Skip to main content

Configure KMS

The key management service (KMS) enables you to have centralized control over the

cryptographic keys used to protect your data. It communicates with KMS servers and retrieves cryptographic keys through the standard key management interoperability protocol (KMIP). This reduces the risk of key leakage and enhances key security. In addition, KMS offers centralized management and distribution of keys, streamlining the disk encryption process and increasing key security and manageability. Therefore, it can provide robust support for protecting VM data.

Restrictions and guidelines

When you add KMS configuration, the steps in the configuration wizard cannot be reversed. Review each parameter carefully before you can proceed to the next step.

Add KMS configuration/Update the certificate

By adding KMS configuration, you can integrate a KMS server into management platform for management and control of VM disk encryption keys to ensure data security and compliance.

  1. On the top navigation bar, click Security. 2. From the left navigation pane, select KMS Settings. 3. Click Create. 4. On the Add KMS Cluster page, configure the following parameters, and click Next. To add more KMS servers, click Add KMS Server.

    ○ Cluster Name: Name of the KMS cluster. ○ Key Algorithm: Algorithm used for key generation. ○ Key Length: Length of the key, in bits. ○ KMS Server: Name of the KMS server. You can identify a KMS server by its name. ○ Server Address: IP address of the KMS server. ○ Port Number: Port number used by the KMS server. This port allows communication with KMS. 5. On the Make System Trust KMS page, configure the following parameters, and click Next. ○ Serial Number: Serial number that uniquely identifies the certificate. ○ Certificate Subject: Information of the certificate holder, typically including the organization name, department, and common name. ○ Certificate Issuer: Issuer of the certificate. ○ Valid From: Date and time when the certificate became effective. ○ Valid Until: Expiration date and time of the certificate. ○ Fingerprint: Unique hash value of the certificate, used to quickly verify the integrity and authenticity of the certificate. 6. On the Make KMS Trust System page, submit the generated CSR certificate to the KMS server by clicking Copy or Download, and then click Next. 7. Click Upload Signed Certificate to upload the certificate signed on the KMS server to the management platform, and then click OK.

Continue KMS configuration

This function allows you to continue previous KMS configuration operations in the event of a disruption or incomplete execution. This function ensures the continuity and integrity of the KMS configuration process, preventing configuration failure or key management anomalies due to interruptions.

  1. On the top navigation bar, click Security. 2. From the left navigation pane, select KMS Settings. 3. Click Continue in the Actions column for the KMS configuration item that you have not completed. 4. Complete the configuration, and then click OK.

Delete KMS configuration

After a KMS configuration is deleted, the management of cryptographic keys for relevant virtual machine disks will no longer rely on the KMS server. Make sure the deletion will not impact data security and normal operations.