Update key managers
PATCH /security/key-managers/{uuid}
Introduced In: 9.6
Updates a key manager.
Required properties (when patching the Onboard Key Manager)
-
onboard.existing_passphrase
- Cluster-wide passphrase. Required only when synchronizing the passphrase of the Onboard Key Manager. -
synchronize
- Synchronizes missing Onboard Key Manager keys on any node in the cluster. Required only when synchronizing the Onboard Key Manager keys in a local cluster.
Required properties (when patching an external key manager)
-
external.client_certificate
orexternal.server_ca_certificates
- Client certificate or Server CA certificate. Required when modifying an external key manager.
Related ONTAP commands
-
security key-manager external modify
-
security key-manager onboard sync
-
security key-manager onboard update-passphrase
Parameters
Name | Type | In | Required | Description |
---|---|---|---|---|
uuid |
string |
path |
True |
Key manager UUID |
Request Body
Name | Type | Description |
---|---|---|
_links |
||
external |
Configures external key management |
|
is_default_data_at_rest_encryption_disabled |
boolean |
Indicates whether default data-at-rest encryption is disabled in the cluster. This field is deprecated in ONTAP 9.8 and later. Use the "software_data_encryption.disabled_by_default" of /api/security endpoint.
|
onboard |
Configures onboard key management. After configuring onboard key management, save the encrypted configuration data in a safe location so that you can use it if you need to perform a manual recovery operation. |
|
policy |
string |
Security policy associated with the key manager. This value is currently ignored if specified for the onboard key manager. |
scope |
string |
Set to "svm" for interfaces owned by an SVM. Otherwise, set to "cluster". |
status |
Optional status information on the current state of the key manager indicating if it is fully setup or requires more action. |
|
svm |
SVM, applies only to SVM-scoped objects. |
|
uuid |
string |
|
volume_encryption |
Indicates whether volume encryption is supported in the cluster. |
Example request
{
"_links": {
"self": {
"href": "/api/resourcelink"
}
},
"external": {
"client_certificate": {
"_links": {
"self": {
"href": "/api/resourcelink"
}
},
"name": "string",
"uuid": "1cd8a442-86d1-11e0-ae1c-123478563412"
},
"server_ca_certificates": [
{
"_links": {
"self": {
"href": "/api/resourcelink"
}
},
"name": "string",
"uuid": "1cd8a442-86d1-11e0-ae1c-123478563412"
}
],
"servers": [
{
"_links": {
"self": {
"href": "/api/resourcelink"
}
},
"connectivity": {
"node_states": [
{
"node": {
"_links": {
"self": {
"href": "/api/resourcelink"
}
},
"name": "node1",
"uuid": "1cd8a442-86d1-11e0-ae1c-123478563412"
},
"state": "not_responding"
}
]
},
"secondary_key_servers": "secondary1.com, 10.2.3.4",
"server": "keyserver1.com:5698",
"timeout": 60,
"username": "admin"
}
]
},
"onboard": {
"existing_passphrase": "The cluster password of length 32-256 ASCII characters.",
"key_backup": "'--------------------------BEGIN BACKUP-------------------------- TmV0QXBwIEtleSBCbG9iAAEAAAAEAAAAcAEAAAAAAAAxBFWWAAAAACEAAAAAAAAA QAAAAAAAAABzDyyVAAAAALI5Jsjvy6gUxnT78KoDKXHYb6sSeraM00quOULY6BeV n6dMFxuErCD1lbERaOQZSuaYy1p8oQHtTEfGMLZM4TYiAAAAAAAAACgAAAAAAAAA 3WTh7gAAAAAAAAAAAAAAAAIAAAAAAAgAZJEIWvdeHr5RCAvHGclo+wAAAAAAAAAA IgAAAAAAAAAoAAAAAAAAAEOTcR0AAAAAAAAAAAAAAAACAAAAAAAJAGr3tJA/LRzU QRHwv+1aWvAAAAAAAAAAACQAAAAAAAAAgAAAAAAAAADV1Vd/AAAAAMFM9Q229Bhp mDaTSdqku5DCd8wG+fOZSr4bx4JT5WHvV/r5gJnXDQQAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABOZXRBcHAgS2V5IEJsb2IA AQAAAAMAAAAYAQAAAAAAALgePkcAAAAAIgAAAAAAAAAoAAAAAAAAAEOTcR0AAAAA AAAAAAAAAAACAAAAAAAJAGr3tJA/LRzUQRHwv+1aWvAAAAAAAAAAACIAAAAAAAAA KAAAAAAAAACIlCHZAAAAAAAAAAAAAAAAAgAAAAAAAQCafcabsxRXMM7gxhLRrzxh AAAAAAAAAAAkAAAAAAAAAIAAAAAAAAAA2JjQBQAAAACt4IqXcNpVggahl0axLsN4 yQjnNVKWY7mANB29O42hI7b70DTGCTaVAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAE5ldEFwcCBLZXkgQmxvYgABAAAAAwAAABgBAAAAAAAA 7sbaoQAAAAAiAAAAAAAAACgAAAAAAAAAQ5NxHQAAAAAAAAAAAAAAAAIAAAAAAAkA ave0kD8tHNRBEfC/7Vpa8AAAAAAAAAAAIgAAAAAAAAAoAAAAAAAAALOHfWkAAAAA AAAAAAAAAAACAAAAAAABAMoI9UxrHOGthQm/CB+EHdAAAAAAAAAAACQAAAAAAAAA gAAAAAAAAACnMmUtAAAAAGVk8AtPzENFgsGdsFvnmucmYrlQCsFew0HDSFKaZqK6 W8IEVzBAhPoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA ---------------------------END BACKUP---------------------------'",
"passphrase": "The cluster password of length 32-256 ASCII characters."
},
"policy": "string",
"scope": "string",
"status": {
"code": 346758,
"message": "This cluster is part of a MetroCluster configuration. Use the REST API POST method security/key_managers/ with the synchronize option and the same passphrase on the partner cluster before proceeding with any key manager operations. Failure to do so could lead to switchover or switchback failure."
},
"svm": {
"_links": {
"self": {
"href": "/api/resourcelink"
}
},
"name": "svm1",
"uuid": "02c9e252-41be-11e9-81d5-00a0986138f7"
},
"uuid": "string",
"volume_encryption": {
"code": 346758,
"message": "No platform support for volume encryption in following nodes - node1, node2."
}
}
Response
Status: 200, Ok
Error
Status: Default
ONTAP Error Response Codes
Error Code | Description |
---|---|
65536139 |
The existing passphrase value provided does not match the configured passphrase. |
65536150 |
The new passphrase is same as old passphrase. |
65536404 |
The passphrase does not match the accepted length. |
65536406 |
The change of passphrase failed. |
65536407 |
The passphrase update failed on some nodes. |
65536802 |
The passphrase does not match the accepted length in common criteria mode. |
65536821 |
The certificate is not installed. |
65536828 |
External key management is not enabled for the SVM. |
65536850 |
New client certificate public or private keys are different from the existing client certificate. |
65536852 |
Failed to query supported KMIP protocol versions. |
65536917 |
Updating an onboard passhrase requires both new and existing cluster passphrase. |
65537242 |
The Onboard Key Manager existing_passphrase must be provided when performing a PATCH/synchronize operation. |
65537243 |
The Onboard Key Manager passphrase must not be provided when performing a PATCH/synchronize operation. |
65538120 |
The key manager policy is not supported on the admin SVM. |
66060338 |
Failed to establish secure connection for a key management server due to incorrect server_ca certificates. |
66060339 |
Failed to establish secure connection for a key management server due to incorrect client certificates. |
66060340 |
Failed to establish secure connection for a key management server due to Cryptsoft error. |
Also see the table of common errors in the Response body overview section of this documentation.
Name | Type | Description |
---|---|---|
error |
Example error
{
"error": {
"arguments": [
{
"code": "string",
"message": "string"
}
],
"code": "4",
"message": "entry doesn't exist",
"target": "uuid"
}
}
Definitions
See Definitions
href
Name | Type | Description |
---|---|---|
href |
string |
_links
Name | Type | Description |
---|---|---|
self |
client_certificate
Client certificate (name and UUID)
Name | Type | Description |
---|---|---|
_links |
||
name |
string |
Certificate name |
uuid |
string |
Certificate UUID |
server_ca_certificates
Security certificate object reference
Name | Type | Description |
---|---|---|
_links |
||
name |
string |
Certificate name |
uuid |
string |
Certificate UUID |
self_link
Name | Type | Description |
---|---|---|
self |
node
Name | Type | Description |
---|---|---|
_links |
||
name |
string |
|
uuid |
string |
key_server_state
The connectivity state of the key server for a specific node.
Name | Type | Description |
---|---|---|
node |
||
state |
string |
Key server connectivity state |
connectivity
This property contains the key server connectivity state of all nodes in the cluster.
This is an advanced property; there is an added computational cost to retrieving its value. The property is not populated for either a collection GET or an instance GET unless it is explicitly requested using the fields
query parameter or GET for all advanced properties is enabled.
Name | Type | Description |
---|---|---|
cluster_availability |
boolean |
Set to true when key server connectivity state is available on all nodes of the cluster. |
node_states |
array[key_server_state] |
An array of key server connectivity states for each node. |
key_server_readcreate
Name | Type | Description |
---|---|---|
_links |
||
connectivity |
This property contains the key server connectivity state of all nodes in the cluster.
This is an advanced property; there is an added computational cost to retrieving its value. The property is not populated for either a collection GET or an instance GET unless it is explicitly requested using the |
|
secondary_key_servers |
string |
A comma delimited string of the secondary key servers associated with the primary key server. |
server |
string |
External key server for key management. If no port is provided, a default port of 5696 is used. |
timeout |
integer |
I/O timeout in seconds for communicating with the key server. |
username |
string |
Username credentials for connecting with the key server. |
external
Configures external key management
Name | Type | Description |
---|---|---|
client_certificate |
Client certificate (name and UUID) |
|
server_ca_certificates |
array[server_ca_certificates] |
The array of certificates that are common for all the keyservers per SVM. |
servers |
array[key_server_readcreate] |
The set of external key servers. |
onboard
Configures onboard key management. After configuring onboard key management, save the encrypted configuration data in a safe location so that you can use it if you need to perform a manual recovery operation.
Name | Type | Description |
---|---|---|
enabled |
boolean |
Is the onboard key manager enabled? |
existing_passphrase |
string |
The cluster-wide passphrase. This is not audited. |
key_backup |
string |
Backup of the onboard key manager's key hierarchy. It is required to save this backup after configuring the onboard key manager to help in the recovery of the cluster in case of catastrophic failures. |
passphrase |
string |
The cluster-wide passphrase. This is not audited. |
synchronize |
boolean |
Synchronizes missing onboard keys on any node in the cluster. If a node is added to a cluster that has onboard key management configured, the synchronize operation needs to be performed in a PATCH operation. In a MetroCluster configuration, if onboard key management is enabled on one site, then the synchronize operation needs to be run as a POST operation on the remote site providing the same passphrase. |
status
Optional status information on the current state of the key manager indicating if it is fully setup or requires more action.
Name | Type | Description |
---|---|---|
code |
integer |
Code corresponding to the status message. Returns 0 if the setup is complete. This is an advanced property; there is an added computational cost to retrieving its value. The property is not populated for either a collection GET or an instance GET unless it is explicitly requested using the |
message |
string |
Current state of the key manager indicating any additional steps to perform to finish the setup. This is an advanced property; there is an added computational cost to retrieving its value. The property is not populated for either a collection GET or an instance GET unless it is explicitly requested using the |
svm
SVM, applies only to SVM-scoped objects.
Name | Type | Description |
---|---|---|
_links |
||
name |
string |
The name of the SVM. This field cannot be specified in a PATCH method. |
uuid |
string |
The unique identifier of the SVM. This field cannot be specified in a PATCH method. |
volume_encryption
Indicates whether volume encryption is supported in the cluster.
Name | Type | Description |
---|---|---|
code |
integer |
Code corresponding to the status message. Returns a 0 if volume encryption is supported in all nodes of the cluster. |
message |
string |
Reason for not supporting volume encryption. |
supported |
boolean |
Set to true when volume encryption support is available on all nodes of the cluster. |