Skip to main content

Restore onboard key management encryption keys in ONTAP

Contributors netapp-ahibbard netapp-aherbin netapp-aaron-holt netapp-bhouser netapp-forry netapp-thomi
PDFs

The procedure you follow to restore your onboard key management encryption keys varies based on your version of ONTAP.

Before you begin
Note If you are using NSE on a system with a Flash Cache module, you should also enable NVE or NAE. NSE does not encrypt data that resides on the Flash Cache module.

ONTAP 9.6 and later

Important If you are running ONTAP 9.8 or later and your root volume is encrypted, follow the procedure for ONTAP 9.8 or later with encrypted root volume.

  1. Verify that the key needs to be restored:
    security key-manager key query -node node

    Learn more about security key-manager key query in the ONTAP command reference.

  2. Restore the key:
    security key-manager onboard sync

    The following ONTAP 9.6 command synchronize the keys in the onboard key hierarchy:

    cluster1::> security key-manager onboard sync

Enter the cluster-wide passphrase for onboard key management in Vserver "cluster1"::    <32..256 ASCII characters long text>

    Learn more about security key-manager onboard sync in the ONTAP command reference.

  3. At the passphrase prompt, enter the onboard key management passphrase for the cluster.

ONTAP 9.8 or later with encrypted root volume

If you are running ONTAP 9.8 and later, and your root volume is encrypted, you must set an onboard key management recovery passphrase with the boot menu. This process is also necessary if you do a boot media replacement.

  1. Boot the node to the boot menu and select option (10) Set onboard key management recovery secrets.

  2. Enter y to use this option.

  3. At the prompt, enter the onboard key management passphrase for the cluster.

  4. At the prompt, enter the backup key data.

    The node returns to the boot menu.

  5. From the boot menu, select option (1) Normal Boot.

ONTAP 9.5 and earlier

  1. Verify that the key needs to be restored:
    security key-manager key show

  2. If you are running ONTAP 9.8 and later, and your root volume is encrypted, complete these steps:

    If you are running ONTAP 9.6 or 9.7, or if you are running ONTAP 9.8 or later and your root volume is not encrypted, skip this step.

  3. Restore the key:
    security key-manager setup -node node

    Learn more about security key-manager setup in the ONTAP command reference.

  4. At the passphrase prompt, enter the onboard key management passphrase for the cluster.