Restore onboard key management encryption keys in ONTAP
Occasionally, you may need to restore an onboard key management encryption key. Once you have verified that a key needs to be restored, you can set up the Onboard Key Manager to restore the key.The procedure you follow to restore your onboard key management encryption keys varies based on your version of ONTAP.
-
Delete the external key manager database if you use NSE with an external KMIP server. For details, see Transition from external key management to ONTAP onboard key management.
-
You must be a cluster administrator to perform this task.
|
If you are using NSE on a system with a Flash Cache module, you should also enable NVE or NAE. NSE does not encrypt data that resides on the Flash Cache module. |
ONTAP 9.6 and later
|
If you are running ONTAP 9.8 or later and your root volume is encrypted, follow the procedure for ONTAP 9.8 or later with encrypted root volume. |
-
Verify that the key needs to be restored:
security key-manager key query -node node
Learn more about
security key-manager key query
in the ONTAP command reference. -
Restore the key:
security key-manager onboard sync
Learn more about
security key-manager onboard sync
in the ONTAP command reference. -
At the passphrase prompt, enter the onboard key management passphrase for the cluster.
ONTAP 9.8 or later with encrypted root volume
If you are running ONTAP 9.8 and later, and your root volume is encrypted, you must set an onboard key management recovery passphrase with the boot menu. This process is also necessary if you do a boot media replacement.
-
Boot the node to the boot menu and select option
(10) Set onboard key management recovery secrets
. -
Enter
y
to use this option. -
At the prompt, enter the onboard key management passphrase for the cluster.
-
At the prompt, enter the backup key data.
After you enter the backup key data, the node returns to the boot menu.
-
From the boot menu, select option
(1) Normal Boot
.
ONTAP 9.5 and earlier
-
Verify that the key needs to be restored:
security key-manager key show
-
Restore the key:
security key-manager setup -node node
Learn more about
security key-manager setup
in the ONTAP command reference. -
At the passphrase prompt, enter the onboard key management passphrase for the cluster.