Configuring InfoScale to enable transfer of keys

1. Be ready with the IP address and port number of the Key Management Server (KMS).
2. Run echo "<IP address of the server >"| base64

Server output for base64

1. Run echo "<Port number of the server >"| base64

Port number output for base64

1. Copy the following content into a file and save it as infoscale-kmip-secret.yaml.
   apiVersion: v1
data:
  host: <Server output for base64>
  port: <Port number output for base64>
kind: Secret
metadata:
  name: infoscale-kmip-encrypt
  namespace: infoscale-vtas
type: Opaque
   1. Run oc apply -f infoscale-kmip-secret.yaml to deploy the InfoScale secret.
   2. From another terminal, login to the Key Management Server - https:// <IP address of the server>:<port number>/ibm/SKLM/login.jsp.
   3. Select Advanced Configuration > Server Certificate. Click** Add**. The Add SSL/KMIP Certificate screen opens.
   4. Select Request certificate from a third-party provider and enter values forCertificate labelandCertificate description.
   5. Click Add Certificate. The certificate is listed as Administer Server Certificates.
   6. Review the Status of the certificate. The status is Certificate is pending.
   7. From the bastion node, run ssh root@<IP address of the KMS >. Enter the password and login.
   8. The certificate you just created is listed under /opt/IBM/WebSphere/AppServer/products/sklm/ as <Time stamp>_<Certificate name>.csr.
   9. Copy content of /opt/IBM/WebSphere/AppServer/products/sklm/<Time stamp>_<Certificate name>.csr into another file <Copy of server cert content>.pem.
   10. Run openssl x509 -req -in <Time stamp>_<Certificate name>.csr -CA infoscale-ca.pem -CAkey infoscale-ca-key.pem -CAcreateserial -out <server-certificate-name> -days 1024 -sha256
   11. Review the output as under
   -out \<server-certificate-name\> -days 1024 -sha256
2. Run openssl x509 -req -in <Copy of server cert content>.pem -CA infoscale-ca.pem -CAkey infoscale-ca-key.pem -CAcreateserial -out <Certificate name>.crt -days 1024 -sha256
3. Review the output for the following message.
   Signature ok
   1. Copy <Certificate name>.crt to the root directory of the Key Management server.
   2. On the Welcome screen of KMS, click Third-party certificates pending import.
   3. In the Import Certificate screen, click Browse and navigate to the certificate you saved. ClickSelect.
   4. Run oc get secret -n infoscale-vtas.
   5. Review the output for the following
   NAME
infoscale-ca
4. Run oc get secret -n infoscale-vtas.
5. Review the output for the following

NAME
infoscale-kmip-encrypt

1. Run oc -n infoscale-vtas get secret infoscale-ca -o jsonpath="{.data['tls\.crt']}" | base64 --decode >> <device-certificate>.crt,

1. Copy <device-certificate>.crt to the root directory of the KMS.
2. On the KMS, select Advanced Configuration > Client Device Certificates. Click** Import**.
3. In the Import SSL/KMIP Certificate for Clients window, assign a name and click Browse to select <device-certificate>.crt from the root directory.
4. Select the checkbox next to Allow the server to trust this certificate with the associated client device.
5. Click Import.

Related information