ONTAP SSL/TLS & Certificate Management Guide

1. Certificate architecture & scoping in ONTAP

ONTAP manages certificates within a unified security database scoped across administrative boundaries:

• Cluster Scope: Applied to the administrative SVM (the cluster itself). Used for System Manager, ONTAP REST API, cluster administration CLI over SSH/TLS, cluster-peering encryption, and external KMIP key management.
• Data SVM Scope: Applied to individual data virtual servers. Used for S3 object storage endpoints, LDAP over TLS (LDAPS/StartTLS), SVM-scoped REST/web services, and SMB over QUIC.

Three primary certificate types exist in ONTAP:

1. Server Certificates (-type server): Contains the public certificate and associated private key. Presented by ONTAP to clients during TLS handshakes.
2. Root & Intermediate CAs (-type root-ca / -type ca): Public certificates of trusted Certificate Authorities. Used by ONTAP to validate external systems (e.g., Active Directory LDAP servers, syslog endpoints, KMIP key managers, or remote clusters).
3. Client Certificates (-type client): Used when ONTAP acts as a client requiring mutual TLS (mTLS) authentication (e.g., authenticating to external KMIP clusters).

2. Inspecting installed certificates & expiration

Before making changes or during routine audits, inventory installed certificates, their expiration dates, serial numbers, and common names across all SVMs.

# Show all certificates across cluster and data SVMs
security certificate show

# Detailed view showing expiration, issuer, serial, and subtype
security certificate show -fields vserver,common-name,type,subtype,expiration,serial

# Filter for certificates expiring in the next 60 days
security certificate show -expiration <60d

# View SSL configuration and active certificate bindings per SVM
security ssl show

ONTAP also generates EMS warnings (e.g., cert.expired or cert.expiring) when certificates approach expiration (default alert thresholds are 60, 30, and 7 days).

3. Generating CSRs & importing CA-signed certificates

Using enterprise PKI (such as Microsoft Active Directory Certificate Services, HashiCorp Vault, or DigiCert) replaces default self-signed certificates and eliminates browser security warnings.

Step 1: Generate a Certificate Signing Request (CSR) in ONTAP

# Generate CSR for cluster management (cluster scope)
security certificate generate-csr -vserver cluster1 \
  -common-name cluster1.corp.example.com \
  -country US -state "California" -locality "San Jose" \
  -organization "Example Corp" -unit "IT Storage" \
  -hash-function SHA256 -key-size 2048

# Output will display:
# 1. The Certificate Signing Request (CSR) block
# 2. Keep the CLI session or save the generated request

Step 2: Install the Root and Intermediate CA Certificates

Before importing the signed server certificate, ONTAP must trust the signing CA chain:

# Install Root CA into the cluster SVM
security certificate install -vserver cluster1 -type root-ca

# When prompted, paste the PEM-formatted Root CA certificate text.

# Install Intermediate CA (if present)
security certificate install -vserver cluster1 -type ca
# Paste intermediate CA PEM text.

Step 3: Install the Signed Server Certificate

# Install signed server certificate matching the CSR
security certificate install -vserver cluster1 -type server

# When prompted, paste the signed public certificate PEM.
# ONTAP automatically matches the public cert to the private key created during CSR generation.

4. Binding certificates to ONTAP services

Installing a certificate stores it in the database; it must be explicitly bound to the target service to take effect.

A. System Manager, REST API & Web Services (HTTPS)

# Identify the exact certificate common-name and serial
security certificate show -vserver cluster1 -type server

# Bind server certificate to SSL/HTTPS on the cluster SVM
security ssl modify -vserver cluster1 -server-enabled true \
  -ca "Example Corp Root CA" -serial 1234567890ABCDEF

# Verify active binding
security ssl show -vserver cluster1

B. ONTAP S3 Object Storage Endpoints

Data SVMs serving S3 over HTTPS require a server certificate matching the S3 endpoint FQDN or wildcard SAN (e.g., s3.corp.example.com):

# Install server cert into the data SVM (svm_s3)
security certificate install -vserver svm_s3 -type server

# Modify S3 server to bind certificate
vserver object-store-server modify -vserver svm_s3 -is-http-enabled false \
  -is-https-enabled true -secure-port 443 \
  -certificate-name svm_s3_cert_2026

# Verify S3 server status
vserver object-store-server show -vserver svm_s3

C. Secure LDAP (LDAPS / StartTLS)

When authenticating NAS users against Active Directory or OpenLDAP over TLS, the data SVM must trust the directory server's issuing CA:

# Install corporate domain Root CA on the data SVM
security certificate install -vserver vs_nas -type root-ca

# Enable StartTLS or LDAPS on the LDAP client config
vserver services name-service ldap client modify -vserver vs_nas \
  -client-config AD_LDAP -use-start-tls true

# Verify LDAP secure connectivity
vserver services name-service ldap check -vserver vs_nas

D. In-Flight Cluster Peering Encryption

Cluster peering links can use TLS to encrypt SnapMirror traffic in transit over WAN connections:

# Enable TLS encryption on the intercluster peering relationship
cluster peer modify -peer-cluster cluster2 -encryption-protocol-status tls-psk

# Or configure certificate-based authentication for cluster peering (ONTAP 9.14+)
cluster peer modify -peer-cluster cluster2 -auth-type certificate \
  -certificate-name cluster1_peer_cert

E. SMB over QUIC

SMB over QUIC (UDP 443) requires a valid TLS 1.3 server certificate issued to the CIFS server NetBIOS/FQDN name with Client Authentication capabilities:

# Install certificate into the CIFS SVM
security certificate install -vserver vs_cifs -type server

# Enable SMB over QUIC and reference the certificate
vserver cifs security modify -vserver vs_cifs -is-smb-over-quic-enabled true \
  -certificate-name cifs_quic_cert

# Verify SMB QUIC listener
vserver cifs security show -vserver vs_cifs -fields is-smb-over-quic-enabled,certificate-name

5. Certificate renewal & replacement runbook

When an existing certificate nears expiration, renew it non-disruptively using this phased replacement procedure:

1. Generate New CSR / Request Certificate: Generate a fresh CSR with a unique name or request the renewed cert from your PKI team.
2. Install New Certificate alongside Old: Install the new certificate into ONTAP. Both certificates coexist in the certificate store without collision (distinguished by serial number).
3. Re-bind Target Services: Update the service (security ssl modify, vserver object-store-server modify, etc.) to reference the new certificate serial or name. Web sessions and new TLS connections immediately adopt the new certificate.
4. Validate Client Handshakes: Test client connectivity (browser to System Manager, curl to REST API, S3 clients, LDAP lookups).
5. Delete Expired Certificate: Once verified, delete the old certificate to keep the security database clean.

# Verify the certificate is no longer in active use
security ssl show
security certificate show -vserver cluster1

# Delete old certificate by serial number
security certificate delete -vserver cluster1 -type server \
  -common-name cluster1.corp.example.com -serial OLD_SERIAL_HEX

6. TLS protocol versions & cipher hardening

By default, modern ONTAP releases (9.12.1+) disable insecure legacy protocols (SSLv3, TLS 1.0, TLS 1.1) and enforce TLS 1.2 and TLS 1.3. Verify and harden cipher suites to comply with corporate security standards.

# Verify enabled TLS protocol versions for web services
security config show

# Restrict cluster web services to TLSv1.3 and TLSv1.2 only
security config modify -supported-protocols TLSv1.3,TLSv1.2

# Check active cipher suites
security config show -fields supported-ciphers

# Customize allowed ciphers (example: enforcing high-strength ephemeral suites)
security config modify -supported-ciphers "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256"

7. Troubleshooting matrix & common pitfalls