Validating with Re-keys

1. Log in to Nutanix Prism Element as an administrator.

2. Select Data at Rest Encryption in the Settings page.

3. In the Cluster Encryption page, select Manage Keys and click the Rekey button under Software Encryption. For more information on validating with Re-keys, see https://portal.nutanix.com/page/documents/details?targetId=Nutanix-Security-Guide-v6_7:wc-security-data-encryption-passwords-wc-aos-t.html.

Re-key

Re-key Success

4. Shut down VMs in the Nutanix cluster.

5. Stop Nutanix Cluster Services.

6. Shut down CVMs and Nutanix Hosts in the cluster, wait for 3 minutes for the power to drain, and verify the shutdown status.

7. Shut down both nodes of KMS Server.

8. Power on Hosts and verify status(CVMs power on automatically).

9. Start Nutanix Cluster Services.

10. Power on the VMs to test the KEK (Key Encryption Key) is not retrieved from the KMS, and the DEK (Data Encryption Key) cannot successfully unlock the Drives to boot the VMs.

11. Power on and start services for the Active KMS Node and attempt to boot the Nutanix VMs and record behavior.

Verify the events/logs of the KMS cluster to see if the keys are fetched successfully from the new active KMS server.

Before Re-key

After Re-Key