CONTAP-807748: MetroCluster Rebaseline May Disable KMIP Server Hostname and IP Verification
Issue
In a MetroCluster configuration using external key management (KMIP), a vserver rebaseline can create the partner cluster’s key manager configuration with hostname and IP verification disabled—even when those checks are enabled on the source cluster.
If a switchover occurs, the partner may connect to the KMIP server without checking that the server’s hostname or IP address matches its certificate. Administrators can detect the mismatch by comparing the output of
This issue applies when the partner’s key manager configuration is created through a vserver baseline, such as during a resync or when configuration replication falls back to a rebaseline. Normal command-based replication preserves the verification settings.
If a switchover occurs, the partner may connect to the KMIP server without checking that the server’s hostname or IP address matches its certificate. Administrators can detect the mismatch by comparing the output of
security key-manager external show for the same SVM on both sites.This issue applies when the partner’s key manager configuration is created through a vserver baseline, such as during a resync or when configuration replication falls back to a rebaseline. Normal command-based replication preserves the verification settings.