See below for using any key management server meeting the Key Management Interoperability Protocol (KMIP).

To create a  KMIP key manager

1. Log in as an administrator with either:
   • The global_admin role.
   • A <user_defined> role with permission to create key managers.
2. Go to Control > Key Managers.
3. Click Create to configure the following settings. 
   • Label
   • Owner
   • Description
   • Authorization Tags
   • Plugin Type
   • KMIP Server URL
   • Client Credential file format
   • Key Algorithm
   • Key Size
   • Digital Signature Algorithm
   • Start Date
   • Enable hostname verification
   • KMIP Version
   • Allow private key export
4. Click Verify to check the connection with the key manager.

Label

A descriptive name of the key manager.

Mandatory: Yes

Owner

The username of the person responsible for the key manager.

Description

A description of the key manager.

Mandatory: No

Authorization Tags

A list of authorization tags. The Custom Roles with any of these tags will grant permissions on the key manager.

Mandatory: No

Plugin Type

Select KMIP-KeyManagement-Plugin.

Mandatory: Yes

KMIP Server URL  

The URL of the KMIP server.

Where:

• <host> is the hostname or IP address of the KMIP server.
• <port> is the port of the KMIP server.

For example:

Mandatory: Yes

Client Credential file format    

The file format for importing the client credentials. When selecting PKCS#12, configure the following additional parameters.

When selecting PEM, configure the following additional parameters. 

Mandatory: Yes

Key Algorithm

The algorithm for generating the keys. 

Mandatory: No. This optional value defaults to RSA (the only supported option).

Key Size    

The bit size of the generated keys. 

Mandatory: No. This optional value defaults to 2048 (the only supported option).

Digital Signature Algorithm    

The algorithm for signing the certificate requests:

• SHA256
• SHA512

Mandatory: No. This optional value defaults to SHA256.

Start Date    

The starting date for the background job that synchronizes the certificate states in Certificate Manager with the certificate states in the KMIP server.

Mandatory: Yes

Enable hostname verification    

Check this box for validating the KMIP server certificate in each connection.

KMIP Version    

The version used by the KMIP server. 

Mandatory: Yes

Allow private key export

Check this box to allow exporting the private key from the key manager – for example, to push the same certificate and key to other destinations.