VMware Trust Authority and Entrust KeyControl: Integration Guide

1. Disconnect any current connection:

   % Disconnect-VIServer -server * -Confirm:$false

2. Connect as the root user to one of the ESXi hosts in the Trusted Cluster (Workload Cluster):

   % Connect-VIServer -server host_ip_address -User root -Password 'password'

   For example:

   % Connect-VIServer -server xx.xxx.xxx..201 -User root -Password 'xxxxxxxx'
   
   Name                           Port  User
   ----                           ----  ----
   xx.xxx.xxx..201                443   root

3. Confirm the ESXi host:

   % Get-VMHost
   
   Name                 ConnectionState PowerState NumCpu CpuUsageMhz CpuTotalMhz   MemoryUsageGB   MemoryTotalGB Version
   ----                 --------------- ---------- ------ ----------- -----------   -------------   ------------- -------
   xx.xxx.xxx..201      Connected       PoweredOn      16         360       33520          13.190          15.706   7.0.2

4. Assign Get-VMHost to a variable:

   % $vmhost = Get-VMHost

5. Export the ESXi host description of software (the ESXi image).

   By default, this command exports the information to the image.tgz file. The image.tgz file in the example is named image-esxi-201.tgz to indicate what ESXi host this is from. Ensure that the destination directory exists before running this command.

   % Export-VMHostImageDb -VMHost $vmhost -FilePath C:\vta\image-esxi-201.tgz
   
   Mode                 LastWriteTime         Length Name
   ----                 -------------         ------ ----
   -a----         2/15/2022  11:53 AM          41046 image-esxi-201.tgz

   Note	The Export-VMHostImageDb cmdlet also works if you prefer to log in to the vCenter Server of the Trusted Cluster. Repeat for each ESXi version in the cluster that you want to trust. Use a different file name for each version so that you do not overwrite a previously exported file.

1. Assign Get-Tpm2EndorsementKey -VMHost $vmhost to a variable:

   % $tpm2 = Get-Tpm2EndorsementKey -VMHost $vmhost

2. Export the CA certificate of a given TPM manufacturer.

   By default, this command exports the TPM certificate to the cacert.zip file. The cacert.zip file in the example is named tpmcacert-201.zip to indicate what ESXi host this is from. Ensure that the destination directory exists before running this command.

   % Export-Tpm2CACertificate -Tpm2EndorsementKey $tpm2 -FilePath C:\vta\tpmcacert-201.zip
   
   Mode                 LastWriteTime         Length Name
   ----                 -------------         ------ ----
   -a----         2/15/2022  11:51 AM           2858 tpmcacert-201.zip

3. Repeat for each TPM hardware type in the cluster that you want to trust.

   Use a different file name for each TMP hardware type so that you do not overwrite a previously exported file.

   ---

   If you have issues exporting the TPM2 CA Certificate of the EXSi host, with errors like this:

You can Collect the TPM Endorsement Key instead. ---

This method should only be used if you failed to Export the ESXi host TPM CA Certificate .

Check the VMware documentation for detailed instructions on how to Collect the TPM Endorsement Key .

You can export a TPM endorsement key (EK) certificate from an ESXi host, and import it to the vSphere Trust Authority Cluster. You do so when you want to trust an individual ESXi host in the Trusted Cluster.

To import a TPM EK certificate into the Trust Authority Cluster, you must change the Trust Authority Cluster’s default attestation type to accept EK certificates. The default attestation type accepts TPM Certificate Authority (CA) certificates. Some TPMs do not include EK certificates. If you want to trust individual ESXi hosts, the TPM must include an EK certificate.

Change the Trust Authority Cluster’s default attestation type to accept EK certificates

Export the TPM EK certificate

Export the Trusted Cluster’s vCenter Server principal information.

1. Disconnect from the ESXi host:

   % Disconnect-VIServer -server * -Confirm:$false

2. Connect to the vCenter Server of the Trusted Cluster using the Trust Authority Administrator user.

   % Connect-VIServer -server TrustedCluster_VC_ip_address -User trust_admin_user -Password 'password'

   For example:

   % Connect-VIServer -server 10.194.148.12 -User [email protected] -Password 'xxxxxxx'
   
   Name                           Port  User
   ----                           ----  ----
   xx.xxx.xxx..12                 443   HPZ8.LOCAL\Administrator

3. Export the Trusted Cluster’s vCenter Server principal information:

   % Export-TrustedPrincipal -FilePath C:\vta\trustedcluserprincipal-12.json
   
   Mode                 LastWriteTime         Length Name
   ----                 -------------         ------ ----
   -a----         2/15/2022  11:57 AM           1867 trustedcluserprincipal-12.json

4. (Optional) If you want to trust an individual host, you must export the TPM EK public key certificate.

   See Export and Import a TPM Endorsement Key Certificate on VMware documentation site for more details.

   The following files are created:

   • TPM CA certificate file ( .zip file extension)

   • ESXi image file ( .tgz file extension)

   • vCenter Server principal file ( .json file extension)

This key wraps other keys and secrets used by this trusted key provider. The assumption here is that you have deployed an Entrust KeyControl cluster, as described in the Entrust KeyControl nshield Integration Guide .

1. Log into the KeyControl web interface using the tenant login URL.

2. Create a client certificate as described in the Entrust KeyControl nshield Integration Guide and download the certificate bundle.

3. Unzip the certificate bundle. You should have two files:

   1. cacert.pem .

   2. The SSL certificate .pem file named after the name given to the client certificate.

4. To create a key, use the pykmip.py python script referenced in this guide.

5. Install Python on your PowerShell:

   % [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
   % Invoke-WebRequest -Uri "https://www.python.org/ftp/python/3.7.0/python-3.7.0.exe" -OutFile "c:/temp/python-3.7.0.exe"
   % c:/temp/python-3.7.0.exe /quiet InstallAllUsers=0 PrependPath=1 Include_test=0

6. Once python is installed, install pip and then the python pykmip package:

   % py -3 -m ensurepip
   % py -3 -m pip install --upgrade pip
   % py -3 -m pip install pykmip

7. Modify the pykmip.py file so it adheres to your environment. (Change KMIP server name and so on).

8. Copy the client certificate .pem files from KeyControl to the folder where your pykmip.py file is located.

9. Rename the SSL certificate .pem file to vta.pem .

   You should have the following files in the folder:

   cacert.pem
   pykmip.py
   vta.pem

10. Run the python script to create a key:

    %  py -3 .\pykmip.py create_symkey
    
    C:\vta\pykmip\vta.pem C:\vta\pykmip/cacert.pem
    UUID: b20bcb41-96ed-4f63-bd89-c4420ab51534

    This should create a key in KeyControl with the UUID referenced above.

11. Log into the KeyControl Tenant Administration page, select the key and then select Actions > Activate to activate it:

The key is created and activated in KeyControl.

1. Disconnect from all connections:

   %  Disconnect-VIServer -server * -Confirm:$false

2. Ensure that you are connected to the vCenter Server of the Trust Authority Cluster:

   % Connect-VIServer -server TrustAuthorityCluster_VC_ip_address -User trust_admin_user -Password 'password'

   For example:

   % Connect-VIServer -server xx.xxx.xxx..11 -User [email protected] -Password 'xxxxxxxx'
   
   Name                           Port  User
   ----                           ----  ----
   xx.xxx.xxx.11                  443   VSPHERE.LOCAL\Administrator

3. Assign Get-TrustAuthorityCluster information to a variable called $VTA :

   % $VTA = Get-TrustAuthorityCluster 'VTA Cluster'

4. Create the trusted key provider using the New-TrustAuthorityKeyProvider cmdlet. For this command:

   • Use the UUID of the keys created earlier and assign a name. For example, KeyControl1.

   • Use the IP address of the KeyControl server.

   • The PrimaryKeyID is normally a key ID that comes from the key server in the form of a UUID. Do not use the key name for PrimaryKeyID.

   • The New-TrustAuthorityKeyProvider cmdlet can take other options, such as KmipServerPort , ProxyAddress , and ProxyPort .

   • Each logical key provider must have a unique name across all vCenter Server systems.

   • To add multiple key servers to the key provider, use the Add-TrustAuthorityKeyProviderServer cmdlet.

   For example:

   % New-TrustAuthorityKeyProvider -TrustAuthorityCluster $VTA -PrimaryKeyId b20bcb41-96ed-4f63-bd89-c4420ab51534 -Name KeyControl1 -KmipServerAddress xx.xx.xx..160
   
   Name                 PrimaryKeyId         Type       TrustAuthorityClusterId
   ----                 ------------         ----       -----------------------
   KeyControl1          b20bcb41-96ed-4f6... KMIP       TrustAuthorityCluster-domain-c21111

5. Establish the trusted connection so that the KeyControl server trusts the trusted key provider:

   1. Obtain the trusted key providers in the given Trust Authority Cluster:

      % $kp = Get-TrustAuthorityKeyProvider -TrustAuthorityCluster $VTA

      If you have more than one trusted key provider, use commands similar to the following to select the one you want:

      Get-TrustAuthorityKeyProvider -TrustAuthorityCluster $VTA
      # <The trusted key providers listing is displayed.>
      
      $kp = Get-TrustAuthorityKeyProvider -TrustAuthorityCluster $VTA | Select-Object -Last 1
      # Using Select-Object -Last 1 selects the last trusted key provider in the list.

   2. Upload the certificate and private key using the Set-TrustAuthorityKeyProviderClientCertificate command:

      Set-TrustAuthorityKeyProviderClientCertificate -KeyProvider $kp -CertificateFilePath <path/to/certfile.pem> -PrivateKeyFilePath <path/to/privatekey.pem>

      Use the privatekey.pem ( vta.pem ) for both the certfile.pem and privatekey.pem files.

      For example:

      % Set-TrustAuthorityKeyProviderClientCertificate -KeyProvider $kp -CertificateFilePath C:\vta\vta.pem -PrivateKeyFilePath C:\vta\vta.pem
      
      Thumbprint                                Subject
      ----------                                -------
      A031DE6E8BE1034771044B1DA96657CACD5D5DF2  CN=vta, O=HyTrust Inc., C=US

      As a result, the trusted key provider has established trust with the key server.

6. Finish the trust setup by uploading a key server certificate so that the trusted key provider trusts the key server:

   1. Obtain the trusted key providers in the given Trust Authority Cluster:

      % $kp = Get-TrustAuthorityKeyProvider -TrustAuthorityCluster $VTA

      If you have more than one trusted key provider, use commands similar to the following to select the one you want:

      Get-TrustAuthorityKeyProvider -TrustAuthorityCluster $VTA
      
      # <The trusted key providers listing is displayed.>
      
      $kp = Get-TrustAuthorityKeyProvider -TrustAuthorityCluster $VTA | Select-Object -Last 1
      
      # Using Select-Object -Last 1 selects the last trusted key provider in the list.

   2. Get the key server server certificate:

      % Get-TrustAuthorityKeyProviderServerCertificate -KeyProviderServer $kp.KeyProviderServers
      
      Certificate                              Trusted    KeyProviderServerId       KeyProviderId
      -----------                              -------    -------------------       -------------
      [Subject]...                             False      domain-c21111-KeyContr... domain-c21111-KeyControl1

      Initially, the certificate is not trusted, so the Trusted state is False . If you have more than one key server configured, a list of certificates is returned. Verify and add each certificate using the following instructions.

   3. Before trusting the certificate, assign Get-TrustAuthorityKeyProviderServerCertificate -KeyProviderServer $kp.KeyProviderServers information to a variable. Run the $cert.Certificate.ToString() command and verify the output:

      % $cert = Get-TrustAuthorityKeyProviderServerCertificate -KeyProviderServer $kp.KeyProviderServers
      % $cert.Certificate.ToString()
      
      [Subject]
        CN=keycontrol55-1f.interop.com, O=HyTrust Inc., C=US
      
      [Issuer]
        CN=HyTrust KeyControl Certificate Authority, O=HyTrust Inc., C=US
      
      [Serial Number]
        00A0AA8922
      
      [Not Before]
        5/31/2011 8:00:00 PM
      
      [Not After]
        12/31/2049 6:59:59 PM
      
      [Thumbprint]
        1D591D20E8A03BC00DD548CE27498721E86F3B98

   4. Add the KMIP server certificate to the trusted key provider:

      % Add-TrustAuthorityKeyProviderServerCertificate -ServerCertificate $cert
      
      Certificate                              Trusted    KeyProviderServerId       KeyProviderId
      -----------                              -------    -------------------       -------------
      [Subject]...                             True                                 domain-c21111-KeyControl1

7. Verify the status of the key provider:

   1. Refresh the key provider status:

      % $kp = Get-TrustAuthorityKeyProvider -TrustAuthorityCluster $VTA

      If you have more than one trusted key provider, use commands similar to the following to select the one you want:

      Get-TrustAuthorityKeyProvider -TrustAuthorityCluster $VTA
      
      # <The trusted key providers listing is displayed.>
      
      $kp = Get-TrustAuthorityKeyProvider -TrustAuthorityCluster $VTA | Select-Object -Last 1
      
      # Using Select-Object -Last 1 selects the last trusted key provider in the list.

   2. Get the key provider status:

      % $kp.Status
      
      KeyProviderId             Health HealthDetails ServerStatus
      -------------             ------ ------------- ------------
      domain-c21111-KeyControl1     Ok {}            {xx.xxx.xxx..160}

      Note	The status can take a few minutes to be refreshed. To view the status, reassign the $kp variable and rerun the $kp.Status command. A Health status of Ok indicates that the key provider is running correctly.

Check the VMware documentation for more details on how to Configure the Trusted Key Provider for Trusted Hosts Using the vSphere Client .

1. Connect to vCenter Server of the Trusted Cluster by using the vSphere Client.

2. Log in as the vCenter Server Administrator, or an Administrator that has the Cryptographic operations.Manage key servers privilege.

3. Select the vCenter Server , then select Configure .

4. Select Key Providers under Security .

5. Select Add Trusted Key Providers .

   The trusted key providers that are available are shown with a status of Connected/Healthy .

6. Select a trusted key provider and select Add Key Providers .

7. The trusted key provider is shown as Trusted and Connected. If this is the first trusted key provider that you add, it is marked as the default.

ESXi Trusted Hosts can now perform cryptographic operations, such as creating encrypted virtual machines.

Check the VMware documentation for more details on how to Configure the Trusted Key Provider for Trusted Hosts Using the Command Line .

1. Disconnect from all connections:

   %  Disconnect-VIServer -server * -Confirm:$false

2. Ensure that you are connected as the Trust Authority Administrator to the vCenter Server of the Trusted Cluster (Workload cluster):

   % Connect-VIServer -server TrustedCluster_VC_ip_address -User trust_admin_user -Password 'password'

   For example:

   % Connect-VIServer -server xx.xxx.xxx..12 -User [email protected] -Password 'xxxxxxxx'
   
   Name                           Port  User
   ----                           ----  ----
   xx.xxx.xxx.12                  443   HPZ8.LOCAL\Administrator

3. Obtain the trusted key provider:

   % Get-KeyProvider

   You can use the -Name option to specify a single trusted key provider.

4. Assign the Get-KeyProvider trusted key provider information to a variable:

   % $workload_kp = Get-KeyProvider

   If you have multiple trusted key providers, you can use Select-Object to select one of them:

   % $workload_kp = Get-KeyProvider | Select-Object -Index 0

5. Register the trusted key provider:

   % Register-KeyProvider -KeyProvider $workload_kp
   
   Name                      DefaultForSystem     ClientCertificateExpiryDate
   ----                      ----------------     ---------------------------
   KeyControl1               False                1/1/0001 12:00:00 AM

6. Register additional trusted key providers by repeating the previous steps.

7. Configure a default key provider:

   1. Set the default trusted key provider:

      % Set-KeyProvider -KeyProvider $workload_kp -DefaultForSystem
      
      Name                      DefaultForSystem     ClientCertificateExpiryDate
      ----                      ----------------     ---------------------------
      KeyControl1               True                 1/1/0001 12:00:00 AM

   2. To set the key provider at the cluster level, run the following command:

      % Add-EntityDefaultKeyProvider -KeyProvider $workload_kp -Entity 'Workload Cluster'

   3. To set the key provider at the folder level, run the following command:

      % Add-EntityDefaultKeyProvider -KeyProvider $workload_kp -Entity 'TC Folder'

When attempting to Encrypt a VM, the following error occurs:

To resolve this, make sure Secure Boot is enable at the VM.

#!/usr/bin/python

import os
import sys
import time
import logging
import argparse
import threading
from kmip.pie.client import ProxyKmipClient, enums
from kmip.core.factories import attributes

logger = logging.getLogger()
if len(logger.handlers) == 0:
    formatter = logging.Formatter(
        '%(asctime)s %(levelname)s: %(funcName)s:%(lineno)d: %(message)s')
    handler = logging.handlers.WatchedFileHandler('kmip.log')
    handler.setFormatter(formatter)
    logger.addHandler(handler)
    logger.setLevel(logging.DEBUG)

cert = '%s/vta.pem' % (os.getcwd())
cacert = '%s/cacert.pem' % (os.getcwd())
key = '%s/test.key' % (os.getcwd())
print(cert, cacert)
config = {
    'hostname': '10.194.148.160',
    'port' : '5696',
    'cert' : cert,
    'ca': cacert,
    #'key': key,
    'ssl_version': 'PROTOCOL_SSLv23',
    'kmip_version': enums.KMIPVersion.KMIP_1_2
}
KEYFILE = 'keyfile.txt'
COUNT = 10
ASYM_KEYSIZE=1024  #Possible values: 1024, 2048, 4096
SYM_KEYSIZE=256  #Possible values: 128, 256

class KMIPKEK(object):

    def kmip_create_symkey(self, client=None):
        """
        Create KMIP Asymmetric Key
        """
        try:
            if client is None:
                client = ProxyKmipClient(**config)
                client.open()
            uuid = client.create(enums.CryptographicAlgorithm.AES, SYM_KEYSIZE,
                                 operation_policy_name='default',
                                 cryptographic_usage_mask=[enums.CryptographicUsageMask.ENCRYPT,
                                                           enums.CryptographicUsageMask.ENCRYPT])
            #client.activate(uuid)
        except Exception as exc:
            print(exc)
            sys.exit(1)
        return uuid

    def kmip_create_asymkey(self, client=None):
        """
        Creat KMIP Asymmetric key
        """

        try:
            if client is None:
                client = ProxyKmipClient(**config)
                client.open()
            uuid1, uuid2 = client.create_key_pair(
                            enums.CryptographicAlgorithm.RSA,
                            ASYM_KEYSIZE,
                            operation_policy_name='default',
                            public_usage_mask=[enums.CryptographicUsageMask.VERIFY],
                            private_usage_mask=[enums.CryptographicUsageMask.SIGN])
            #client.activate(uuid)
        except Exception as exc:
            #print (exc, uuid1, uuid2)
            print (exc)
            sys.exit(1)
        return uuid1, uuid2

    def kmip_fetch(self, uuid, client=None):
        """
        Fetch KMIP object
        """
        try:
            if client is None:
                client = ProxyKmipClient(**config)
                client.open()
            key = client.get(uuid)
            attr = client.get_attributes(uuid, ['Cryptographic Length'])
            print(attr)
        except Exception as exc:
            print (exc, uuid)
            sys.exit(1)
        return str(key)

    def kmip_destroy(self, guid, client=None):
        """
        Delete KMIP object
        """
        try:
            if client is None:
                client = ProxyKmipClient(**config)
                client.open()
            client.destroy(guid)
            print('Delete kmip guid: %s', guid)
        except Exception as exc:
            print (exc, guid)
            sys.exit(1)

    def kmip_locate(self, sym=True, offset=0, count = 10, client=None):
        try:
            if sym:
                attr = enums.ObjectType.SYMMETRIC_KEY
            else:
                attr = enums.ObjectType.PRIVATE_KEY
            print("Here")
            if client is None:
                client = ProxyKmipClient(**config)
                client.open()
            f = attributes.AttributeFactory()
            print("Here1")
            key = client.locate(
                        maximum_items=int(count),
#                        offset_items=int(offset),
                        attributes=[
                            f.create_attribute(
                                'x-NETAPP-ClusterId',
                                '50b7a51c-6f12-11e4-88de-123478563412'
                            ),
                            f.create_attribute(
                                'x-NETAPP-KeyType',
                                'AES'
                            ),
                            f.create_attribute(
                                'x-NETAPP-Product',
                                'Data ONTAP'
                            ),
                            f.create_attribute(
                                'x-NETAPP-VserverId',
                                '46'
                            ),
                        ]
                    )
        except Exception as exc:
            print (exc)
            sys.exit(1)
        print(key, len(key))

    def kmip_create_symkey500(self):
        """
        Create and write 500 Symmetric KMIP keys
        """
        try:
            client = ProxyKmipClient(**config)
            client.open()
            with open(KEYFILE, 'a') as f:
                for i in range(COUNT):
                    uuid = self.kmip_create_symkey(client)
                    key = self.kmip_fetch(uuid, client)
                    print ("%s: UUID:%s Key:%s" % (i, uuid, key))
                    f.write('%s %s\n' % (uuid, key))
        except Exception as exc:
            print (exc, uuid)
            sys.exit(1)

    def kmip_create_asymkey500(self):
        """
        Create and write 500 Symmetric KMIP keys
        """
        try:
            client = ProxyKmipClient(**config)
            client.open()
            with open(KEYFILE, 'a') as f:
                for i in range(COUNT):
                    uuid1, uuid2 = self.kmip_create_asymkey(client)
                    key1 = self.kmip_fetch(uuid1, client)
                    key2 = self.kmip_fetch(uuid2, client)
                    print ("%s: UUID:%s Key:%s\n" % (i, uuid1, key1))
                    print ("%s: UUID:%s Key:%s\n" % (i, uuid2, key2))
                    f.write('%s %s\n' % (uuid1, key1))
                    f.write('%s %s\n' % (uuid2, key2))
        except Exception as exc:
            print (exc, uuid1, uuid2)
            sys.exit(1)

    def kmip_fetch500(self):
        """
        Fetch and verify KMIP keys against value in file
        """
        try:
            client = ProxyKmipClient(**config)
            client.open()
            i = 0
            with open(KEYFILE, 'r') as fp:
                for line in fp:
                    arr = line.strip().split()
                    guid = arr[0]
                    key = str(client.get(guid))
                    if key == arr[1]:
                        print ("%s: Key match for GUID: %s" % (i, arr[0]))
                    else:
                        print ("%s: Invalid key. Key from KC : %s Key from file: %s" % (i, key, arr[1]))
                        raise RuntimeError('Invalid key for guid: %s' % guid)
                    i += 1
        except Exception as exc:
            print (exc, guid)
            sys.exit(1)

    def kmip_activate500(self):
        """
        Activate all keys
        """
        try:
            client = ProxyKmipClient(**config)
            client.open()
            i = 0
            with open(KEYFILE, 'r') as fp:
                for line in fp:
                    arr = line.strip().split()
                    guid = arr[0]
                    client.activate(guid)
                    print ("%s: Activated KMIP Guid: %s" % (i, guid))
                    i += 1
        except Exception as exc:
            print (exc, guid)
            sys.exit(1)

    def kmip_activate(self, guid):
        """
        Activate specific guid
        """
        try:
            client = ProxyKmipClient(**config)
            client.open()
            client.activate(guid)
            print ("Activated KMIP Guid: %s" % (guid))
        except Exception as exc:
            print (exc, guid)
            sys.exit(1)

    def kmip_revoke(self, guid):
        """
        Activate specific guid
        """
        try:
            client = ProxyKmipClient(**config)
            client.open()
            client.revoke(enums.RevocationReasonCode.CESSATION_OF_OPERATION,
                            guid)
            print ("Revoked KMIP Guid: %s" % (guid))
        except Exception as exc:
            print (exc, guid)
            sys.exit(1)

    def kmip_revoke500(self):
        """
        Revoke all keys
        """
        try:
            client = ProxyKmipClient(**config)
            client.open()
            i = 0
            with open(KEYFILE, 'r') as fp:
                for line in fp:
                    arr = line.strip().split()
                    guid = arr[0]
                    client.revoke(enums.RevocationReasonCode.CESSATION_OF_OPERATION,
                                  guid)
                    print ("%s: Revoked KMIP Guid: %s" % (i, guid))
                    i += 1
        except Exception as exc:
            print (exc, guid)
            sys.exit(1)

    def kmip_destroy500(self):
        """
        Destroy all keys
        """
        try:
            client = ProxyKmipClient(**config)
            client.open()
            i = 0
            with open(KEYFILE, 'r') as fp:
                for line in fp:
                    arr = line.strip().split()
                    guid = arr[0]
                    client.destroy(guid)
                    print ("%s: Deleted KMIP Guid: %s" % (i, guid))
                    i += 1
            os.unlink(KEYFILE)
        except Exception as exc:
            print (exc, guid)
            sys.exit(1)

    def __init__(self):
        parser = argparse.ArgumentParser(
                       description='KMIP commands',
                        usage='''kmip1.py <command> [<args>]
        The commands are:
                create_symkey       Create 256 bit Symmetric KMIP Key and return its guid
                create_asymkey      Create 256 bit Asymmetric KMIP Key and return its guids
                fetch               Fetch Key bits for specified guid
                activate            Activate KMIP object
                revoke              Revoke KMIP object
                destroy             Delete specific key
                kcinfo              Display KeyControl information
                create_symkey500    Create 500 Symmetric KMIP keys and write uuid and KMIP data to a file
                create_asymkey500   Create 500 Asymmetric KMIP keys and write uuid and KMIP data to a file
                verify500           Fetch key from KC and compare it against value in file
                activate500         Activate all keys
                revoke500           Revoke all 500 keys
                destroy500          Destroy all 500 keys
                sym_locate <offset> <count>  Locate symmetric key objects
                asym_locate <offset> <count> Locate asymmetric key objects
              ''')
        parser.add_argument('command', help='Subcommand to run')
        args = parser.parse_args(sys.argv[1:2])
        if not hasattr(self, args.command):
            print ('Unrecognized command: %s' % (args.command))
            parser.print_help()
            exit(1)
        getattr(self, args.command)()

    def create_symkey(self):
        """
        Create KMIP object
        """
        uuid = self.kmip_create_symkey()
        print ("UUID: %s" % (uuid))

    def create_asymkey(self):
        """
        Create Asymmetric KMIP key
        """
        uuid1, uuid2 = self.kmip_create_asymkey()
        print ("UUID1: %s\nUUID2: %s" % (uuid1, uuid2))

    def fetch(self):
        """
        Fetch KMIP object
        """
        parser = argparse.ArgumentParser(
                    description='Fetch KMIP Key object for specified guid')
        parser.add_argument('uuid')
        args = parser.parse_args(sys.argv[2:])
        key = self.kmip_fetch(args.uuid)
        print ("Key: %s" % (key))

    def destroy(self):
        """
        Destroy kmip object
        """
        parser = argparse.ArgumentParser(
                    description='Delete KMIP Key object for specified guid')
        parser.add_argument('uuid')
        args = parser.parse_args(sys.argv[2:])
        self.kmip_destroy(args.uuid)

    def sym_locate(self):
        parser = argparse.ArgumentParser(
                    description='Skip offset items and return result')
        parser.add_argument('offset')
        parser.add_argument('count')
        args = parser.parse_args(sys.argv[2:])
        self.kmip_locate(True, args.offset, args.count)

    def asym_locate(self):
        parser = argparse.ArgumentParser(
                    description='Skip offset items and return result')
        parser.add_argument('offset')
        parser.add_argument('count')
        args = parser.parse_args(sys.argv[2:])
        print(args.count)
        self.kmip_locate(False, args.offset, args.count)

    def activate(self):
        """
        Activate all keys
        """
        parser = argparse.ArgumentParser(
                    description='Activate a KMIP Guid')
        parser.add_argument('guid')
        args = parser.parse_args(sys.argv[2:])
        self.kmip_activate(args.guid)

    def revoke(self):
        """
        Activate all keys
        """
        parser = argparse.ArgumentParser(
                    description='Revoke a KMIP Guid')
        parser.add_argument('guid')
        args = parser.parse_args(sys.argv[2:])
        self.kmip_revoke(args.guid)

    def activate500(self):
        """
        Activate all keys
        """
        self.kmip_activate500()

    def create_symkey500(self):
        """
        Create 500 KMIP keys and write uuid and KMIP data to a file
        """
        self.kmip_create_symkey500()

    def create_asymkey500(self):
        """
        Create 500 Asymmetric keys
        """
        self.kmip_create_asymkey500()

    def verify500(self):
        """
        Fetch KMIP keys and verify it against the value in file
        """
        self.kmip_fetch500()

    def revoke500(self):
        """
        Revoke all keys
        """
        self.kmip_revoke500()

    def destroy500(self):
        """
        Destroy all keys
        """
        self.kmip_destroy500()

    def kcinfo(self):
        """
        Fetch KC information
        """
        print ("KeyControl IP: %s" % (config['hostname']))
        print ("KeyControl KMIP port: %s" % (config['port']))

if __name__ == '__main__':
    KMIPKEK()