Upload the Client Certificate to Establish a Trusted Key Provider Trusted Connection

Some key server (KMS) vendors require that you upload the trusted key provider's client certificate to the key server. After the upload, the key server accepts traffic that comes from the trusted key provider.

Prerequisites

• Enable the Trust Authority Administrator.
• Enable the Trust Authority State.
• Collect Information About ESXi Hosts and vCenter Server to Be Trusted.
• Import the Trusted Host Information to the Trust Authority Cluster.
• Create the Key Provider on the Trust Authority Cluster.

Procedure

1. Ensure that you are connected to the vCenter Server of the Trust Authority Cluster. For example, you can enter $global:defaultviservers to show all the connected servers.
2. (Optional) If necessary, you can run the following commands to ensure that you are connected to the vCenter Server of the Trust Authority Cluster.

   Disconnect-VIServer -server * -Confirm:$false
   Connect-VIServer -server TrustAuthorityCluster_VC_ip_address -User trust_admin_user -Password 'password'

3. Assign the Get-TrustAuthorityKeyProvider -TrustAuthorityCluster $vTA information to a variable.
   For example:

   $kp = Get-TrustAuthorityKeyProvider -TrustAuthorityCluster $vTA

   If you are following these tasks in order, you previously assigned Get-TrustAuthorityCluster information to a variable (for example, $vTA = Get-TrustAuthorityCluster 'vTA Cluster').

   This variable obtains the trusted key providers in the given Trust Authority Cluster, in this case, $vTA.

   Note: If you have more than one trusted key provider, use commands similar to the following to select the one you want:

   Get-TrustAuthorityKeyProvider -TrustAuthorityCluster $vTA
   <The trusted key providers listing is displayed.>
   $kp = Get-TrustAuthorityKeyProvider -TrustAuthorityCluster $vTA | Select-Object -Last 1

   Using Select-Object -Last 1 selects the last trusted key provider in the list.

4. To create the trusted key provider client certificate, run the New-TrustAuthorityKeyProviderClientCertificate cmdlet.
   For example:

   New-TrustAuthorityKeyProviderClientCertificate -KeyProvider $kp

   The thumbprint is displayed.
5. To export the key provider client certificate, run the Export-TrustAuthorityKeyProviderClientCertificate cmdlet.
   For example:

   Export-TrustAuthorityKeyProviderClientCertificate -KeyProvider $kp -FilePath clientcert.pem

   The certificate is exported to a file.
6. Upload the certificate file to the key server.
   See your key server documentation for more information.

Results

The trusted key provider has established trust with the key server.