---
title: "cluster set-certificates"
slug: "cluster-set-certificates"
tags: ["5.4"]
updated: 2026-10-28T01:52:11Z
published: 2026-10-28T01:52:11Z
canonical: "docs.vastdata.com/cluster-set-certificates"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vastdata.com/llms.txt
> Use this file to discover all available pages before exploring further.

# cluster set-certificates

If encryption of data at rest is configured on the cluster with external key management, this command enables you to modify the configuration of the external key manager (EKM).

## Usage

```plaintext
cluster set-certificates --ekm-servers EKM_ADDRESS1[:PORT1][,EKM_ADDRESS2[:PORT2][,EKM_ADDRESS3[:PORT3][,EKM_ADDRESS4[:PORT4]]]]
                        [--ekm-certificate CERTIFICATE]
                        [--ekm-private_key PRIVATE_KEY]
                        [--ekm-ca-certificate CA_CERTIFICATE]
                        [--ekm-certificate-file CERTIFICATE_FILE]
                        [--ekm-private-key-file PRIVATE_KEY_FILE]
                        [--ekm-ca-certificate-file CA_CERTIFICATE_FILE]
                        [--ekm-domain EKM_DOMAIN]      
                        [--ekm-auth-domain EKM_AUTH_DOMAIN]
                        [--ekm-proxy-address PROXY_ADDRESS]
                        [--ekm-bypass-validation BYPASS_VALIDATION]
```

## Required Parameters

| `--ekm-servers EKM_ADDRESS1[:PORT1][,EKM_ADDRESS2[:PORT2][,EKM_ADDRESS3[:PORT3][,EKM_ADDRESS4[:PORT4]]]] ` | Refines the IP addresses or DNS names and port numbers for up to four EKM servers. Valid port range: 1024 - 65535. Default: 5696 Example: `--ekm-servers 192.0.2.0:1024,192.0.2.1:1024` **Note** If you run the command with this option, the set of IP addresses that you specify overrides the previous set. Therefore, be sure to include any pre-existing IP addresses that you do not want to remove. If you run the command without this option, any previously existing IP addresses are unaffected |
| --- | --- |

## Options

| `--ekm-certificate CERTIFICATE` | Specifies the SSL certificate for the connection to the EKM servers. Enter the certificate content encapsulated in quotation marks (""). Include the "-----BEGIN CERTIFICATE-----" and "-----END CERTIFICATE-----" lines from the certificate file content. |
| --- | --- |
| `--ekm-private_key PRIVATE_KEY` | Specifies the private key of the SSL certificate for connecting to the EKM servers. Enter the private key content encapsulated in quotation marks (""). Include the "-----BEGIN EC PRIVATE KEY-----" and "-----END EC PRIVATE KEY-----" lines from the private key file content. |
| `--ekm-ca-certificate CA_CERTIFICATE` | Specifies the CA certificate file for the connection to the EKM servers. Place the file on the CNode host from which you are running the VAST CLI under `/vast/bundles`. Specify `CA_CERTIFICATE` as a file path relative to `/vast/bundles` in quotation marks as `CA-CERTIFICATE`. |
| `--ekm-certificate-file CERTIFICATE_FILE` | Specifies the SSL certificate file for the connection to the EKM servers. Place the file on the CNode host from which you are running the VAST CLI under `/vast/bundles`. Specify the file path in quotation marks as `CERTIFICATE-FILE` relative to `/vast/bundles`. Example:` --ekm-certificate-file "/vast/bundles/cert.pem"`. |
| `--ekm-private-key-file PRIVATE_KEY_FILE` | Specifies the private key file of the SSL certificate for connecting to the EKM servers. Place the private key file on the CNode host from which you are running the VAST CLI under /vast/bundles. Specify the file path relative to `/vast/bundles` in quotation marks as `PRIVATE-KEY-FILE`. Example: `--ekm-private-key-file "/vast/bundles/tmp/cert.key"`. |
| `--ekm-ca-certificate-file CA_CERTIFICATE_FILE` | Specifies the CA certificate file for the connection to the EKM servers. Place the file on the CNode host from which you are running the VAST CLI under `/vast/bundles`. Specify the file path relative to `/vast/bundles` in quotation marks as `CA-CERTIFICATE-FILE`. Example: `--ekm-ca-certificate-file "/vast/bundles/ca-cert.pem"`. |
| `--ekm-domain EKM_DOMAIN` | When using Thales CipherTrust Manager, specify a child domain name for use when logging in. New keys will be created inside the domain. |
| `--ekm-auth-domain EKM_AUTH_DOMAIN` | For use with Thales CipherTrust Manager. Specify the CipherTrust authentication domain of the user. This is the domain where the user was created. The default is an empty string, which is equivalent to the root domain. For example, if you created the domain "vastdomain" on the Thales CipherTrust manager, you should include `--ekm-auth-domain vastdomain` in the command line. |
| `--ekm-proxy-address PROXY_ADDRESS` | Specifies the proxy address when connecting to the Thales CipherTrust Manager via a proxy. Specify PROXY_ADDRESS in the following format: `https://proxy-address:port`. Example: `--ekm-proxy-address https://squid:squid@10.27.103.73:3128` |
| `--ekm-auth-domain EKM_AUTH_DOMAIN--ekm-bypass-validation EKM_BYPASS_VALIDATION` | Include this option to bypass certificate validation. |

## Example

```plaintext
vcli: admin> cluster set-certificates --ekm-servers 192.0.2.0,192.0.2.1,192.0.2.2,192.0.2.3 --ekm-certificate-file "/vast/bundles/cert.pem" --ekm-private-key-file "/vast/bundles/tmp/cert.key" --ekm-ca-certificate-file "/vast/bundles/ca-cert.pem" --ekm-proxy-address https://squid:squid@10.27.103.73:3128
```