EMC® VNX® Series Security Configuration Guide for VNX

Import a CA-signed certificate

1. Obtain the signed certificate (for example, cert.pem) from the CA.
2. Query all Data Movers to determine which personas are waiting for a signed certificate:
   $ server_certificate ALL -persona -list

   Output:

   server_2 :
   id=1
   name=default
   next state=Request Pending 
   request subject = CN=name;CN=1.2.3.4 
   server_3 : 
   id=1
   name=default
   next state=Request Pending 
   request subject = CN=test;CN=5.6.7.8

3. To determine to which persona to import the certificate, match the certificate’s subject with the value of the Request Subject field for those personas whose Next State is Request Pending.
4. Import the signed certificate to the waiting persona by using this command syntax:
   $ server_certificate <movername> -persona -import {<persona_name>|id=<persona_id>}

   where:

   <movername> = name of the physical Data Mover with which the persona is associated.

   <persona_name> = name of the persona.

   <persona_id> = ID of the persona. The ID is generated when the persona is created.

   NOTE: The signed certificate can be in either DER or PEM format. You can only paste text in PEM format at the command prompt. If you specify -filename and provide a path, you can import a CA-signed certificate in either DER or PEM format.

   Example:

   To import the signed certificate, type:

   $ server_certificate server_2 -persona -import default

   Output:

   server_2 : Please paste certificate data. Enter a carriage 
   return and on the new line type ‘end of file’ or ‘eof’ 
   followed by another carriage return.

   NOTE: After the certificate text is pasted correctly, the system prompt is displayed.
5. Verify that the certificate has been imported successfully by using this command syntax:
   $ server_certificate<movername>-persona -info{-all| <persona_name>| id=<persona_id>}

   where:

   <movername> = name of the physical Data Mover with which the persona is associated.

   <persona_name> = name of the persona.

   <persona_id> = ID of the persona. The ID is generated when the persona is created.

   Example:

   To verify that the certificate for the default persona has been imported successfully, type:

   $ server_certificate server_2 -persona -info default

   Output:

   server_2
   id=1
   name=default
   next state=Not Available
   Current Certificate: 
     id              = 1
     subject         = CN=name;CN=1.2.3.4
     issuer          = O=Celerra Certificate Authority;CN=eng173100
     start date      = 20070606183824Z
     end date        = 20070706183824Z
     serial number   = 05
     signature alg.  = sha1WithRSAEncryption
     public key alg. = rsaEncryption
     public key size = 4096
     version         = 3

   NOTE: Typically, after a certificate is imported, it immediately becomes the current key set and certificate, and the Next State field is shown as Not Available. If the imported certificate is not valid (for example, its time stamp is several minutes or more ahead of the Data Mover), the imported key set and certificate remain the next key set and certificate, and the Next State field is shown as Available until such time as the key set and certificate become valid.