Setting up a secure (SSL) connection
You can use a Secure Sockets Layer (SSL) certificate to create a secure, encrypted connection between the storage system and the management client.
Setting up SSL communications
Before you enable SSL encryption, you must create a private key and a public key to establish a secure communication session.
The following figure shows the procedure to set up SSL communication. Unless otherwise noted, all steps are required. Note that creation of private and public keys requires a dedicated program. You can download a program for creating private and public keys from the OpenSSL website (http://www.openssl.org/).
Setting up SSL encryption
To improve security of remote operations from a Device Manager - Storage Navigator SVP to a storage system, you can set up Secure Sockets Layer (SSL) encrypted communication. By setting SSL encryption, the Device Manager - Storage Navigator User ID and Password are encrypted.
Creating a keypair
To enable SSL, you must create a keypair consisting of a public and a private key on the management client. The instructions use Windows 7 as an example.
Creating a private key
A private key is required to create an SSL keypair. The following procedure for Windows 7 creates a private key file called server.key in the c:\key folder.
Before you begin
Download
openssl.exe
from the OpenSSL website.
Procedure
If the read-only attribute is set, release it from the
c:\openssl
folder.Open a command prompt with administrator permissions.
Move the current directory to the folder to which the key file is output (such as
c:\key
), and execute the following command:c:\key > c:\openssl\bin\openssl genrsa -out server.key 1024
Creating a public key
A public key has the file extension .csr. It is required to create an SSL keypair. The following procedure is for the Windows 7 operating system.
Before you begin
Download
openssl.exe
from the OpenSSL website.
Procedure
Open a command prompt with administrator permissions.
Move the current directory to the folder to which the key file is output (such as
c:\key
). Execute the following command:c:\key > c:\openssl req -sha256 -new -key server.key -config c:\openssl\bin\openssl.cfg -out server.csr
Enter the following information in the prompt:
- Country Name (two-letter code)
- State or Province Name
- Locality Name
- Organization Name
- Organization Unit Name
- Common Name
To create a self-signed certificate, enter the IP address of the SVP or GUM. The name you entered here is used as the server name (host name). To obtain a signed and trusted certificate, ensure that the server name is the same as the host name.
- Email Address
- Challenge password (optional)
- Company name (optional)
The following example shows the contents of a command window when you create a public key.
......++++++ ..++++++ is 65537 (0x10001) C:\key>c:\openssl\bin\openssl req -sha256 -new -key server.key -config c You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. \openssl\bin\openssl.cfg -out server.csr For some fields there will be a default value. If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]:JP State or Province Name (full name) [Some-State]:Kanagawa Locality Name (eg, city) []:Odawara Organization Name (eg, company) [Internet Widgits Pty Ltd]:Hitachi Organization Unit Name (eg, section) []:ITPD Common Name (eg, YOUR name) []:192.168.0.1 Email Address []: Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []:
Obtaining a signed certificate
After creating a private key and public key, obtain a signed public key certificate file. You can use any of these methods to obtain a signed certificate file.
- Create a certificate by self-signing. See Obtaining a self-signed certificate .
- Obtain a certificate from the certificate authority that is used by your company.
- Request an official certificate from an SSL certificate authority. See Obtaining a signed and trusted certificate.
When you send a request to a certificate authority, specify the SVP or GUM as the host name.
Hitachi recommends that self-signed certificates be used only for testing encrypted communication.
Obtaining a self-signed certificate
To obtain a self-signed certificate, open a command prompt and execute the following command:
c:\key>c:\openssl\bin\openssl x509 -req -sha256 -days 10000 -in server.csr -signkey server.key -out server.crt
This command creates a
server.crt
file in the
c:\key
folder, which is valid for 10,000 days. This is the signed private key, which is also referred to as a self-signed certificate.
Obtaining a signed and trusted certificate
To obtain a signed and trusted certificate, you must obtain a certificate signing request (CSR), send that file to a Certificate Authority (CA), and request that the CA issue a signed and trusted certificate. Each certificate authority has its own procedures and requirements. Use of this certificate results in higher reliability in exchange for greater cost and requirements. The signed and trusted certificate is the signed public key.
Uploading the SSL certificate to the SVP or management client
To use SSL-encrypted communication, you must upload the private key and the signed server certificate (public key) to the management client.
Before you begin
- You must have the Storage Administrator (Initial Configuration) role to perform this task.
- You must be logged in to the SVP or management client.
- A private key (.key file) has been created. Make sure that the file name is server.key.
- The passphrase for the private key (server.key file) is released.
- A signed public key certificate (.crt file) has been acquired. Make sure that the file name is server.crt.
- The private key (.key file) must be in PEM format. You cannot use DER format.
- The signed public key certificate (.crt file) must be in X509 PEM format. You cannot use X509 DER format.
- The passphrase for the private key (server.key file) must be released.
Procedure
In the maintenance utility Menu navigation tree, click System Management.
Click Update Certificate Files.
NoteFor storage systems without an SVP, unselect the Connect to SVP box.Select the Web Server checkbox, then click Browse.
Browse to the certificate file and click Open. The File Upload window closes and returns you to the Update Certificate Files dialog box.
Click Apply.
Releasing an SSL certificate passphrase
An SSL certificate cannot be applied for the SVP if the passphrase is set. If the passphrase is set, release the passphrase for the SSL certificate before applying the SSL certificate to the SVP. The following procedure explains how to verify and release the passphrase settings.
Before you begin
- A private key (.key file) has been created.
- OpenSSL must be installed. In this procedure, it is installed in
C:\openssl
.
Procedure
Open a command prompt window with administrator permissions.
Move the current directory to the folder (for example, C:\key) where the key file is stored, and run the following command:
CautionExecuting this command will overwrite the current key file. To prevent loss of the key file, do one of the following:- Back up the key file first.
- Use a different key file input destination and output destination.
C:\key>C:\openssl\bin\openssl rsa -in key-file-input-destination -out key-file-output-destination
If
Enter pass phrase for server.key:
is displayed, the passphrase is set. Enter the passphrase. The passphrase in the SSL private key will be released, and the SSL certificate can be applied to the SVP.
C:\key>c:\openssl\bin\openssl rsa -in server.key -out server.key
Enter pass phrase for server.key: "Enter passphrase"
Writing RSA key
C:\key>c:\openssl\bin\openssl rsa -in server.key –out server.key
Writing RSA key
Converting the SSL certificates to PKCS#12 format
Uploaded SSL certificates need to be in PKCS#12 format.
If you are uploading a created private key and the SSL certificate to the management client, you need to convert the SSL certificate to PKCS#12 format. If you are not uploading the SSL certificate, conversion is not required.
Before you begin
- You must store a private key and SSL certificate in the same folder.
- In the following procedure:
- The private key file name is “client.key”.
- The SSL certificate file name is “client.crt”.
- The SSL certificate in PKCS#12 format is output to c:\key.
Procedure
Open a command prompt with administrator permissions.
Enter the following command:
C:key>c:\openssl\bin\openssl pkcs12 -export -in client.crt –inkey client.key -out client.p12
Enter a password, which is used when uploading the SSL certificate in PKCS#12 format. You can use up to 128 alphanumeric characters and the following symbols: ! # $ % & ' ( ) * + , - . / : ; < = > ? @ [ \ ] ^ _ ` { | } ~
The client.p12 file is created in the C:\key folder. This client.p12 file is the SSL certificate in PKCS#12 format.
Close the command prompt.
Returning the certificate to default
You can return the certificate that was updated by the procedure in Uploading a signed certificate to default.
Before you begin
- You must have the Storage Administrator (Initial Configuration) role to perform this task.
Procedure
Close all Device Manager - Storage Navigator sessions on the SVP.
On the Device Manager - Storage Navigator computer, open a web browser and enter the following URL to open the Tool Panel dialog box.
http://
IP-address-or-host-name-of-SVP/cgi-bin/utility/toolpanel.cgi
In the Tool Panel dialog box, click Update Certificate Files. The Update Certificate Files login dialog box opens.
If SSL communication has been established, the Security Alert dialog box opens before the login dialog box. In the Security Alert dialog box, click OK.In the Login dialog box, enter the administrator user ID and password, and click login. The Upload dialog box opens.
In the Upload dialog box, click Return to Default. A confirmation dialog box opens.
Click Yes to confirm and close the dialog box.
When the certificate update is complete, the SVP Web server restarts to show the update. When the restart is complete, the Update Completion dialog box opens.In the Update Completion dialog box, click OK. The dialog box closes and the display returns to the Login dialog box.
NoteIf an error occurs during the certificate update, an error message appears. Resolve the problem described in the error message and then repeat this procedure, starting with Step 4 (login) above.NoteIf the Security Alert dialog box for the certificate opens at other times, click View Certificate to confirm that the certificate is correct and then click Yes.
Importing the SSL certificate to the Web browser
To allow your Web browser to automatically trust SSL certificates, you can import the SSL certificate into your Web browser.
Consult your Web browser's documentation for instructions to import the SSL certificate to the Web browser.
Blocking HTTP communication to the management client
You can use the HTTP setting tool to block or allow access to the HTTP communication port as needed.
Before you begin
- You must have the Storage Administrator (Initial Configuration) role to perform this task.
- You must be logged into the SVP or management client.
Procedure
Close all management client sessions on the storage system, including Storage Advisor Embedded, maintenance utility, and Device Manager - Storage Navigator.
Open a command prompt window with administrator permissions.
In the folder where the HTTP setting tool is located, execute the following command:
C:\MAPP\wk\Supervisor\MappIniSet>MappHttpBlock.bat
A completion message box displays. Press any key to acknowledge the message and close the message box.
Close the command prompt window.
Releasing HTTP communication blocking
If the web server supports SSL (HTTPS), you can use the HTTP setting tool to release a block to the HTTP communication port as needed.
Before you begin
- You must have the Storage Administrator (Initial Configuration) role to perform this task.
- You must be logged into the SVP or management client.
Procedure
Close all management client sessions on the storage system, including Storage Advisor Embedded, maintenance utility, and Device Manager - Storage Navigator.
Open a command prompt window with administrator permissions.
In the folder where the HTTP setting tool is located, execute the following command:
C:\MAPP\wk\Supervisor\MappIniSet>MappHttpRelease.bat
A completion message box displays. Press any key to acknowledge the message and close the message box.
Close the command prompt window.
Managing SSL certificates
When you use encrypted SSL communications to manage your storage system, you can select the desired cipher suite, update a signed certificate, and return an updated certificate to default.
SSL connection protects the User IDs and passwords that are exchanged when users log in to the management client.
Selecting a cipher suite
Before you begin
You must have the Storage Administrator (View & Modify) role to complete this procedure.
Procedure
In the maintenance utility Menu navigation tree, click System Management.
Click Select Cipher Suite.
Select the type of communication to use between the management client and the storage system. The selections change the encryption level. Higher encryption provides better security but the communication speed is slower.
- TLS_RSA_WITH_AES_128_CBC_SHA (Prioritize Transmission Speed). This selection provides higher communication speed and lower security.
- TLS_RSA_WITH_AES_128_CBC_SHA256 (Prioritize Security). This selection provides higher security and lower communication speed.
Click Apply to save the setting and close the dialog box.
Updating a signed certificate
To use SSL-encrypted communication, you must update and upload the private key and the signed server certificate (public key) to the management client.
Before you begin
- You must have the Storage Administrator (Initial Configuration) role to perform this task.
- You must be logged in to the SVP or management client.
- A private key (.key file) has been created. Make sure that the file name is server.key.
- The passphrase for the private key (server.key file) is released.
- A signed public key certificate (.crt file) has been acquired. Make sure that the file name is server.crt.
- The private key (.key file) must be in PEM format. You cannot use DER format.
- The signed public key certificate (.crt file) must be in X509 PEM format. You cannot use X509 DER format.
- The passphrase for the private key (server.key file) must be released.
Procedure
Close all management client sessions on the storage system, including Storage Advisor Embedded, maintenance utility, and Device Manager - Storage Navigator.
Open a command prompt window with administrator permissions.
In the folder where the .bat file is located, execute the following command:
C:\MAPP\wk\Supervisor\MappIniSet>MappApacheCrtUpdate.bat absolute-path-of-signed-public-key-certification-file absolute-path-of-private-key-file
NoteA space is required between MappApacheCrtUpdate.bat and the signed public key certification file path.
A space is required between the signed public key certification file path and the private key file path.
A completion message box displays. Press any key to acknowledge the message and close the message box.
Close the command prompt window.
Notes on updating a signed certificate for the service processor
The following notes provide additional information about updating a signed certificate.
- While the service processor certificate is being updated, tasks that are being run or scheduled to run on Device Manager - Storage Navigator are not executed.
- Certificates for RMI communication are updated asynchronously. The process takes about two minutes.
- If the service processor certificate is updated while Storage Advisor or Hitachi Command Suite is being set up, the setup operation will fail.
- Updating the SSL certificate might change the system drastically and may lead to service processor failure. Therefore take sufficient care to consider the content of the certificate and private key to be set.
- After the certificate update is complete, depending on the environment, the service processor can take 30 to 60 minutes to restart.
Returning the certificate to default
You can return the certificate that was updated by the procedure in Updating a signed certificate back to default.
Before you begin
- You must have the Storage Administrator (Initial Configuration) role to perform this task.
- You must be logged into the management client.
- A private key (.key file) has been created. Make sure that the file name is server.key. See Creating a private key.
- The passphrase for the private key (server.key file) is released.
- A signed public key certificate (.crt file) has been acquired. Make sure that the file name is server.crt. See Creating a public key.
- The private key (.key file) must be in PEM format. You cannot use DER format.
- The signed public key certificate (.crt file) must be in X509 PEM format. You cannot use X509 DER format. See Obtaining a self-signed certificate .
- The passphrase for the private key (server.key file) must be released.
Procedure
Close all management client sessions on the storage system, including Storage Advisor Embedded, maintenance utility, and Device Manager - Storage Navigator.
Open a command prompt window with administrator permissions.
In the folder where the .bat file is located, execute the following command:
C:\MAPP\wk\Supervisor\MappIniSet>MappApacheCrtInit.bat
A completion message box displays. Press any key to acknowledge the message and close the message box.
Close the command prompt window.
Website security certificates
When the message "There is a problem with this website's security certificate." is displayed, click Continue to this website (not recommended).
If the security certificate is not issued by a trusted certificate authority, the browser displays a warning message whenyou use encrypted SSL communications to connect to the storage system.
In addition, if the IP address or host name you specified as the URL and the common name (CN) in the security certificate are different, this warning message appears.
Updating the certificate files
The Update Certificate Files window is used to update the certificates that are used for communication between the management client and the storage system.
Before you begin
- You must have the Storage Administrator (View & Modify) role to complete this procedure.
Procedure
In the maintenance utility Menu navigation tree, click System Management.
Click Update Certificate Files.
NoteFor storage systems without an SVP, unselect the Connect to SVP box.To update the certificate file on the management client:
Select the Web Server checkbox, then click Browse.
Browse to the certificate file and click Open. The File Upload window closes and returns you to the Update Certificate Files dialog box.
In the Web Server Password: field, enter the certificate password.
Enter the password again in the Web Server Re-enter Password: field.
NoteFor storage systems without an SVP, continue to step 5.To update the certificate file on the SVP:
Select the Connect to SVP checkbox, then click Browse.
Browse to the certificate file and click Open. The File Upload window closes and returns you to the Update Certificate Files dialog box.
In the Connect to SVP Password: field, enter the certificate password.
Enter the password again in the Connect to SVP Re-enter Password: field.
Click Apply to update the certificates.
Managing HCS certificates
This topic explains how to set or delete certificates for Hitachi Command Suite (HCS) that are used to check the server's reliability when SSL communication for HCS external authentication is performed.
Registering HCS certificates
To check the server reliability during SSL communication for HCS external authentication, upload an HCS public key certificate to the web server to register the certificate.
Before you begin
- You must be logged into the SVP.
- The private key file on the HCS server must be current. Update it if necessary.
- The certificate file must have a .crt extension. Rename the file if necessary.
- The certificate must be in X509 PEM format or X509 DER format.
Procedure
Close all Device Manager - Storage Navigator sessions on the SVP.
Open a command prompt window with administrator permissions.
In the folder where the certificate update tool is located, execute the following command:
C:\MAPP\wk\Supervisor\MappIniSet>MappHcsCrtEntry.bat absolute-path-of-signed-public-key-certificate-file
NoteA space is required between MappHcsCrtEntry.bat and the signed public key certification file path.A completion message box displays. Press any key to acknowledge the message and close the message box.
Close the command prompt window.
Deleting HCS certificates
You can delete the certificates you registered in the procedure of the "Registering certificates for HCS" section. After you delete a certificate, server reliability for that certificate is not checked by SSL communication for HCS external authentication.
Before you begin
- You must be logged into the SVP.
- The private HCS server key must be updated.
- The certificate file must have a .crt extension. Rename the file if necessary.
- The certificate must be in X509 PEM format or X509 DER format.
Procedure
Close all Device Manager - Storage Navigator sessions on the SVP.
Open a command prompt window with administrator permissions.
In the folder where the certificate update tool is located, execute the following command:
C:\MAPP\wk\Supervisor\MappIniSet>MappHcsCrtDelete.bat
A completion message box opens. Press any key to acknowledge the message and close the message box.
Close the command prompt window.
Using HSTS
HSTS (HTTP Strict Transport Security) is a security mechanism used when the Web server communicates with the Web browser using HTTPS.
Enabling HSTS
Procedure
Open a command prompt with administrator permissions on the SVP.
Move the current directory to the folder in which the setting tool is located, and then execute the following command:
cd /d C:\Mapp\wk\Supervisor\MappIniSet MappHstsEnable.bat
NoteC:\Mapp:
Indicates the installation directory of storage management software and SVP software. If you specified an installation directory other thanC:\Mapp
, replaceC:\Mapp
with the specified installation directory.When "Press any key to continue ..." appears in the window, press the Enter key.
To verify that HSTS is enabled, execute the following command:
MappHstsState.bat
NoteIf "hsts=on" appears, HSTS is enabled. Press the Enter key. If "hsts=off" appears, HSTS is not enabled. Press the Enter key, and then go back to step 2.
If the message indicating that the specified file could not be found appears, the HSTS settings failed. Press the Enter key, and then go back to step 2.
Close the command prompt window.
Disabling HSTS
To disable HSTS, use the following procedure:
Procedure
Open a command prompt with administrator permissions on the SVP.
Move the current directory to the folder in which the setting tool is located, and then execute the following command:
cd /d C:\Mapp\wk\Supervisor\MappIniSet MappHstsDisable.bat
NoteC:\Mapp:
indicates the installation directory of storage management software and SVP software. If you specified an installation directory other thanC:\Mapp
, replaceC:\Mapp
with the specified installation directory.When "Press any key to continue ..." appears in the window, press the Enter key.
To verify that HSTS is disabled, execute the following command:
MappHstsState.bat
NoteIf "hsts=off" appears, HSTS is disabled. Press the Enter key. If "hsts=on" appears, HSTS is not disabled. Press the Enter key, and then go back to step 2.
If the message indicating that the specified file could not be found appears, the HSTS settings failed. Press the Enter key, and then go back to step 2.
Close the command prompt window.