Setting up a secure (SSL) connection

The storage systems can use SSL encryption for all connection paths, as shown in the following figure and table. The encryption protocol used for SSL encryption is TLS version 1.2.

• A: Path between the management client and the storage system.
• B: Path between the SVP and the management client.
• C: Path between the SVP and the storage system.
• D: Path between the management client and the storage system.

To prevent a man-in-the middle attack, the SSL encryption on path B (between the SVP and storage system) verifies the validity of the connection by using the certificate that was uploaded to the SVP in advance and by using the certificate of the storage system. The same certificate must be uploaded to the SVP and the storage system.

Parent Topic

• Setting up SSL communications

  Before you enable SSL encryption, you must create a private key and a public key to establish a secure communication session.

To improve security of remote operations from a Device Manager - Storage Navigator SVP to a storage system, you can set up Secure Sockets Layer (SSL) encrypted communication. By setting SSL encryption, the Device Manager - Storage Navigator User ID and Password are encrypted.

Parent Topic

• Setting up SSL communications

  Before you enable SSL encryption, you must create a private key and a public key to establish a secure communication session.

To enable SSL, you must create a keypair consisting of a public and a private key on the management client. The instructions use Windows 8.1 as an example.

Parent Topic

• Setting up SSL communications

  Before you enable SSL encryption, you must create a private key and a public key to establish a secure communication session.

Child Topics

• Creating a private key using the OpenSSL command
• Creating a public key using the OpenSSL command

......++++++ 
..++++++ 
is 65537 (0x10001) 
C:\key>c:\openssl\bin\openssl req -sha256 -new -key server.key -config c 
You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. 
\openssl\bin\openssl.cfg -out server.csr 
For some fields there will be a default value. 
If you enter '.', the field will be left blank. 
----- 
Country Name (2 letter code) [AU]:JP 
State or Province Name (full name) [Some-State]:Kanagawa 
Locality Name (eg, city) []:Odawara 
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Hitachi 
Organization Unit Name (eg, section) []:ITPD 
Common Name (eg, YOUR name) []:192.168.0.1 
Email Address []: 
Please enter the following 'extra' attributes 
to be sent with your certificate request 
A challenge password []:

After creating a private key and public key, obtain a signed public key certificate file. You can use any of these methods to obtain a signed certificate file.

• Create a certificate by self-signing. See Obtaining a self-signed certificate .
• Obtain a certificate from the certificate authority that is used by your company.
• Request an official certificate from an SSL certificate authority. See Obtaining a signed and trusted certificate.

Parent Topic

• Setting up SSL communications

  Before you enable SSL encryption, you must create a private key and a public key to establish a secure communication session.

Child Topics

• Obtaining a self-signed certificate
• Obtaining a signed and trusted certificate

Parent Topic

• Setting up SSL communications

  Before you enable SSL encryption, you must create a private key and a public key to establish a secure communication session.

Child Topics

• Releasing an SSL certificate passphrase
• Converting the SSL certificates to PKCS#12 format

  Uploaded SSL certificates need to be in PKCS#12 format.

C:\key>c:\openssl\bin\openssl rsa -in server.key -out server.key

Enter pass phrase for server.key: "Enter passphrase"

Writing RSA key

C:\key>c:\openssl\bin\openssl rsa -in server.key –out server.key

Writing RSA key

Before you begin

Procedure

1. In the maintenance utility Menu navigation tree, click System Management.

   

2. Click Update Certificate Files.

   
   NoteFor storage systems without an SVP, unselect the Connect to SVP box.

3. Select the Web Server checkbox, then click Browse.

4. Browse to the certificate file and click Open. The File Upload window closes and returns you to the Update Certificate Files dialog box.

5. Click Apply.

Parent Topic

• Setting up SSL communications

  Before you enable SSL encryption, you must create a private key and a public key to establish a secure communication session.

Child Topics

• Uploading the signed certificate for SSL communication between the SVP and management client to the SVP
• Uploading the certificates for “Connect to SVP” and “Web server” to the storage system
• Uploading the certificate for “Connect to SVP” to the SVP
• Uploading the web server certificate to the SVP
• Checking the web server certificate uploaded to the SVP

To allow your Web browser to automatically trust SSL certificates, you can import the SSL certificate into your Web browser.

Consult your Web browser's documentation for instructions to import the SSL certificate to the Web browser.

Parent Topic

• Setting up SSL communications

  Before you enable SSL encryption, you must create a private key and a public key to establish a secure communication session.

Before you begin

Procedure

1. Verify that HTTP communication is not already blocked by checking HTTP Blocking in the Storage Device List window on the SVP.

   • release: HTTP communication to the SVP is not blocked.
   • block: HTTP communication to the SVP is blocked.
   

   The value displayed in HTTP Blocking is updated periodically. Wait for a few minutes after changing the setting, or click the refresh button in the Storage Device List window.

   HTTP Blocking is displayed when the storage management software version is 93-06-01 or later. For software versions that do not display HTTP Blocking, connect HDvM - SN using the HTTP protocol from the management client, and then check HTTP Blocking.

2. Close all management client sessions on the storage system, including Storage Advisor Embedded, maintenance utility, and HDvM - SN.

3. Open a command prompt window with administrator permissions.

4. Move the current directory to the folder containing the SVP configuration tool (for example, C:\MAPP\wk\Supervisor\MappIniSet), and then execute the following command:

   MappHttpBlock.bat

5. When the completion message appears, press any key to acknowledge the message and close the message box.

6. Close the command prompt window.

Parent Topic

• Setting up SSL communications

  Before you enable SSL encryption, you must create a private key and a public key to establish a secure communication session.

Before you begin

Procedure

1. Close all management client sessions on the storage system, including Storage Advisor Embedded, maintenance utility, and Device Manager - Storage Navigator.

2. Open a command prompt window with administrator permissions.

3. Move the current directory to the folder containing the SVP configuration tool (for example, C:\MAPP\wk\Supervisor\MappIniSet), and then execute the following command:

   MappHttpRelease.bat

4. When the completion message appears, press any key to acknowledge the message and close the message box.

5. Close the command prompt window.

Parent Topic

• Setting up SSL communications

  Before you enable SSL encryption, you must create a private key and a public key to establish a secure communication session.

Before you begin

Procedure

1. Close all Device Manager - Storage Navigator sessions on the SVP.

2. On the management client, open a web browser, and then type the following URL to open the Tool Panel dialog box by using HTTPS connection.

   https://IP-address-or-host-name-of-SVP/cgi-bin/utility/toolpanel.cgi

3. In the Tool Panel dialog box, click TLS Security Settings to open the TLS Security Settings login dialog box.

   If SSL/TLS communication has been established, the Security Alert dialog box opens before the login dialog box opens. In the Security Alert dialog box, click OK.

   If the Security Alert dialog box for the certificate opens, click View Certificate to display the certificate, confirm that the certificate is correct, and then click Yes.

4. In the TLS Security Settings login dialog box, enter the administrator user ID and password, and then click Login.

5. In the TLS Security Settings dialog box, enter the required items.

   CautionWhen using TLS1.2, select the cipher suites corresponding to the key type of the certificate uploaded to the SVP.

   • If the key type is RSA, select a cipher suite whose name contains “RSA”.
   • If the key type is ECDSA, select a cipher suite whose name contains “ECDSA”.

   If the cipher suites are not set correctly, the SSL/TLS communications with the SVP fail, and then a problem, such as a Device Manager - Storage Navigator login error, occurs.

   When using TLS1.3, you can select both cipher suites regardless of whether the certificate key type is RSA or ECDSA.

6. In the TLS Security Settings dialog box, confirm the messages about the possible TLS communication failures and recommendations, and then select the check box for I understood that I canceled HTTP blocking or TLS communication might fail.

7. Click Next to perform a communication test. The Communication Test dialog box for TLS Security Settings opens.

8. The communication test using the security settings specified in step 5 starts automatically for the following communication paths:

   • SVP – Syslog Server
   • SVP – Key Management Server
   • SVP – LDAP Server
   • SVP – HCS server

9. Verify the results of the communication test for each communication path performed in the previous step. In the Communication Test dialog box for TLS Security Settings, wait until any of the following is displayed as the communication test result:

   • Normal: Communication is complete correctly.
   • Skipped: Connection settings are not made on Device Manager - Storage Navigator.
   • Error：Communication failed.

10. Confirm the communication test result, and then click Submit in the Communication Test dialog box for TLS Security Settings.

11. When prompted if you are sure you want to change the settings, click OK.

    The SVP web server restarts to reflect the security settings. When the SVP Web server restart is complete, the setting completion dialog box for TLS Security Settings opens.

12. Click OK to return to the login dialog box.

13. Back up the new security settings. For details, see Backing up HDvM - SN configuration files.

Parent Topic

• Setting up SSL communications

  Before you enable SSL encryption, you must create a private key and a public key to establish a secure communication session.

Before you begin

Procedure

1. In the maintenance utility Menu navigation tree, click System Management.

   

2. Click Select Cipher Suite.

3. Select the type of communication to use between the management client and the storage system.

   The selections change the encryption level. Higher encryption provides better security but the communication speed is slower. After you select a cipher suite, the available cipher suites differ depending on the connection path for SSL communications.
   • TLS_RSA_WITH_AES_128_CBC_SHA (Prioritize Transmission Speed): This selection provides higher communication speed and lower security.
   • TLS_RSA_WITH_AES_128_CBC_SHA256 (Prioritize Security): This selection provides higher security and lower communication speed.
   If you select either of the following cipher suites, enable the cipher suites for RSA key exchange on the SVP:
   • TLS_RSA_WITH_AES_128_CBC_SHA256
   • TLS_RSA_WITH_AES_128_CBC_SHA

   If you do not use either of these cipher suites, disable the cipher suites for RSA key exchange on the SVP.

4. Click Apply to save the setting and close the dialog box.

Parent Topic

• Managing SSL certificates

  When you use encrypted SSL communications to manage your storage system, you can select the desired cipher suite, update a signed certificate, and return an updated certificate to default.

You can use a web browser on the management client to check the following information about the certificate for SSL communications between the SVP and the management client:

• Issued to: <name or url>
• Issued by: <name or url>
• Valid from <date> to <date>

Parent Topic

• Managing SSL certificates

  When you use encrypted SSL communications to manage your storage system, you can select the desired cipher suite, update a signed certificate, and return an updated certificate to default.

Child Topics

• Checking the certificate for SSL communications using Internet Explorer
• Checking the certificate for SSL communications using Google Chrome

Before you begin

Procedure

1. Close all management client sessions on the storage system, including Storage Advisor Embedded, maintenance utility, and Device Manager - Storage Navigator.

2. Open a command prompt window with administrator permissions.

3. Move the current directory to folder containing the SVP configuration tool (for example, C:\MAPP\wk\Supervisor\MappIniSet), and then execute the following command:

   MappApacheCrtUpdate.bat absolute-path-of-signed-public-key-certification-file absolute-path-of-private-key-file
   Note

   • A space is required between MappApacheCrtUpdate.bat and the signed public key certification file path.
   • A space is required between the signed public key certification file path and the private key file path.

4. When the completion message appears, press any key to acknowledge the message and close the message box.

5. Close the command prompt window.

Parent Topic

• Managing SSL certificates

  When you use encrypted SSL communications to manage your storage system, you can select the desired cipher suite, update a signed certificate, and return an updated certificate to default.

Before you begin

Procedure

1. Close all management client sessions on the storage system, including Storage Advisor Embedded, maintenance utility, and Device Manager - Storage Navigator.

2. Open a command prompt window with administrator permissions.

3. Move the current directory to the folder containing the SVP configuration tool (for example, C:\MAPP\wk\Supervisor\MappIniSet), and then execute the following command:

   MappApacheCrtInit.bat

4. When the completion message appears, press any key to acknowledge the message and close the message box.

5. Close the command prompt window.

Parent Topic

• Managing SSL certificates

  When you use encrypted SSL communications to manage your storage system, you can select the desired cipher suite, update a signed certificate, and return an updated certificate to default.

When the message "There is a problem with this website's security certificate." is displayed, click Continue to this website (not recommended).

When you are using encrypted SSL communications to connect to the storage system, the browser displays a warning message if the security certificate is not issued by a trusted certificate authority. This warning message also appears when the IP address or host name specified in the URL does not match the CN listed in the security certificate.

If this warning message starts to appear after an update of the storage management software, check to see if the SSL certificate returned to the default. If the SSL certificate has returned to the default, install the certificate file that was backed up when the storage management software was updated.

Parent Topic

• Managing SSL certificates

  When you use encrypted SSL communications to manage your storage system, you can select the desired cipher suite, update a signed certificate, and return an updated certificate to default.

The Update Certificate Files window is used to update the certificates that are used for communication between the management client and the storage system.

Before you begin

Procedure

1. In the maintenance utility Menu navigation tree, click System Management.

   

2. Click Update Certificate Files.

   
   NoteFor storage systems without an SVP, unselect the Connect to SVP box.

3. To update the certificate file on the management client:

   1. Select the Web Server checkbox, then click Browse.

   2. Browse to the certificate file and click Open. The File Upload window closes and returns you to the Update Certificate Files dialog box.

   3. In the Web Server Password: field, enter the certificate password.

   4. Enter the password again in the Web Server Re-enter Password: field.

   NoteFor storage systems without an SVP, continue to step 5.

4. To update the certificate file on the SVP:

   1. Select the Connect to SVP checkbox, then click Browse.

   2. Browse to the certificate file and click Open. The File Upload window closes and returns you to the Update Certificate Files dialog box.

   3. In the Connect to SVP Password: field, enter the certificate password.

   4. Enter the password again in the Connect to SVP Re-enter Password: field.

5. Click Apply to update the certificates.

Parent Topic

• Managing SSL certificates

  When you use encrypted SSL communications to manage your storage system, you can select the desired cipher suite, update a signed certificate, and return an updated certificate to default.

Before you begin

{
"user": "someuser",
"password": "password123",
"innerConnectionCertPath": "c:\\sslcert\\innercert.crt",
"innerPrivateKeyPath": "c:\\sslcert\\innercert.key",
"outerConnectionCertPath": "c:\\sslcert\\outercert.crt",
"outerPrivateKeyPath": "c:\\sslcert\\outercert.key"
}

Procedure

1. On the SVP, start Windows command prompt as an Administrator.

2. Move the current directory to the directory where the tool exists

   cd /d C:\Mapp\wk\Supervisor\MappIniSet
   Note

   • C:\Mapp indicates the installation directory of the storage management software and the SVP software. When the installation directory other than C:\Mapp was specified, replace C:\Mapp with the specified installation directory.
   • If you specify --ignore-cert-verification, the signed certificate for SSL communication between the SVP and the management client is not verified when the certificate is updated. Specify this option immediately after you install HDvM - SN on the SVP or when the certificate has not been normally updated. (You must check the IP address of the GUM on the storage system beforehand.)
   • If you specify --delete, the parameter file is automatically deleted after the SSL certificate is updated.

3. Run the following command:

   mappsslcertupdate.bat
           --file=name-of-the-parameter-file-created-beforehand

4. A message appears indicating that the command finished, and then the GUM restarts automatically.

5. Restart the SVP manually.

Parent Topic

• Managing SSL certificates

  When you use encrypted SSL communications to manage your storage system, you can select the desired cipher suite, update a signed certificate, and return an updated certificate to default.

Before you begin

Procedure

1. Close all Device Manager - Storage Navigator sessions on the SVP.

2. Open a command prompt window with administrator permissions.

3. Move the current directory to the folder containing the SVP configuration tool (for example, C:\MAPP\wk\Supervisor\MappIniSet), and then execute the following command:

   MappHcsCrtEntry.bat absolute-path-of-signed-public-key-certificate-file

   If you are using Hitachi Ops Center Administrator, execute the same command.

   NoteA space is required between MappHcsCrtEntry.bat and the signed public key certification file path.

4. When the completion message box appears, press any key to acknowledge the message and close the message box.

5. Close the command prompt window.

Parent Topic

• Administering management software certificates

Before you begin

Procedure

1. Close all Device Manager - Storage Navigator sessions on the SVP.

2. Open a command prompt window with administrator permissions.

3. Move the current directory to the folder containing the SVP configuration tool (for example, C:\MAPP\wk\Supervisor\MappIniSet), and then execute the following command:

   MappHcsCrtDelete.bat

   Use this command for Ops Center Administrator and for HCS.

4. When the completion message box appears, press any key to acknowledge the message and close the message box.

5. Close the command prompt window.

Parent Topic

• Administering management software certificates

Procedure

1. On the SVP, open a command prompt with administrator permissions.

2. Move the current directory to the folder containing the setting tool.

3. Execute the following command:

   cd /d C:\Mapp\wk\Supervisor\MappIniSet
   MappHstsEnable.bat
   

   Note C:\Mapp: indicates the installation directory of the storage management software and SVP software. If you specified a different installation directory, replace C:\Mapp with the specified installation directory.

4. When prompted, press any key to continue.

5. To verify that HSTS is enabled, execute the following command:

   MappHstsState.bat

   • If "hsts=on" appears, HSTS is enabled. Press the Enter key, and then go to the next step.
   • If "hsts=off" appears, HSTS is not enabled. Press the Enter key, and then go back to step 3.
   • If a message indicating that the specified file could not be found appears, the HSTS settings failed. Press the Enter key, and then go back to step 3.

6. Close the command prompt window.

Parent Topic

• Using HSTS

Procedure

1. Open a command prompt with administrator permissions on the SVP.

2. Move the current directory to the folder in which the setting tool is located, and then execute the following command:

   cd /d C:\Mapp\wk\Supervisor\MappIniSet
   MappHstsDisable.bat
   

   Note C:\Mapp: indicates the installation directory of storage management software and SVP software. If you specified an installation directory other than C:\Mapp, replace C:\Mapp with the specified installation directory.

3. When "Press any key to continue ..." appears in the window, press the Enter key.

4. To verify that HSTS is disabled, execute the following command:

   MappHstsState.bat
   Note

   If "hsts=off" appears, HSTS is disabled. Press the Enter key. If "hsts=on" appears, HSTS is not disabled. Press the Enter key, and then go back to step 2.

   If the message indicating that the specified file could not be found appears, the HSTS settings failed. Press the Enter key, and then go back to step 2.

5. Close the command prompt window.

Parent Topic

• Using HSTS