Installation and Upgrade Guides › SiteMinder Upgrade Guide › Using FIPS-Compliant Algorithms › How to Re-Encrypt Existing Sensitive Data › Re-encrypt Policy and Key Store Data › Re-encrypt Keys Stored in the Policy or Key Store

Re-encrypt Keys Stored in the Policy or Key Store

You re-encrypt the keys stored in the policy or key store to replace the existing keys with versions that are encrypted using FIPS-compliant algorithms.

To re-encrypt the keys stored in the policy or key store

1. Open a command prompt from the computer hosting the Policy server and run the following command:

   smkeyexport -dadmin_name -wadmin_password -ooutput_file_name -l -v -t -cf
   

   • -dadmin_name

     Specifies the name of the SiteMinder administrator account.

   • -wadmin_password

     Specifies the password for the SiteMinder administrator account.

   • -ooutput_file_name

     (Optional) Specifies the name of the exported file. If you do not specify a file name, the default file name is stdout.smdif.

     Note: Ensure that the file name contains the .smdif extension.

     Example: pskeys.smdif

   • -l

     Specifies that a log file be created.

   • -v

     (Optional) Enables verbose mode for troubleshooting.

   • -t

     (Optional) Enables tracing for troubleshooting.

   • -cf

     Specifies that smkeyexport run in FIPS-migration mode.

     Note: When smkeyexport runs in FIPS-migration mode, the keys stored in the policy store are exported and re-encrypted using FIPS-compliant algorithms.

   smkeyexport exports an smdif file that contains the re-encrypted keys.

2. Run the following command:

   smkeyimport -iinput_file_name -dadmin_name -wadmin_password -l -v -t -cf
   

   • -iinput_file_name

     Specifies the name of the file output file you created.

     Note: Ensure that the file name you specify includes the .smdif extension.

   • -dadmin_name

     Specifies the name of the SiteMinder administrator account.

   • -wadmin_password

     Specifies the password for the SiteMinder administrator account.

   • -l

     Specifies that a log file be created.

   • -v

     (Optional) Enables verbose mode for troubleshooting.

   • -t

     (Optional) Enables tracing for troubleshooting.

   • -cf

     Specifies that smkeyimport run in FIPS-migration mode.

   smkeyimport imports the re-encrypted keys into the respective store.

You may now re-encrypt policy store data.