Skip to main content
Dell PowerEdge servers can encrypt their self-encrypting drives (SEDs) with keys from a KMIP key manager, through a feature of iDRAC called Secure Enterprise Key Management (SEKM). This guide sets up iDRAC as a KMIP client of Infisical KMS.

​
Prerequisites

  • A running KMIP server that iDRAC can reach on port 5696
  • A KMS project where you have the Admin role
  • A Dell PowerEdge server with an iDRAC Enterprise license and an SEKM license

​
Step 1: Register iDRAC as a KMIP client

1
In your KMS project, go to KMIP and select Add KMIP Client.
2
Enter a Name, select every operation under Permissions, then select Add KMIP Client.
3
Select the options menu on the client’s row, select Generate Certificate, and set Request Method to Certificate Signing Request (CSR). Keep the dialog open: you need the Client ID and Project ID it shows in the next step.

​
Step 2: Create a certificate request on iDRAC

1
In the iDRAC web interface, go to iDRAC Settings > Services, expand iDRAC Key Management, and select SEKM.
2
Enter the KMIP server’s address and port 5696, then select Next.
3
Select Generate CSR, and fill in the certificate fields:
  • Common Name (CN): The Client ID from Infisical
  • Organizational Unit (OU): The Project ID from Infisical
  • Any other fields your organization requires, such as Organization and Country
4
Select Generate, and download the certificate request.

​
Step 3: Sign the certificate in Infisical

1
In the Infisical dialog, paste the certificate request into Certificate Signing Request (CSR).
2
Enter a TTL, such as 1y, then select Sign Certificate.
3
Download the Certificate Body and the Certificate Chain.

​
Step 4: Finish the setup on iDRAC

1
In iDRAC, upload the Certificate Body as the client certificate, and the Certificate Chain as the KMS CA certificate.
2
Select Test Network Connection, then finish the SEKM setup.
3
Turn on encryption for your storage controller (PERC, HBA, or NVMe) in iDRAC.

​
Troubleshooting

  • Certificate validation fails: Check that the certificate request used the Client ID as the common name and the Project ID as the organizational unit
  • Connection times out: Check that iDRAC can reach the KMIP server, and that your firewall allows traffic on port 5696
  • Authentication fails: Check that you uploaded both the client certificate and the certificate chain to iDRAC