Skip to main content
NetApp Knowledge Base

Node Timeout While Connecting to (KMIP) External Key Manager

  1. Last updated
  2. Save as PDF
Views:
7
Visibility:
Public
Votes:
0
Category:
ontap-9
Specialty:
CORE
Last Updated:

Applies to

  • ONTAP 9
  • External Key Management (EKM) / KMIP configurations

Issue

One of the node was unable to connect to configured external KMIP key management servers, while a partner node could connect successfully. The issue persisted with the following symptoms and log outputs:

::> security key-manager external show-status output:

Node: nascls032-n03
Vserver: nascls032
KeyServerPort: 5696
KMIP is operational: false
Reason: IO
KeyServer   Role      Server Status      Reason
----------------------------------------------
10.176.175.121 primary  not-responding   IO
10.223.204.26 primary  not-responding   IO

EMS logs:

[node01:mgwd:km.keyserver.notavailable:alert]: The external key management server "10.xx.yy.121:5696" is not available for Vserver "vserver01", status: "not-responding".
[node01:mgwd:km.keyserver.notavailable:alert]: The external key management server "10.xx.yy.26:5696" is not available for Vserver "vserver01", status: "not-responding".

KMIP2 client logs:

ERR: kmip2::kmipCmds::KmipConnection:[cryptsoftErrorCb]: Error: kmip_ssl_conn_do_handshake: 10.xx.xy.121
ERR: kmip2::tables::kmip_keyserver_status:[setKeyServerStatus]: Received an exception in setting up TLS connection: IO(10) Cryptsoft error code 10 = IOError: TCP connection never established, TLS handshake cannot begin.

  • TCP connectivity tests from affected node timed out, while partner node succeeded.

Sign in to view the entire content of this KB article.

New to NetApp?

Learn more about our award-winning Support

NetApp provides no representations or warranties regarding the accuracy or reliability or serviceability of any information or recommendations provided in this publication or with respect to any results that may be obtained by the use of the information or observance of any recommendations provided herein. The information in this document is distributed AS IS and the use of this information or the implementation of any recommendations or techniques herein is a customer's responsibility and depends on the customer's ability to evaluate and integrate them into the customer's operational environment. This document and the information contained herein may be used solely in connection with the NetApp products discussed in this document.