Enable and test encryption in IBM Db2

Perform the following tasks to enable and test encryption in Db2:

Create the KMIP configuration file.
Configure Db2 to use the CryptoHub.
Create the encrypted database and verify the integration.

Create the configuration file

Perform the following steps to create the KMIP configuration file:

Open a text editor and create a kmip.cfg configuration file with the following details:

Text

VERSION=1
PRODUCT_NAME=OTHER
ALLOW_KEY_INSERT_WITHOUT_KEYSTORE_BACKUP=true
SSL_KEYDB=C:\Path\to\clientkeydb.p12
SSL_KEYDB_STASH=C:\Path\to\clientkeydb.sth
SSL_KMIP_CLIENT_CERTIFICATE_LABEL=<LABEL OF CLIENT CERTIFICATE>
ALLOW_NONCRITICAL_BASIC_CONSTRAINT=false
MASTER_SERVER_HOST=<IP ADDRESS OF CryptoHub>
MASTER_SERVER_KMIP_PORT=<KMIP PORT>

The following sample shows an example configuration file:

Text

VERSION=1
PRODUCT_NAME=OTHER
ALLOW_KEY_INSERT_WITHOUT_KEYSTORE_BACKUP=true
SSL_KEYDB=C:\Certs\clientkeydb.p12
SSL_KEYDB_STASH=C:\Certs\clientkeydb.sth
SSL_KMIP_CLIENT_CERTIFICATE_LABEL=ibmdb2
ALLOW_NONCRITICAL_BASIC_CONSTRAINT=false
MASTER_SERVER_HOST=10.0.8.79
MASTER_SERVER_KMIP_PORT=5696

Save the file to your working folder (such as C:\Certs).

Configure Db2

Perform the following steps to configure Db2 to use the CryptoHub.

Open the Db2 command line processor.

Run the following commands to point to the CryptoHub by using the configuration file:

Text

db2 => update dbm cfg using keystore_location C:\Certs\kmip.cfg
db2 => update dbm cfg using keystore_type kmip

Run the following commands to bounce the database:

Text

db2 => db2stop
db2 => db2start

Create the encrypted database

Perform the following steps to create the encrypted database and verify the integration:

In the IBM Db2 Command Line Processor, run the following commands to create an encrypted database:

Text

db2 => create db fxencdb encrypt

Replace fxencdb with the desired database name. Note that database names must not be longer than eight characters.

After running the preceding command, the master encryption key generates inside the IBM Db2 service on the CryptoHub.

The following message displays after the process successfully completes:

None

DB20000I  The CREATE DATABASE command completed successfully.

Verify the database has been successfully encrypted by executing the following command:

Text

db2 => get db cfg for fxencdb

Ensure that the Encrypted Database configuration parameter is set to YES in the command response.

Verify the creation of the key on the CryptoHub by going to Key Management > Keys. The HSM Protected key generated for IBM DB2 is similar to the following naming scheme:

Text

DB2_SYSGEN_DB2_FXENCDB_2024-04-18-11.47.35_4A9769C4

For more information on configuring a KMIP key store with IBM DB2, consult the IBM documentation ( www.ibm.com/docs/en/db2/11.5?topic=keystore-kmip-configuration-file#t0062025).

​Create the configuration file

​Configure Db2

​Create the encrypted database

Create the configuration file

Configure Db2

Create the encrypted database