Setting symmetric master keys for the first time when sharing a CKDS in a sysplex environment

Setting symmetric master keys for the first time in a sysplex environment can be accomplished using:

the optional TKE Workstation (Group of coprocessors and/or group of domains function). See the z/OS Cryptographic Services ICSF TKE Workstation User's Guide for more information.
Master Key Entry
PPINIT

Before setting symmetric master keys for the first time in a sysplex environment, you will need to allocate an empty CKDS. For information about defining a CKDS, see z/OS Cryptographic Services ICSF System Programmer's Guide.

Once you have allocated an empty CKDS, all LPARs that will share this CKDS must update their ICSF options data set to use this CKDS as their active CKDS. On the first LPAR that starts ICSF, you will load the symmetric master keys, initialize the CKDS, and set the symmetric master keys. On all other LPARs that will share the same active CKDS, you will only load the same master keys, and then set the master key. You should only initialize the CKDS once from the first LPAR that started ICSF.

Note: AES master keys are only supported on z9 and later servers with coprocessors with the Nov. 2008 or later licensed internal code (LIC).