mrhsm enable

Syntax

mrhsm enable
  [ -active true|false ] Activate/Deactivate the KMIP configuration. Default: true 
  [ -dare ]              Generate the DARE key. Set for DARE-enabled clusters
  -sopin <PIN>           The PIN for the Security Officer (SO) 

Parameters

active

Activates or deactivates the KMIP configuration. If set to true, this command activates (enables) the KMIP feature by creating/retrieving the Core and Common KEKs in the HSM, as well as importing/creating the CLDB and DARE keys. When this is successful, the data-fabric core platform components, including the CLDB and MFS, retrieves the CLDB and DARE keys that are protected by the HSM Core KEK instead of from configuration files.

The KMIP configuration cannot be modified using the mrhsm set command if it is active. To modify any part of the KMIP configuration after activating it, you need to first deactivate the KMIP feature by using mrhsm enable -active false. After the configuration is deactivated, modify the KMIP configuration as needed, and use the mrhsm enable command to activate it again.

dare

Generate the DARE key. This option takes no parameters. Specify this option to generate the DARE key for fresh installations for a DARE-enabled cluster.

sopin

The PIN for the Security Officer. If not specified in the command line, a prompt will be displayed to enter the SO PIN.

Once enabled, you cannot disable the external KMIP feature without reconfiguring data-fabric security using the configure.sh script.