> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Validate the integration

> Confirm that SAP ASE reads encrypted data through the HSM key on the Excrypt HSM, including after a restart.

Confirm that SAP ASE reads encrypted data through the HSM key on the Excrypt HSM, including after a restart.

Run the SQL in `isql` as an SAP ASE login with `sso_role` and `keycustodian_role`. This page uses a user database named `<database>` with a table that has an encrypted column, as created in [Configure SAP ASE and create the HSM key](https://docs.futurex.com/Integrations/HSM/Database/SAP_ASE/Configure_SAP_ASE_and_create_the_HSM_key.md).

## Confirm the key hierarchy

**1. Display the keys**

Display the keys in `master` and in the user database:

```sql title="SQL" theme={null}
use master
go
sp_encryption helpkey
go
use <database>
go
sp_encryption helpkey
go
```

> [!TIP]
>
> `master` lists `hsm_key` protected by `hsm` and `sybencrmasterkey` protected by `hsm key`. The user database lists its own `sybencrmasterkey` protected by `hsm key` and its column keys protected by `master key`.

**2. Write and read the encrypted column**

```sql title="SQL" theme={null}
insert into <encrypted_table> values (1, '123-45-6789')
go
select * from <encrypted_table>
go
```

> [!TIP]
>
> The query returns the plaintext value. SAP ASE decrypted the master key through the HSM to use the column key.

## Confirm restart recovery

**1. Restart SAP ASE**

Run `shutdown` in `isql`, and then start SAP ASE from its RUN file as the SAP ASE account. Replace `<server>` with the SAP ASE server name:

```shell title="Shell" wrap theme={null}
source /opt/sap/SYBASE.sh
cd /opt/sap/ASE-16_0/install
/opt/sap/ASE-16_0/bin/startserver -f ./RUN_<server>
```

**2. Read the encrypted column again**

```sql title="SQL" theme={null}
use <database>
go
select * from <encrypted_table>
go
```

> [!TIP]
>
> The query returns the plaintext value. After the restart, SAP ASE loaded the library, logged in to the HSM with the stored credential, and decrypted the master key again. The SAP ASE error log has no `Cryptoki API` errors.

**3. Regenerate the master key**

Regenerate the server-wide master key under the HSM key. This step also confirms the stored credential, because SAP ASE must decrypt and encrypt the master key through the HSM:

```sql title="SQL" theme={null}
use master
go
alter encryption key master with external key regenerate key
go
```

> [!TIP]
>
> The command completes without an error, and `sp_encryption helpkey` still lists `sybencrmasterkey` protected by `hsm key`.

## Confirm that SAP ASE fails closed

**1. Store a wrong password**

Store a wrong password in the HSM credential, then restart SAP ASE:

```sql title="SQL" theme={null}
sp_encryption 'hsm_credential', 'lib=libfxpkcs11.so;pin=<wrong-password>;slot=0'
go
```

> [!TIP]
>
> After the restart, the SAP ASE error log reports `Call to Cryptoki API 'C_Login' failed with error code 160 (0xa0) CKR_PIN_INCORRECT`. A query on the encrypted column returns `Msg 15432: A validation check failed when Adaptive Server decrypted an encryption key`, and `sp_helpdb` shows a fully encrypted database as `offline, encrypted`. SAP ASE can't use its keys without the HSM.

> [!WARNING]
>
> SAP ASE retries the HSM login for every query that needs a key, and each failed login counts toward the login limit of the HSM identity. When the identity reaches the limit, the HSM refuses all of its logins for a short time, including logins with the correct password. Run as few queries as possible while the wrong password is stored. If `online database` fails after you restore the correct password, wait a minute and run it again.

**2. Restore the password**

Restore the correct password and bring any offline database online:

```sql title="SQL" theme={null}
sp_encryption 'hsm_credential', 'lib=libfxpkcs11.so;pin=<identity-password>;slot=0'
go
online database <database>
go
```

> [!TIP]
>
> SAP ASE reports `Database '<database>' is now online`, and the encrypted column returns plaintext values.

## Return to production logging

If you enabled traffic logging during setup, set `<LOG-MODE>` to **ERROR** and `<LOG-TRAFFIC>` and `<LOG-TEMPLATES>` to **NO** in `/etc/fxpkcs11.cfg`. SAP ASE reads the file when it loads the library, so restart SAP ASE for the change to take effect.