If you deploy an additional Cryptographic Security Platform Vault on GCP, you can add it to your existing Cryptographic Security Platform Vault cluster.

Before You Begin 

  • Ensure that the new Cryptographic Security Platform Vault node can communicate with the nodes in the existing Cryptographic Security Platform Vault cluster.

  • Ensure that you have the following information: 

    • The instance ID for the new Cryptographic Security Platform Vault instance. This is located in the Basic Information section on the Details page of the instance.

    • The External IP associated with the new instance.

    • The private IP address of one of the existing Cryptographic Security Platform Vault nodes in the cluster.

      Tip: To find this IP address, log into the Cryptographic Security Platform Vault webGUI and click Switch to Appliance Management. Click Clusters in the top menu bar, then navigate to the Servers tab to see the IP address.

Procedure 

  1. Use a web browser to navigate to https://<Public-IP-addy>, where <Public-IP-addy> is the Public IP address assigned to the Cryptographic Security Platform Vault VM. For security reasons, you must explicitly specify https:// in the URL.

  2. If prompted, add a security exception for the Cryptographic Security Platform Vault IP address and proceed to the Cryptographic Security Platform Vault Management webGUI.

    Cryptographic Security Platform Vault uses its own Root Certificate Authority to create its security certificate, which means that certificate will not be recognized by the browser. For details, see CSP Vault Certificates.

  3. On the Entrust Cryptographic Security Platform Vault Management login page, enter secroot for the username and the Instance ID for the password.

  4. Click Login.

  5. Review the EULA (end user license agreement). When you are done, click I Agree to accept the license terms.

  6. On the Welcome to Appliance Management screen, click Join an Existing Cluster..

    The Join Existing Cluster window displays.

  7. On the Get Started page, review the overview information to determine that you are ready to begin. This includes: 

    • Access to the cluster you are joining the node to. We recommend that you open the webGUI for the cluster in a different tab or browser window.
    • Permissions on both this node and the cluster node so that you can download and import the required certificates and files.
    • A passphrase to use during the joining process. Passphrase requirements are configured by a Cryptographic Security Platform Vault administrator in the System Settings. This phrase is a temporary string used to encrypt the initial communication between this node and the existing cluster.
    • Verifying that both this node and the cluster node are running the same Cryptographic Security Platform Vault version and build. The version number for the cluster node is on the Settings > System Upgrade page.
  8. Click Continue.
  9. On the Download CSR page, click Generate and Download CSR.
  10. Click Continue.
  11. Switch to one of the existing nodes in the cluster and navigate to the Cluster page.
  12. Select Actions > Add a Node.

  13. On the Add a Node window, upload the CSR that you downloaded from the new node (in .pem format) and enter a passphrase to use during the joining process.

  14. Click Save and Download Bundle to download the certificate bundle from the cluster node.

    The certificate bundle is a .zip file you must unpack. It contains both an encrypted SSL certificate in .p12 format and a CA certificate in .pem format.

  15. Click OK to close the Add a Node window.
  16. Return to the new node and click Continue.

  17. On the Node page, upload the encrypted SSL certificate and CA certificate that you downloaded from the cluster node, enter the IP address of any node in the existing cluster, and enter the passphrase that you selected.

  18. Click Join.

    During the joining process, a status page is displayed on the new node. Do not refresh the browser while this is in process.

    The cluster will automatically be placed in maintenance mode.

    The node will restart after the join is complete.

  19. When the node has successfully restarted, click Login.

  20. Optional. Log into the htadmin account on the Cryptographic Security Platform VaultSystem Console using the private key file. For example: 

    ssh -i <key-file>.pem htadmin@<Public-IP-addy>

    The password is the VM unique ID (vmId).

    After logging in, you can change this password. The change applies only to the htadmin login on this node.