Skip to main content
Sign Out

Welcome to Dell

My Account
  • Place orders quickly and easily
  • View orders and track your shipping status
  • Enjoy members-only rewards and discounts
  • Create and access a list of your products
  • Manage your Dell EMC sites, products, and product-level contacts using Company Administration.
Sign In Create an Account Dell Financial Services Premier Sign In Partner Program Sign In
Contact Us

Your Dell.com Carts

EMC® VNX® Series Security Configuration Guide for VNX

PDF

SSL certificates

Any time a client connects to a server over a network, it is important that the client can verify the identity of the server. Otherwise, any node on the network can impersonate the server and potentially extract information from the client. This is known as a man-in-the-middle attack.

Unisphere uses public key cryptography to verify the identity of the storage management server. Each VNX SP and Control Station contains a PKI certificate with a corresponding public key that the storage management server presents to a client. The certificates will be self-signed by default, but users have the ability to import certificates that have been signed by a trusted third party. If the client has the root certificate for that trusted third party (web browsers have certificates from common certificate authorities pre-installed) then it can inherently trust the server. This is the same mechanism by which your web browser inherently trusts most secure web sites.

NOTE: VNX systems inherently support SHA-1 certificates. For SHA-2 support, you must import your own SHA-2 certificates.

Certificates should contain 2048-bit RSA encrypted keys but keys containing as low as 1024 bits are allowed to be imported. For VNX for block, the interface for managing user certificates is found at:

https://<SP_IP_address>/setup, which requires username and password authentication, or with the naviseccli security -pkcs12upload switch.

NOTE:For more information about the interface for managing user certificates for VNX for block, see VNX for block SSL certificate import. For more information about the naviseccli commands, see the VNX Series Command Line Interface Reference for Block, located on mydocs.emc.com.

Unisphere not only verifies the certificate of the storage system it is connected to, it also verifies certificates for all the VNX systems in the domain. Other client software like Unisphere Service Manager (USM), CLI, and Unisphere Server Utility will perform certificate verification when connecting to the storage system. The management server that is running on the storage system will also verify certificates when connecting to external servers like LDAP and ESX/Virtual Center.

How it works

When a client (such as Unisphere, CLI, or USM) connects to a server (such as the Storage management server or LDAP) for the first time, it is presented with a certificate from the server. The user can check the details of the certificate and decide to accept the certificate or reject it. If the user rejects the certificate, the communication with the server is stopped. If the user decides to accept the certificate, the communication continues and the certificate is stored in a certificate store. The next time when the client communicates with that server, the server's certificate is verified with the certificate in the certificate store. The user is prompted the first time it communicates with a server. Once the certificate is stored, the certificate verification process will happen in the background.

The following options are presented to the user when connecting to a server for the first time:

  • Accept for session - Accepts the certificate to manage the system for this session only. The user will be prompted again in future sessions to accept the certificate.
  • Accept Always - By selecting this option, the certificate is stored in the certificate store on the client; for subsequent communications the certificate is verified as a background task. The user will not be prompted again.
  • Reject - If the user does not trust the certificate, the user can opt to reject the certificate and the communication will be stopped.

Unisphere and USM use the Java certificate store for storing certificates. The certificates store can be managed using the Java control panel. Block CLI and Unisphere Server Utility create a certificate store on the user directory of the client. Unisphere, USM, and Unisphere Server Utility will enforce certificate verification when connecting to the storage system.

The storage management server also performs certificate verification when communicating with LDAP and the ESX/Virtual Center server. The certificates are stored on the storage system and appear in Trusted Certificates for LDAP and VMware Servers (in Unisphere use Settings > Security > Server Certificates for Block).

Rate this content

Accurate
Useful
Easy to understand
Was this article helpful?
0/3000 characters
  Please provide ratings (1-5 stars).
  Please provide ratings (1-5 stars).
  Please provide ratings (1-5 stars).
  Please select whether the article was helpful or not.
  Comments cannot contain these special characters: <>()\