Frequently Asked Question
The TLS certificates that you specified in the configuration are not correct.
KMIP uses a TLS connection with is authenticated in both directions. From the client to the server and from the server to the client. As a result there 3 certificates that are required to establish a TLS with a KMIP server:
- The Root CA certificate that was used to sign the server's certificate.
- The server's certificate
- The client certificate
Most commonly, we see that the RootCA certificate specified is not actually the Root's CA cert. As a result, the server's certificate can not be verified and the session fails.
You can disable certificate verification on KVS's side. However KVS is meant to test that the TLS connection to the KMIP server is working, so it it recommended to correct the certificate issue. If wish to disable certificate verification, you may disable it in KVS by adding SSLOptions to the [KMIP Interop] section of your config like this
[KMIP Interop]
server = kmiptest1.p6r.com
port = 5696
rootPEM = RootCert.pem
certPEM = ClientCert.pem
privPEM = ClientPrivate.pem
privSize = 2048
compatMask = 0
SSLOptions = 0xC0000164
The "SSLOptions" configuration parameter (positive numeric value), is a bit mask. This allows control over the TLS connection between client and server. All possible values for SSLOptions can be found in the documentation.