db2p12tokmip - Migrate local keystores to centralized KMIP keystores command

Authorization

Instance owner

Required connection

None

Command syntax

db2p12tokmip command

Command parameters

-to centralized_key_man.cfg

Specifies the path to the centralized KMIP keystore configuration file.

-from local.p12

Specifies the path to the local keystore.

-localpw pw

Specifies the local keystore password if it was not stashed. Users are prompted for the password if the keystore password was not stashed, or if the keystore with the stashed password failed to open.

-sslpw pw

Specifies the keystore password that is holding the SSL certificates that are used to connect to the centralized KMIP keystore.

-dryrun

Prints a list of keys that are to be migrated. However, running this parameter does not run the migration itself. Instead, it is used for testing purposes, and to ensure that the user has the correct file paths and password.

-version or -v

Prints the program's version.

-h or -help

Displays the help message for this command.

Examples

To print the db2p12tokmip description and syntax information, type either of the following commands:

db2p12tokmip -h

or

db2p12tokmip -help

To migrate keys stored in the KEYSTORE_LOCATION in dbm cfg to a centralized KMIP keystore:

db2p12tokmip -to ~/ekeystore.cfg

This example uses the centralized KMIP keystore configuration file ekeystore.cfg. Initially, the command attempts to access the keystore, since the password is assumed to be stashed. If the attempt to access the keystore fails, the user is prompted for the password.

To migrate keys stored in the KEYSTORE_LOCATION in dbm cfg to a centralized KMIP keystore:

db2p12tokmip -to ~/ekeystore.cfg -localpw 1234

Similar to the previous example, this example runs the same procedure. However, the password 1234 is used to access the local keystore.

Usage notes

• The -to parameter is mandatory.

• The configuration file must be passed to the tool to perform the migration.