CA RiskMinder Administration Guide › Tools for System Administrators › DBUtil: RiskMinder Database Tool › Updating the Master Key

Updating the Master Key

Specified during installation, the master key is used to encrypt the values in the securestore.enc file. It also encrypts all encryption keys that are used by the product and are stored in the RiskMinder database.

If for security reasons you need to change the master key value in securestore.enc, then:

1. Back up the current securestore.enc file.

   The current securestore.enc is available at:

   • On Windows

     <install_location>\Arcot Systems\conf
     

   • On UNIX-based Platforms

     <install_location>/arcot/conf
     

2. Delete the securestore.enc in ARCOT_HOME\conf.
3. Navigate to the following location where DBUtil is available:
   • On Windows

     <install_location>\Arcot Systems\tools\win
     

   • On UNIX-based Platforms

     <install_location>/arcot/tools/<platform_name>
     

4. Run the following command:

   (For software mode) dbutil -init <master_key_name>
   (For hardware mode) dbutil -init <HSM_Key_Label>
   

   The tool re-creates securestore.enc with the master key name that you specify.

   Important! If the master key setup fails, contact CA Support for help.

5. Update the database information in the securestore.enc file.

   The RiskMinder installer automatically configures the database username/password and database DSN/password information in securestore.enc. However, after creating a new securestore.enc file, you must manually insert this information in the new file. You need to use the dbutil -pi option to do so.

   To insert the supplied database values in securestore.enc, use the following commands:

   • (For software mode) dbutil -pi <dbUser> <dbPassword>
   • (For hardware mode) dbutil -pi <dbUser> <dbPassword> [-h HSMPin [-d HSMModule]]

     In the preceding commands, dbUser is the database user name and dbPassword is the password associated with the specified user name. For example:

     dbutil -pi arcotuser welcome123

   Note: The user name that you specify in this command is case-sensitive.

   • (For software mode) dbutil -pi <dsn> <dbPassword>
   • (For hardware mode) dbutil -pi <dsn> <dbPassword> [-h HSMPin [-d HSMModule]]

     In the preceding commands, dsn is the data source name and dbPassword is the database password. For example:

     dbutil -pi arcotdsn welcome123

   Note: The DSN name that you specify in this command is case-sensitive.

6. If you have performed distributed deployment of RiskMinder, then you must copy the new securestore.enc file to all the systems where RiskMinder components are installed.