> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Validate the integration

> Confirm that SAP ASE reads encrypted data through the HSM key on CryptoHub, recovers encrypted databases at startup, and fails closed without the key.

Confirm that SAP ASE reads encrypted data through the HSM key in CryptoHub, recovers encrypted databases at startup, and fails closed when it can't reach the key.

Run the SQL in `isql` as an SAP ASE login with `sso_role` and `keycustodian_role`. This page uses a fully encrypted test database named `<database>` with a table that has an encrypted column.

## Confirm the key hierarchy

**1. Display the keys**

Display the keys in `master` and in the user database:

```sql title="SQL" theme={null}
use master
go
sp_encryption helpkey
go
use <database>
go
sp_encryption helpkey
go
```

> [!TIP]
>
> `master` lists `hsm_key` protected by `hsm` and `sybencrmasterkey` protected by `hsm key`. The user database lists its own `sybencrmasterkey` protected by `hsm key` and its column keys protected by `master key`.

**2. Read the encrypted column**

```sql title="SQL" theme={null}
select * from <encrypted_table>
go
```

> [!TIP]
>
> The query returns the plaintext values.

## Confirm restart recovery

**1. Restart SAP ASE**

Run `shutdown` in `isql`, and then start SAP ASE from its RUN file as the SAP ASE account. Replace `<server>` with the SAP ASE server name:

```shell expandable lines wrap title="Shell" theme={null}
cd /opt/sap/ASE-16_0/install
/opt/sap/ASE-16_0/bin/startserver -f ./RUN_<server>
```

> [!TIP]
>
> The SAP ASE error log reports `Recovering database '<database>'` and then `Database '<database>' is now online`, and `sp_helpdb <database>` shows `encrypted` without `offline`. The encrypted column returns plaintext values again. SAP ASE decrypted the master keys through CryptoHub during startup.

**2. Regenerate the master key**

Regenerate the server-wide master key under the HSM key:

```sql title="SQL" theme={null}
use master
go
alter encryption key master with external key regenerate key
go
```

> [!TIP]
>
> The command completes without an error, and `sp_encryption helpkey` still lists `sybencrmasterkey` protected by `hsm key`.

## Confirm that SAP ASE fails closed

**1. Store a wrong PIN**

Store a wrong PIN, then restart SAP ASE:

```sql title="SQL" theme={null}
sp_encryption 'hsm_credential', 'lib=libfxpkcs11.so;pin=<wrong-pin>;slot=0'
go
```

> [!TIP]
>
> After the restart, `sp_helpdb <database>` shows the database as `offline`, and the error log reports `Call to Cryptoki API 'C_Login' failed with error code 160 (0xa0) CKR_PIN_INCORRECT`. SAP ASE can't open the encrypted database without CryptoHub.

**2. Restore the PIN**

Restore the correct PIN and bring the database online:

```sql title="SQL" theme={null}
sp_encryption 'hsm_credential', 'lib=libfxpkcs11.so;pin=<endpoint-pin>;slot=0'
go
online database <database>
go
```

> [!TIP]
>
> SAP ASE reports `Database '<database>' is now online`, and the encrypted column returns plaintext values.