Skip to main content

Change the ONTAP onboard key management passphrase

Contributors netapp-aoife netapp-barbe netapp-aaron-holt netapp-andreajost netapp-bhouser netapp-ahibbard netapp-forry netapp-thomi netapp-aherbin
PDFs

NetApp recommends that you change the onboard key management passphrase regularly. You must store the new passphrase in a secure location outside the storage system.

Before you begin

  • You must be a cluster or SVM administrator to perform this task.

  • Advanced privileges are required for this task.

  • You must enter the current onboard key management passphrase before you can set a new passphrase.

  • In a MetroCluster environment, after you update the passphrase on the local cluster, synchronize the passphrase update on the partner cluster.

Steps

  1. Change to advanced privilege level:

    set -privilege advanced

  2. Change the onboard key management passphrase. The command you use depends on the ONTAP version you are running.

    After you enter the command, respond to the prompts to enter the current passphrase, the new passphrase, and the new passphrase again for confirmation.

    ONTAP 9.6 and later

    security key-manager onboard update-passphrase

    ONTAP 9.5 and earlier

    security key-manager update-passphrase

  3. When prompted, enter the current passphrase.

  4. Enter a new passphrase between 32 and 256 characters, or for “cc-mode”, a passphrase between 64 and 256 characters.

    If the specified “cc-mode” passphrase is less than 64 characters, there is a five-second delay before the key manager setup operation displays the passphrase prompt again.

  5. At the passphrase confirmation prompt, reenter the new passphrase.

  6. If you are in a MetroCluster configuration, synchronize the updated passphrase on the partner cluster.

    1. Synchronize the passphrase on the partner cluster by choosing the correct command for your ONTAP version:

      ONTAP 9.6 and later

      security key-manager onboard sync

      ONTAP 9.5 and earlier

      • In ONTAP 9.5, run:

        security key-manager setup -sync-metrocluster-config

      • In ONTAP 9.4 and earlier, after you've updated the passphrase on the local cluster, wait 20 seconds, and then run the following command on the partner cluster:

        security key-manager setup

    2. Enter the new passphrase when prompted.

      The same passphrase must be used on both clusters.

After you finish

Copy the onboard key management passphrase to a secure location outside the storage system for future use.

Back up key management information manually whenever you change the onboard key management passphrase.

Related information