Some Key Management Server (KMS) vendors require that you configure the trusted key provider with the client certificate and private key provided by the KMS. After you configure the trusted key provider, the KMS accepts traffic from the trusted key provider.

Prerequisites

Procedure

  1. Ensure that you are connected to the vCenter Server of the Trust Authority Cluster. For example, you can enter $global:defaultviservers to show all the connected servers.
  2. (Optional) If necessary, you can run the following commands to ensure that you are connected to the vCenter Server of the Trust Authority Cluster.
    Disconnect-VIServer -server * -Confirm:$false
    Connect-VIServer -server TrustAuthorityCluster_VC_ip_address -User trust_admin_user -Password 'password'
  3. Assign the Get-TrustAuthorityKeyProvider -TrustAuthorityCluster $vTA information to a variable.
    For example:
    $kp = Get-TrustAuthorityKeyProvider -TrustAuthorityCluster $vTA

    If you are following these tasks in order, you previously assigned Get-TrustAuthorityCluster information to a variable (for example, $vTA = Get-TrustAuthorityCluster 'vTA Cluster').

    The $kp variable obtains the trusted key providers in the given Trust Authority Cluster, in this case, $vTA.
    Note: If you have more than one trusted key provider, use commands similar to the following to select the one you want:
    Get-TrustAuthorityKeyProvider -TrustAuthorityCluster $vTA
    <The trusted key providers listing is displayed.>
    $kp = Get-TrustAuthorityKeyProvider -TrustAuthorityCluster $vTA | Select-Object -Last 1

    Using Select-Object -Last 1 selects the last trusted key provider in the list.

  4. Upload the certificate and private key using the Set-TrustAuthorityKeyProviderClientCertificate command.
    For example:
    Set-TrustAuthorityKeyProviderClientCertificate -KeyProvider $kp -CertificateFilePath <path/to/certfile.pem> -PrivateKeyFilePath <path/to/privatekey.pem>

Results

The trusted key provider has established trust with the KMS.