
Viewing device properties	309
Adding a property label	312
Editing a property label	312
Deleting a property label	313
Editing a property field	313
Ports	314
Viewing port connectivity	314
Refreshing the port connectivity view	317
Enabling a port	317
Disabling a port	317
Filtering port connectivity	318
Enabling the filter	319
Disabling the filter	319
Viewing port details	319
Viewing ports and port properties	320
Port types	323
Showing connected ports	323
Viewing port connection properties	324
Determining inactive iSCSI devices	327
Determining port status	327
Viewing port optics	328
Port Auto Disable	330
Viewing the port auto disable status	331
Configuring port auto disable triggers	332
Enabling port auto disable on individual ports	333
Enabling port auto disable on all ports on a device	334
Disabling port auto disable on individual ports	334
Disabling port auto disable on all ports on a device	335
Unblocking ports	336
Host Port Mapping	337
In this chapter	337
Host port mapping overview	337
Creating a new Host	338
Renaming an HBA Host	338
Deleting an HBA Host	339
Viewing Host properties	339
Associating an HBA with a Host	339
Importing HBA-to-Host mapping	340
Removing an HBA from a Host	341
Exporting Host port mapping	341
Storage Port Mapping	343
In this chapter	343
Storage port mapping overview	343
Creating a storage array	344
Adding storage ports to a storage array	344
Unassigning a storage port from a storage array	345
Reassigning mapped storage ports	345
Editing storage array properties	346
Deleting a storage array	346
Viewing storage port properties	347
Viewing storage array properties	347
Importing storage port mapping	348
Exporting storage port mapping	349
Host management	351
In this chapter	351
Host management	351
HCM software	352
HCM features	352
Host bus adapters	353
Converged network adapters	354
Fabric adapters	355
Host adapter discovery	355
Connectivity map	356
View management	356
Host port mapping	356
Adapter software	358
Driver repository	359
Boot Image Repository	360
Role-based access control	363
Host adapter management privileges	363
Host adapter administrator privileges	363
Host performance management	364
Host security authentication	365
Configuring security authentication using the Management application	365
supportSave on adapters	366
Host fault management	367
Adapter events	367
Event actions	367
Filtering event notifications	367
Syslog forwarding	368
Backup support	368
Configuring backup to a hard drive	368
Enabling backup	369
Disabling backup	369
Adapter port WWN virtualization	370
Configuring fabric-assigned port WWNs on switch ports	370
Configuring Fabric Assigned WWNs on attached AG ports	373
VM Manager	375
Adding a VM Manager	375
Editing VM Manager	376
Deleting VM Manager	376
Fibre Channel over Ethernet	377
In this chapter	377
FCoE overview	377
DCB exchange protocol	378
Enhanced Ethernet features	378
Enhanced transmission selection	378
Priority-based flow control	378
Ethernet jumbo frames	379
FCoE protocols supported	379
Ethernet link layer protocols supported	379
FCoE protocols	379
FCoE Licensing	380
Save running to startup	380
Copying switch configurations to selected switches	380
DCB configuration	381
Switch policies	382
DCB map and Traffic Class map	382
LLDP profiles	382
802.1x policy	382
Opening the DCB Configuration dialog box	383
Minimum DCB configuration for FCoE traffic	383
Adding a LAG	388
Editing a DCB switch	390
Editing a DCB port	391
Editing a LAG	393
Enabling a DCB port or LAG	395
Deleting a LAG	395
QoS configuration	396
Enhanced Transmission Selection	396
Priority-based flow control	396
Creating a DCB map	397
Editing a DCB map	398
Deleting a DCB map	399
Assigning a DCB map to a port or link aggregation group	400
Creating a traffic class map	401
Editing a traffic class map	401
Deleting a traffic class map	402
Assigning a traffic class map to a port or link aggregation group	402
FCoE provisioning	403
Changing the VLAN ID on the default FCoE map	404
Enabling or disabling the FCoE map on the port	405
VLAN classifier configuration	406
Adding a VLAN classifier rule	406
Editing a VLAN classifier rule	408
Deleting a VLAN classifier rule	408
Creating a VLAN classifier group	409

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1,000
1,001
1,002
1,003
1,004
1,005
1,006
1,007
1,008
1,009
1,010
1,011
1,012
1,013
1,014
1,015
1,016
1,017
1,018
1,019
1,020
1,021
1,022
1,023
1,024
1,025
1,026
1,027
1,028
1,029
1,030
1,031
1,032
1,033
1,034
1,035
1,036
1,037
1,038
1,039
1,040
1,041
1,042
1,043
1,044
1,045
1,046
1,047
1,048
1,049
1,050
1,051
1,052
1,053
1,054
1,055
1,056
1,057
1,058
1,059
1,060
1,061
1,062
1,063
1,064
1,065
1,066
1,067
1,068
1,069
1,070
1,071
1,072
1,073
1,074
1,075
1,076
1,077
1,078
1,079
1,080
1,081
1,082
1,083
1,084
1,085
1,086
1,087
1,088
1,089
1,090
1,091
1,092
1,093
1,094
1,095
1,096
1,097
1,098
1,099
1,100
1,101
1,102
1,103
1,104
1,105
1,106
1,107
1,108
1,109
1,110
1,111
1,112
1,113
1,114
1,115
1,116
1,117
1,118
1,119
1,120
1,121
1,122
1,123
1,124
1,125
1,126
1,127
1,128
1,129
1,130
1,131
1,132
1,133
1,134
1,135
1,136
1,137
1,138
1,139
1,140
1,141
1,142
1,143
1,144
1,145
1,146
1,147
1,148
1,149
1,150
1,151
1,152
1,153
1,154
1,155
1,156
1,157
1,158
1,159
1,160
1,161
1,162
1,163
1,164
1,165
1,166
1,167
1,168
1,169
1,170
1,171
1,172
1,173
1,174
1,175
1,176
1,177
1,178
1,179
1,180
1,181
1,182
1,183
1,184
1,185
1,186
1,187
1,188
1,189
1,190
1,191
1,192
1,193
1,194
1,195
1,196
1,197
1,198
1,199
1,200
1,201
1,202
1,203
1,204
1,205
1,206
1,207
1,208
1,209
1,210
1,211
1,212
1,213
1,214
1,215
1,216
1,217
1,218
1,219
1,220
1,221
1,222
1,223
1,224
1,225
1,226
1,227
1,228
1,229
1,230
1,231
1,232
1,233
1,234
1,235
1,236
1,237
1,238
1,239
1,240
1,241
1,242
1,243
1,244
1,245
1,246
1,247
1,248
1,249
1,250
1,251
1,252
1,253
1,254
1,255
1,256
1,257
1,258
1,259
1,260
1,261
1,262
1,263
1,264
1,265
1,266
1,267
1,268
1,269
1,270
1,271
1,272
1,273
1,274
1,275
1,276
1,277
1,278
1,279
1,280
1,281
1,282
1,283
1,284
1,285
1,286
1,287
1,288
1,289
1,290
1,291
1,292
1,293
1,294
1,295
1,296
1,297
1,298
1,299
1,300
1,301

Match case Limit results 1 per page

Brocade Network Advisor SAN User Manual

471

53-1002167-01

Steps for connecting to a TKLM appliance

Creating a self-signed certificate for TKLM

You must create a self-signed certificate for TKLM that can be downloaded to the Fabric OS

encryption engines to verify the authenticity of TKLM.

Select

Tivoli Key Lifecycle Manager > Configuration.

The

Configuration

page displays.

Select

Create self-signed certificate

Under

Certificate label in key store

, enter a certificate label.

Under

Certificate description (common name)

, enter a descriptive name.

Under

Validity period of new certificate

, enter the desired life time for the certificate.

Select

Tivoli Key Lifecycle Manager > Advanced Configuration > Server Certificates

to verify

that the certificate label is listed on

Administer Server Certificates

under

Certificates

Reboot the TKLM server.

Importing the Fabric OS encryption node KAC certificates to TKLM

The KAC certificates previously exported from the Fabric OS encryption nodes to an external LINUX

host must now be imported into the TKLM server file system. You must import the KAC certificate in

.der format. To do this, refer to

“Converting the KAC certificate format”

on page 470.

Import the KAC certificate from the external host into the TKLM server file system using a

binary file transfer mechanism using FTP, USB, or SCP.

Select

Tivoli Key Lifecycle Manager > Advanced Configuration > Client Certificates.

The

Client Certificates

page displays.

Select

Import > SSL Certificate

The

Import SSL/KMIP Certificates for Clients

page displays.

Enter the Fabric OS KAC certificate name in the

Certificate

field.

Under

File name and location

, enter or browse to the location where the imported KAC

certificate is stored.

Select

Trust

Select

Import

Verify that the imported certificate is valid and active.

Exporting the TKLM self-signed server certificate

The TKLM self-signed server certificate must be exported in preparation for importing and

registering the certificate on a Fabric OS encryption group leader node.

Enter the TKLM server wsadmin CLI.

For Linux (in ./wsadmin.sh):

<installed directory>/IBM/tivoli/tiptklmV2/bin/wsadmin.sh -username TKLMAdmin

-password <password> -lang jython