PowerScale OneFS 9.5.0.0 CLI Administration Guide

Generate and install certificates

Authorization, authentication, and encryption are provided by Transport Layer Security (TLS) certificates. Certificates are required for daemon startup and all communication between Datamover engines. TLS requires valid certificates (identity + CA) to be installed before the Datamover daemon finishes startup. TLS will periodically recheck for certificates and start up when it finds them. The following steps to generate certificates create a minimal operational environment for Datamover. Note that these steps are intended as a demonstration. Customize these steps to integrate with your existing PKI processes.

1. Create a Certificate Authority (CA) (once for each identity or trust group). Each system has one or more CA certificates. These certificates are used to check whether the Identity Certificate that is presented by a peer system should be trusted.

   openssl genrsa -out ca.key 4096
   openssl req -x509 -new -nodes -key ca.key -sha256 -days 1825 -out ca.pem

2. Generate the Identity Certificate (once for each Datamover system). Every cluster running Datamover must have exactly one Identify Certificate. The Identity Certificate uniquely identifies the system that it belongs to, and the Identity Certificate is signed by a CA.

   openssl genrsa -out identity.key 4096
   openssl req -new -key identity.key -out identity.csr

3. Sign the identity with CA (once for each identity).

   cat << EOF > identity.ext
   authorityKeyIdentifier=keyid,issuer
   basicConstraints=CA:FALSE
   keyUsage=digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
   EOF
   openssl x509 -req -in identity.csr -CA ca.pem -CAkey ca.key -CAcreateserial -out identity.crt -days 825 -sha256 -extfile identity.ext

4. Install one identity and the CA that signed that identity on each Datamover system. To establish trust between system A and system B, for example:
   • On system A, install the CA that signed system B's identity.
   • On system B, install the CA that signed system A's identity.
   • These may be the same if the same CA signed both system A and system B's identities.
   Install a CA certificate by running the isi dm certificates ca create command. This command requires that the CA certificate be located under the /ifs tree. Note that locating the CA certificated under the /root tree will not work..

   isi dm certificates ca create "$PWD"/ca.pem --name descriptive-ca-name

   Install an Identity.

   isi dm certificates id create "$PWD"/identity.crt --certificate-key-path "$PWD"/identity.key --name descriptive-identity-name

   If the CA that signed the identity certificate is not installed, the cluster cannot communicate with itself over a loopback. This could be a valid configuration, but in most cases you should also install the signing CA.