Differences

This shows you the differences between two versions of the page.

--- syno:dsm7kmip [2026/09/01 11:57] – Bernard Condrau
+++ syno:dsm7kmip [2026/09/01 13:58] (current) – [DSM as Client] Bernard Condrau
@@ Line 2: / Line 2: @@
   * Follow the guide to install [[https://kb.synology.com/en-global/DSM/help/DSM/AdminCenter/connection_security_kmip?version=7|KMIP]] on a Synology NAS server and client
 ===== Certificates =====
-  - The default, out-of-the-box self-signed Synology certificate will fail on DSM 7.4 and later, which hardened the certificate requirements. You will generate matching certificates from an official Synology script, which will be installed alongside the default certificates, and are valid for 10 years. These certificates also work for Synology clients, when added to a [[deb13:kmip_server_pykmip|KMIP Server (PyKMIP)]] not hosted on a synology NAS.
+  - The default, out-of-the-box self-signed Synology certificate will fail on DSM 7.4 and later, which hardened the certificate requirements. You will generate matching certificates from an official Synology script, which will be installed alongside the default certificates, and are valid for 10 years. These certificates also work for Synology clients connecting to a [[deb13:kmip_server_pykmip|KMIP Server (PyKMIP)]] not hosted on a synology NAS.
   - Login to your NAS on the command line with SSH and elevate to root
   - Download Synology's official KMIP certificate script:<code>wget supweb.synology.com/support_web/kc_tool/how_to_gen_cert_for_kmip_services/gen_kmip_certs.sh</code>
@@ Line 15: / Line 15: @@
 server-key.pem
 server.pem</code>
-==== DSM as Server ====
+===== DSM as Server =====
   - go to //Control Panel > Security > Certificate//
   - Click //Add//, choose //Import Certificate//, and upload:
@@ Line 40: / Line 40: @@
   - Upload the certificate authority file ''ca.pem'' and click **Next**. Wait until you see the connection is successful.
   - Now you need to go to **Storage Manager --> Storage** and click //Global Settings//. Scroll down to **Encryption Key Vault** and click //Reset// (important!) to make the switch to the KMIP Server permanent and move the encryption keys.
+  - Go to **Control Panel --> Security --> KMIP**, check //Set as remote key client//, and make sure your KMIP Server with uploaded Synology certificates is running (either Synology DSM, or PyKMIP on Debian, or a commercial KMIP Server)
+  - Enter the following credentials. Note that every time you edit the connection you need to upload the //Certificate Authority// file (<color red>**ca.pem**</color>).{{ :syno:kmip-credentials.jpg?600 |KMIP Credentials}}
 ===== How to gain access to encrypted volumes when the KMIP Server was unavailable during DSM boot =====

Differences

Know How