TSM Client Encryption functionality question

[Nicke]

Hi there!

Currently working with a new S.P/TSM 8.1.x PoC Cloud project with Linux servers and have a question:

The customer don't accept having the Encryption Certificates managed by the TSM Server (in the cloud side) and only by the client. (From doc's how it works now: .. one random encryption key is generated per session and it is stored on the Tivoli Storage Manager server)

And /etc/adsm/TSM.PWD file on the client server only seem to contain the encryption passwords and not the whole encryption certificate.

This is my current TSM client node stanza:
Servername TEST44
NODENAME TEST03
Resourceutilization 30
Passwordaccess Generate
TCPSERVERADDRESS *******
ENCRYPTKEY SAVE
ENABLECLIENTENCRYPTKEY YES
ENCRYPTIONTYPE AES256
INCLUDE.ENCRYPT /.../*


For the API there's this option: "DSM_ENCRYPT_CLIENTENCRKEY" but I can't see any other client B/A option like it than what I already have in the dsm.sys stanza.

Thanks for some insight how client encryption should be,
Kind Regards,
Nicke

 

[Nicke]

So now I've started trying to use these GSKit commands instead to see how it will work:

gsk8capicmd_64 -keydb -create -populate -db <filename>.kdb -pw <password> -stash
gsk8capicmd_64 -cert -create -db server.kdb -stashed -dn"CN=myserver,OU=mynetwork,O=mycompany,C=mycountry" -expire 7300 -label "My self-signedcertificate" -default_cert yes
gsk8capicmd_64 -cert -extract -db server.kdb -stashed -label "My self-signedcertificate" -format ascii -target mycert.arm
...

//nicke