--- name: vmwaresolutions-kmip_standalone_ordering title: Ordering KMIP for VMware instances description: As of 17 July 2025, new automated installations of Red Hat® OpenShift® for VMware® are no longer available for new or existing deployments of VMware Cloud Foundation for Classic - Automated instances. You can still use or delete your existing Red Hat OpenShift for VMware automated installations until 16 July 2026. The service will no longer be available from 17 July 2026. last-updated: 2026-03-05 --- > ## Documentation Index > The table of contents for this documentation set is at https://cloud.ibm.com/docs/vmwaresolutions?format=markdown > The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt > Use these files to discover more information as needed. # Ordering KMIP for VMware instances {: #kmip_standalone_ordering} As of 17 July 2025, new automated installations of Red Hat® OpenShift® for VMware® are no longer available for new or existing deployments of VMware Cloud Foundation for Classic - Automated instances. You can still use or delete your existing Red Hat OpenShift for VMware automated installations until 16 July 2026. The service will no longer be available from 17 July 2026. {: deprecated} **End of Marketing**: As of 17 July 2025, new deployments of VMware Regulated Workloads instances are no longer available for new customers. If you are an existing customer, you can still add or delete clusters, add or delete VMware ESXi™ servers or NFS storage, and add or remove services for your existing Regulated Workloads instances. As an existing customer, you can also view or delete your Regulated Workloads instances. {: note} You can order a KMIP™ for VMware® instance without associating it to any VMware Cloud Foundation for Classic - Automated instance for flexible management of the service and instances. ## Before you begin {: #kmip_standalone_ordering-req} Complete the following tasks: * Configure the IBM Cloud® infrastructure credentials on the **Settings** page. For more information, see [User accounts and settings](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-useraccount&format=markdown). * Review all considerations in [Considerations when you install KMIP for VMware instances](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-kmip_standalone_considerations&format=markdown#kmip_standalone_considerations-install). ## Ordering a KMIP for VMware instance {: #kmip_standalone_ordering-step1} ### Settings {: #kmip_standalone_ordering-step1-settings} When you order a KMIP for VMware instance, configure the following settings: #### Resource group {: #kmip_standalone_ordering-resource-group} If **No resource group available** is displayed in this field, you currently do not have permissions to any resource group in this account. Contact the account owner to be assigned an Editor or Administrator role on a resource group in the account. For more information, see [IBM Cloud IAM roles](https://cloud.ibm.com/docs/iam?topic=iam-userroles&format=markdown). {: note} Click **Browse configurations** to open the configuration manager side pane. Here, you can choose a configuration from the list of saved templates to update it and then save it as a new configuration template. #### Instance name {: #kmip_standalone_ordering-config-instance-name} The instance name is set to **kmip-_xx_** by default, where _xx_ represents two randomly generated alphabet characters. You can also specify a name for your KMIP for VMware instance. ### Procedure to order a KMIP for VMware instance {: #kmip_standalone_ordering-step1-procedure} 1. In the IBM Cloud for VMware Solutions console, scroll down to the services section and click **KMIP for VMware** in the **Security and compliance** category. 2. On the **KMIP for VMware** page, configure the service settings as needed. 3. Click **Create**. ### Results after the order {: #kmip_standalone_ordering-step1-results} 1. The deployment of the instance starts automatically and you receive console notification that your order request is being processed. The instance is displayed in the **KMIP for VMware** table on the **KMIP for VMware** > **Resources** pages from the IBM Cloud for VMware Solutions console. The status of the instance is **Installing**. 2. When the instance is successfully deployed, its status is changed to **Inactive**. ## Activating the KMIP for VMware instance {: #kmip_standalone_ordering-step2} ### Prerequisites {: #kmip_standalone_ordering-step2-prereqs} If you are using Hyper Protect Crypto Services (HPCS), you must first create a service authorization that allows your KMIP for VMware instance to access your HPCS instance. Then, grant your KMIP for VMware instance both the platform **Viewer** role and the service **VMware KMIP Manager** role to your HPCS instance. For more information, see [Grant service-to-service authorization in IAM](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-tutorial-kmip-vmware&format=markdown#tutorial-kmip-s2s). ### Settings {: #kmip_standalone_ordering-step2-settings} When you enable the nonactive KMIP for VMware instance, provide the following settings: | Setting | Description | |:------- |:----------- | | **HPCS instances** | The list of available HPCS instances that you can select to use for key management | | **Customer root key** | The list of customer root keys that are stored in your selected HPCS instance | {: caption="Configuration settings for HPCS" caption-side="bottom"} {: class="simple-tab-table"} {: #simpletabtable1} ### Procedure to activate the KMIP for VMware instance {: #kmip_standalone_ordering-step2-procedure} 1. For the key management type, select **Hyper Protect Crypto Services**. 2. To select a key management service, click **Retrieve** to get the list of available HPCS instances and select the one to use for key management. 3. Select the Key Manager instance from the list. 4. Under **Customer root key**, the names and values of the root keys are displayed. Select the root key that you want. 5. (Optional) To add client SSL certificates, click **Add**. In the **Add client SSL certificate** window, enter the name and contents of the certificate, and then click **Add**. The certificate name cannot be reused within your selected instance. The certificate content must be valid and contain the BEGIN CERTIFICATE and END CERTIFICATE tags. {: restriction} 6. Click **Configure**. ### Results after the activation {: #kmip_standalone_ordering-step2-results} 1. The configuration of the instance starts automatically. The status of the instance is changed to **Configuring**. 2. When the instance is ready to use, the status of the instance is changed to **Installed**. ## (Optional) Adding client SSL certificates {: #kmip_standalone_ordering-step3} If you did not add the client SSL certificates in the previous step, you must add it after the instance can be used. ### Procedure to add client SSL certificates {: #kmip_standalone_ordering-step3-procedure} 1. For more information about end of life procedures for IBM Cloud infrastructure services and third-party software products, see [Lifecycle policy for IBM Cloud products](https://cloud.ibm.com/docs/overview?topic=overview-services_availability&format=markdown). If you have any questions or need assistance, send an email to clouddigitalsales@us.ibm.com, or [open a support ticket](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-trbl_support&format=markdown) in the VMware Solutions console. 2. In the **KMIP for VMware** table, click the instance that you want to add certificates for. 3. Click **Add**. 4. In the **Add client SSL certificate** window, enter the certificate name and content, and then click **Add**. The certificate name cannot be reused within your selected instance. The certificate content must be valid and contain the BEGIN CERTIFICATE and END CERTIFICATE tags, and the certificate cannot be reused in the selected region where the instance is deployed. {: attention} ### Results after adding client SSL certificates {: #kmip_standalone_ordering-step3-results} 1. You get a console notification that your request to add the certificate is being processed. 2. When the certificate is added successfully, you get console confirmation and the added certificate is displayed in the **Client SSL certificates** table on the service details page. ## Connecting vCenter Server to the KMIP instance {: #kmip_standalone_ordering-next} Connect your vCenter Server to your KMIP instance by using the client certificate that you uploaded to the KMIP instance. If your KMIP instance is connected to HPCS, you can find details for the single load-balanced KMIP endpoint in your KMIP for VMware instance. Use this endpoint to configure a single key provider in vCenter. You can find the endpoints for each region in the following table: | Location | Endpoints | |:-------- |:--------- | | Dallas | `kmip-1.private.us-south.vmware-solutions.cloud.ibm.com:5696` \n `kmip-2.private.us-south.vmware-solutions.cloud.ibm.com:5696` | | Frankfurt | `kmip-1.private.eu-central.vmware-solutions.cloud.ibm.com:5696` \n `kmip-2.private.eu-central.vmware-solutions.cloud.ibm.com:5696` | | London | `kmip-1.private.uk-south.vmware-solutions.cloud.ibm.com:5696` \n `kmip-2.private.uk-south.vmware-solutions.cloud.ibm.com:5696` | | Osaka | `kmip-1.private.jp-osa.vmware-solutions.cloud.ibm.com:5696` \n `kmip-2.private.jp-osa.vmware-solutions.cloud.ibm.com:5696` | | Sao Paulo | `kmip-1.private.br-sao.vmware-solutions.cloud.ibm.com:5696` \n `kmip-2.private.br-sao.vmware-solutions.cloud.ibm.com:5696` | | Sydney | `kmip-1.private.ap-south.vmware-solutions.cloud.ibm.com:5696` \n `kmip-2.private.ap-south.vmware-solutions.cloud.ibm.com:5696` | | Tokyo | `kmip-1.private.ap-north.vmware-solutions.cloud.ibm.com:5696` \n `kmip-2.private.ap-north.vmware-solutions.cloud.ibm.com:5696` | | Toronto | `kmip-1.private.ca-tor.vmware-solutions.cloud.ibm.com:5696` \n `kmip-2.private.ca-tor.vmware-solutions.cloud.ibm.com:5696` | | Washington DC | `kmip-1.private.us-east.vmware-solutions.cloud.ibm.com:5696` \n `kmip-2.private.us-east.vmware-solutions.cloud.ibm.com:5696` | | Madrid | `kmip-1.private.eu-es.vmware-solutions.cloud.ibm.com:5696` \n `kmip-2.private.eu-es.vmware-solutions.cloud.ibm.com:5696` | {: caption="KMIP for VMware network service endpoint locations" caption-side="bottom"} ## Related links {: #kmip_standalone_ordering-related} * [Viewing KMIP for VMware instances](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-kmip_standalone_viewing&format=markdown) * [Deleting KMIP for VMware instances](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-kmip_standalone_deleting&format=markdown) * [Activity tracking events for VMware Solutions](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-at_events&format=markdown)