Instance does not start and returns error GLPCRY007E

Edit online

In certain scenarios, the directory server instance might not start and might return error GLPCRY007E. Follow the steps to resolve this issue.

Scenario
  1. Create a directory server instance, inst1, configure the instance, and start the instance. The encryption seed that is used to create the instance, inst1, is thisismyseed.
  2. Drop the instance, inst1, without dropping the database that is associated with it.
  3. Re-create the instance with the encryption seed, thisismyseed, and configure the instance with the existing database.
  4. Start the instance.
Observed
The instance does not start and returns error:
GLPCRY007E The directory key stash file is inconsistent with the 
 associated encrypted data.
Reason
When a directory server instance is created and is started, some information from key stash file (.ksf), is stored in the database. Therefore, an existing database cannot be used with a key stash file that gets created when an instance is re-created.
Workaround

In such case, if you intend to use an existing database with a new instance, then at the time of instance creation you must use -e and -g options to specify the encryption seed and encryption salt values for the new instance. This encryption seed and salt value must be same as the encryption seed and salt value of the dropped instance.

If you did not provide the salt value with the -g option for the instance that you are intending to drop, then the salt value must be determined before an instance is dropped. Issue the idsldapsearch command of the following format to retrieve the salt value. 
idsldapsearch -h IP address -p port -s base -b "cn=crypto,cn=localhost" \
objectclass=* ibm-slapdCryptoSalt