EMC® VNX® Series Security Configuration Guide for VNX

Adding or changing a Storage Processor SSL certificate using openssl

1. If this is new setup, create a private key. (Optional to set a passphrase for the key. If set, it is important to remember at later steps. In this example, emcemc is the passphrase used with server.key, specified in passin option.)
   Issue a command using the following syntax,

   openssl genrsa -des3 -out <server.key> 2048

2. To request a CSR (C=Country, ST=State, L=Location, O=Orginaisation, CN=CommonName - all are optional except the CN which must match the SP IP):
   Issue a command using the following syntax,

   openssl req -new -sha1 -key <server.key> -out <request.csr> -days <1825-5 years> -passin pass:emcemc -subj '/C=US/ST=Florida/L=Sarasota/O=MyCust/CN=10.0.0.1/'

3. When using an external CA, do the following, otherwise go to Step 4:
   1. Get the contents from request.csr certified by a CA.
   2. Have a copy of the CA signed certificate and go to step 6.
4. When using a self-signed certificate, do the following, otherwise go to Step 5:
   1. Issue a command using the following syntax, then go to step 6:

      openssl x509 -in <request.csr> -out <signed_cert.crt> -req -signkey server.key -days 1825

5. When using a private key obtained from a CA and sign. (This is a rare situation since a CA's private key usually will not be shared.)
   1. Issue a command using the following syntax, then go to step 6:

      openssl ca -cert <ca.cert> -keyfile <caprivate.key> -in <request.csr> -out <signed_cert.crt>

6. Pack the signed certificate and private key generated at step 1 (passout is for passphrase for the saved pfx file) using the following syntax:

   openssl pkcs12 -export -out <cert_with_key.pfx> -inkey server.key -in <signed_cert.crt> -passin pass:emcemc -passout
   pass:emcout

7. Import the PFX file on the Storage Processor using the following syntax:

   # naviseccli -h <SP_IP> -user <admin_user> -scope 0 -password <admin_password> security -pkcs12upload
   -file <cert_with_key.pfx> -passphrase <emcout> -descert

   If the above command reports any errors, corresponding action is required. Whole steps can be tried for SPB (and Control Station). For VNX Control Station, the certificate is stored in /nas/http/conf/ - the private key without password should be in ssl.key and ssl.crt is the signed certificate.