Configuring a SafeNet KeySecure Server for KMIP

1. Navigate to "Security -> Local CAs" and create a local CA to use for the KMIP server.
2. Navigate to "Security ->Trusted CA Lists" and add the certificate authority you created to the trusted list.
3. Create a server certificate.
   1. Navigate to "Security -> SSL Certificates" and create a Certificate Signing Request (CSR). Be sure that the "Common Name" and the "Subject Alternative Name" are set to the hostname that you will use for your KMIP server.
   2. Navigate to "Security -> Local CAs" and click on the "Sign Request" button to sign the CSR you just created.
4. Goto "Security -> Local Authentication" and create a user. The username MUST be used as the CN of the client certificate.
5. Create a Certificate Signing Request (CSR) for your client cert locally (the CN MUST be identical to the username created in step 4).
   You can create a CSR locally using the following OpenSSL commands:
   1. Create a private key (just hit "Enter" when requested to provide a passkey):
      
      $ openssl genrsa -out /path/to/www_server_com.key 2048
      
      
   2. Create the Certificate Signing Request
      
      $ openssl req -new -key /path/to/www_server_com.key -out /path/to/www_server_com.csr
      
      You will now be prompted to enter the information which will be incorporated into your CSR. This information is also known as the Distinguished Name, or DN. Some fields are required, while others are optional and can be left blank.
      
      

      Hit Enter to move forward through each item:

      1. The Country Name is mandatory and takes a two-letter country code.
      2. The State or Province Name field requires a full name – do not use an abbreviation.
      3. The Locality Name field is for your city or town.
      4. In the Organization Name field, add your company or organization.
      5. Organizational Unit Name is an optional field for your department or section.
      6. The Common Name field (this MUST be set to the username created in step 4).
      7. Email address is an optional field for this request. (You can hit Enter to skip forward.)
      8. The challenge password and optional company name fields are optional and can be skipped as well.
         
6. Next naviagte to "Security -> Local CAs" and select your CA and click "Sign Request". Paste your certificate into the textbox and sign the request.
7. Navigate to "Device -> Key Servers" and add/edit a KMIP server. Set the server certificate to the one you created in Step 2 above.
   1. Set "Client Certificate Authentication" to "Used for SSL session and username".
   2. Set "Trusted CA Profile" to the correct profile.
   3. Set "Username field in client certificate" to "CN (Common Name)"
   4. Check "Allow Key Export"
   5. Check "Allow Key and Policy Configuration Operations"
   6. Click "Save"