Installation Guides › Upgrade Guide › Using FIPS-Compliant Algorithms › How to Re-Encrypt Existing Sensitive Data › Re-encrypt Policy and Key Store Data › Re-encrypt Keys Stored in the Policy or Key Store

Re-encrypt Keys Stored in the Policy or Key Store

You re-encrypt the keys stored in the policy or key store to replace the existing keys with versions that are encrypted using FIPS-compliant algorithms.

To re-encrypt the keys stored in the policy or key store

1. Open a command prompt from the computer hosting the Policy server and run the following command:

   smkeyexport -dadmin_name -wadmin_password -ooutput_file_name -l -v -t -cf
   

   -dadmin_name

   Specifies the name of the SOA Security Manager administrator account.

   -wadmin_password

   Specifies the password for the SOA Security Manager administrator account.

   -ooutput_file_name

   (Optional) Specifies the name of the exported file. If you do not specify a file name, the default file name is stdout.smdif.

   Note: Ensure that the file name contains the .smdif extension.

   Example: pskeys.smdif

   -l

   Specifies that a log file be created.

   -v

   (Optional) Enables verbose mode for troubleshooting.

   -t

   (Optional) Enables tracing for troubleshooting.

   -cf

   Specifies that smkeyexport run in FIPS-migration mode.

   Note: When smkeyexport runs in FIPS-migration mode, the keys stored in the policy store are exported and re-encrypted using FIPS-compliant algorithms.

   smkeyexport exports an smdif file that contains the re-encrypted keys.

2. Run the following command:

   smkeyimport -iinput_file_name -dadmin_name -wadmin_password -l -v -t -cf
   

   -iinput_file_name

   Specifies the name of the file output file you created.

   Note: Ensure that the file name you specify includes the .smdif extension.

   -dadmin_name

   Specifies the name of the SOA Security Manager administrator account.

   -wadmin_password

   Specifies the password for the SOA Security Manager administrator account.

   -l

   Specifies that a log file be created.

   -v

   (Optional) Enables verbose mode for troubleshooting.

   -t

   (Optional) Enables tracing for troubleshooting.

   -cf

   Specifies that smkeyimport run in FIPS-migration mode.

   smkeyimport imports the re-encrypted keys into the respective store.

You may now re-encrypt policy store data.