Configure and Customize Dell PowerFlex v3.6.x

Workflow for externally signed security certificates

The system generates and signs self-signed certificates automatically when secure communication is enabled, and no user intervention is required. You can replace the certificates by an externally signed security certificate. A Certificate Authority (CA) uses the CSR (Certificate Signing Request) file to create an externally signed security certificate.

1. Log in to the primary MDM with a security or administrator user role:

   scli --mdm_ip <primary_mdm_ip> --login --username admin --password <password>

2. Generate the CSR file on the primary MDM, for the specified MDM (target):

   scli --generate_mdm_csr_file --target_mdm_ip <mdm_ip>

   The file mdm-target_hostname.csr is created and saved to:

   • Linux: /opt/emc/scaleio/mdm/cfg
   • Windows: C:\Program Files\emc\scaleio\mdm\cfg
3. Send the generated CSR file to the CA for signing.
   The CA returns the following files:
   1. A certificate for each MDM.
   2. A trusted/root certificate and its' intermediate certificate from the CA.
4. On each MDM, from the CLI, add the root and intermediate certificate to the truststore, using the --add_certificate command. Refer to PowerFlex CLI Reference Guide for more information.

   scli --add_certificate --certificate_file root-ca.pem.crt

5. Run the following commands using Java's keytool to import all the certificates to each of the following components' truststore. It is recommended to restart the machine after running the commands.
   • PowerFlex Gateway
     • Linux: /opt/emc/scaleio/gateway/webapps/ROOT/WEB-INF/classes/certificates/truststore.jks
     • Windows (64 bit): C:\Program Files\EMC\ScaleIO\Gateway\webapps\ROOT\WEBINF\classes\certificates\truststore.jks
   • PowerFlex presentation server
     NOTE:Refer to "Update the certificate for the PowerFlex presentation server" for detailed steps on how to import the certificate from the MDM to the PowerFlex presentation server.
     • Linux: /etc/mgmt-server/.config/mdm-truststore.jks
   • vSphere plugin
     • Linux: $HOME/.vmware/scaleio/certificates
     • Windows: C:\Users\[user_name]\AppData\Roaming\VMware\scaleio\certificates\truststore.jks or C:\Windows\System32\config\systemprofile\AppData\Roaming\VMware\scaleio\certificates
   Trust is now established.
6. Save the signed certificate for the MDM in /opt/emc/scaleio/mdm/cfg.
7. Rename the MDM certificate file to mdm_signed_certificate.pem.
8. From the MDM, remotely log in to the primary MDM with a security or administrator user role:

   scli --mdm_ip <primary_mdm_ip> --login --username admin --password <password>

9. Run the following command to begin applying the signed certificate to each of the MDMs:

   /opt/emc/scaleio/mdm/bin/apply_signed_certificate.py --mdm_ip <primary_mdm_ip> --local_mdm_ip <local_mdm_ip>

   If the remote read-only feature is enabled on the MDM, add --skip_cli_command to the command, and later, while logged in with user that has security permissions, run the command scli --replace_mdm_security_files.

   NOTE:This step changes the MDM certificate, and might cause a brief failure period (switch ownership).