Ordering KMIP for VMware instances

Settings

When you order a KMIP for VMware instance, configure the following settings:

Procedure

1. In the IBM Cloud for VMware Solutions console, scroll down to the services section and click KMIP for VMware in the Security and compliance category.
2. On the KMIP for VMware page, configure the service settings as needed.
3. Click Create.

Results of Step 1

• The deployment of the instance starts automatically and you receive console notification that your order request is being processed. The instance is displayed in the KMIP for VMware table on the KMIP for VMware > Resources pages from the IBM Cloud for VMware Solutions console. The status of the instance is Installing.
• When the instance is successfully deployed, its status is changed to Inactive.

Prerequisites

If you are using Hyper Protect Crypto Services (HPCS), you must first create a service authorization that allows your KMIP for VMware instance to access your HPCS instance. Then, grant your KMIP for VMware instance both the platform Viewer role and the service VMware KMIP Manager role to your HPCS instance. For more information, see Grant service-to-service authorization in IAM.

Settings

When you enable the nonactive KMIP for VMware instance, provide the following settings according to the key management service that you selected.

Procedure

1. Select the key management type, either Hyper Protect Crypto Services or Key Protect.

2. Select a key management service:

   • For Hyper Protect Crypto Services, click Retrieve to get the list of available HPCS instances and select the one to use for key management.
   • For Key Protect, enter your service ID API key, then click Retrieve to get the list of available key manager instances and select the one to use for key management.

3. Select the Key Manager instance from the list.

4. For Key Protect, under Customer key ring, the names of the key rings that belong to the selected Key Manager instance are displayed. Select the Customer key ring from the list.

   For HPCS, the key ring field is not displayed.

5. Under Customer root key, the names and values of the root keys are displayed. Select the root key that you want.

6. (Optional) Add client SSL certificates:

   1. Click Add.

   2. In the Add client SSL certificate window, enter the name and contents of the certificate, and then click Add.

      The certificate name cannot be reused within your selected instance. The certificate content must be valid and contain the BEGIN CERTIFICATE and END CERTIFICATE tags. When you use Key Protect, the certificate cannot be reused in the region where the instance is deployed.

7. Click Configure.

Results of Step 2

• The configuration of the instance starts automatically. The status of the instance is changed to Configuring.
• When the instance is ready to use, the status of the instance is changed to Installed.

Procedure

1. From the IBM Cloud for VMware Solutions console, click Resources > KMIP for VMware from the left navigation pane.

2. In the KMIP for VMware table, click the instance that you want to add certificates for.

3. Click Add.

4. In the Add client SSL certificate window, enter the certificate name and content, and then click Add.

   The certificate name cannot be reused within your selected instance. The certificate content must be valid and contain the BEGIN CERTIFICATE and END CERTIFICATE tags, and the certificate cannot be reused in the selected region where the instance is deployed.

Results of Step 3

• You get a console notification that your request to add the certificate is being processed.
• When the certificate is added successfully, you get console confirmation and the added certificate is displayed in the Client SSL certificates table on the service details page.