PowerScale OneFS 9.2.1.0 CLI Administration Guide

Configure certificates

You can configure certificates for SyncIQ policy encryption.

1. On the Source cluster, install the identity certificate and private key pair to the server certificate store.

    isi sync cert server import SourceClusterCert.pem SourceClusterKey.pem --set-certificate-key-password
    --name myClusterCertID

   You will be prompted to enter the certificate key password, and then to confirm that password.
2. On the Source cluster, set the newly installed ID from the server store as your SyncIQ cluster certificate. The full ID of the certificate is displayed when the -v option is used to the server store list command.

   isi sync cert server list -v
    isi sync setting mod –cluster-certificate-id=<fullID>
   

3. On the Source cluster, install the Source cluster CA to the global cluster CA store. This CA was used to issue TargetClusterCert.pem.

   isi cert auth import TargetClusterCA.pem --name SyncIQTargetCA

4. On the Source cluster, add the Target’s certificate to the whitelist peer certificate store.

    isi sync cert peer import TargetClusterCert.pem --name SyncIQTargetClusterCert

   NOTE This step requires the end-entity certificate for each SyncIQ peer be shared with the peer. This action is not an SSL requirement. It is an implementation specific requirement to add a whitelist layer of security to SyncIQ encryption policies. The associated private key for peer certificates should not be shared when exchanging end-entity certificates with peers.
5. On the Target cluster, install the identity certificate and private key pair to the server certificate store.

   isi sync cert server import TargetClusterCert.pem TargetClusterKey.pem --certificate-key-password
   <string> --name myClusterCertID

6. On the Target cluster, set the newly installed ID from the server store as your SyncIQ cluster certificate. The full ID of the certificate is displayed when the -v option is used to the server store list command.

    isi sync cert server list -v
    isi sync setting mod –cluster-certificate-id=<fullID>
   

7. On the Target cluster, install the Source cluster CA to the global cluster CA store. This CA that was used to issue SourceClusterCert.pem.

    isi cert auth import SourceClusterCA.pem --name SyncIQSourceCA

8. On the Target cluster, add the Source's certificate to the whitelist peer certificate store.

    isi sync cert peer import SourceClusterCert.pem --name SyncIQSourceClusterCert

   NOTE This step requires the end-entity certificate for each SyncIQ peer be shared with the peer. This action is not an SSL requirement. It is an implementation specific requirement to add a whitelist layer of security to SyncIQ encryption policies. The associated private key for peer certificates should not be shared when exchanging end-entity certificates with peers.