Enable and test encryption in IBM Db2

This section shows you how to enable and test encryption for this Db2 integration.

Import the certificate

Perform the following steps to import the signed client certificate:

Put the signed client certificate PEM file into the working folder you created (for example, C:\Certs).

Rename the client certificate file to client.crt.

Run the following command to import the signed client certificate into the local keystore:

Shell

"C:\Program Files\IBM\gsk8\bin\gsk8capicmd_64" -cert -receive -db C:\Certs\clientkeydb.p12 -stashed -file C:\Certs\client.crt

Create the configuration file

Perform the following steps to create the KMIP configuration file:

Open a text editor and create the kmip.cfg configuration file similar to the following template with your details:

None

VERSION=1
PRODUCT_NAME=OTHER
ALLOW_KEY_INSERT_WITHOUT_KEYSTORE_BACKUP=true
SSL_KEYDB=C:\Path\to\clientkeydb.p12
SSL_KEYDB_STASH=C:\Path\to\clientkeydb.sth
SSL_KMIP_CLIENT_CERTIFICATE_LABEL=<LABEL OF CLIENT CERTIFICATE>
ALLOW_NONCRITICAL_BASIC_CONSTRAINT=false
MASTER_SERVER_HOST=<IP ADDRESS OF KMES SERIES 3>
MASTER_SERVER_KMIP_PORT=<KMIP PORT>

The following example shows a sample configuration file:

None

VERSION=1
PRODUCT_NAME=OTHER
ALLOW_KEY_INSERT_WITHOUT_KEYSTORE_BACKUP=true
SSL_KEYDB=C:\Certs\clientkeydb.p12
SSL_KEYDB_STASH=C:\Certs\clientkeydb.sth
SSL_KMIP_CLIENT_CERTIFICATE_LABEL=ibmdb2
ALLOW_NONCRITICAL_BASIC_CONSTRAINT=false
MASTER_SERVER_HOST=10.0.8.79
MASTER_SERVER_KMIP_PORT=5696

Save the file to your working folder (such as C:\Certs).

Configure Db2

Perform the following steps to configure Db2 to use the KMES Series 3:

Open the Db2 Command Line Processor.

Run the following commands to point to the KMES Series 3 by using the configuration file:

Sql

db2 => update dbm cfg using keystore_location C:\Certs\kmip.cfg
db2 => update dbm cfg using keystore_type kmip

Run the following commands to stop and start the database:

Sql

db2 => db2stop
db2 => db2start

Create an encrypted database

Perform the following steps to create an encrypted database and verify the integration:

In the IBM Db2 Command Line Processor, run the following command to create an encrypted database, replacing fxencdb with your database name (no more than eight characters):

Sql

db2 => create db fxencdb encrypt

The master encryption key generates on the KMES Series 3, and you see the following message after the process successfully completes:

Sql

DB20000I  The CREATE DATABASE command completed successfully.

Verify the database encrypted successfully by executing the following command:

Sql

db2 => get db cfg for fxencdb

The Encrypted Database configuration parameter is set to YES in the command response.

Verify the creation of the key on the KMES Series 3 by navigating to Key Management > Keys. A HSM Protected key should have been generated for IBM Db2, similar to the following example:

None

DB2_SYSGEN_DB2_FXENCDB_2024-04-18-11.47.35_4A9769C4

For more information on configuring a KMIP key store with IBM Db2, consult the IBM documentation.

​Import the certificate

​Create the configuration file

​Configure Db2

​Create an encrypted database

Import the certificate

Create the configuration file

Configure Db2

Create an encrypted database