---
title: "Fortanix DSM with IBM Db2"
slug: "fortanix-dsm-with-ibm-db2"
updated: 2026-07-24T16:57:18Z
published: 2026-07-24T16:57:18Z
canonical: "support.fortanix.com/fortanix-dsm-with-ibm-db2"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.fortanix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Fortanix DSM with IBM Db2

## 1.0 Introduction

This article describes how to integrate **Fortanix-Data-Security-Manager (DSM)** with **IBM Db2 Using KMIP**.

IBM Db2® is a family of hybrid data management products offering a complete suite of AI-empowered capabilities designed to help you manage both structured and unstructured data on-premises as well as in private and public cloud environments. Db2 is built on an intelligent common SQL engine designed for scalability and flexibility.

## 2.0 Product Tested Version

The following product versions were tested:

- Fortanix DSM version 5.6
- IBM DB2 versions 11.5 and 12.1

## 3.0 Why use Fortanix DSM with IBM Db2?

Db2® native encryption uses a two-tier approach to data encryption. Data is encrypted with a Data Encryption Key (DEK), which is in turn encrypted with a Master Key (MK). The encrypted DEK is stored with the data, while the MK is stored in a keystore external to Db2.

Db2 native encryption ensures that the DEK is never exposed outside of the encrypted database, transaction log, or backup file. There are no interfaces provided to access the DEK in either its clear text or encrypted form. As the MK is stored in a different location from the encrypted data, the chance of the encrypted DEK being concurrently exposed with the MK used to encrypt it is very unlikely. Since the risk of the DEK being exposed is extremely low, the need to rotate it is negligible. The rotation of the MK, which is used to protect the DEK, can be done efficiently without the need to decrypt and re-encrypt the data.

The Db2 database system supports SSL, which means that a Db2 client application that also supports SSL can connect to a Db2 database by using an SSL socket. CLI, CLP, and .NET Data Provider client applications and applications that use the IBM® Data Server Driver for JDBC and SQLJ (type 4 connections) support SSL.

## 4.0 Prerequisites

Ensure the following:

- Fortanix DSM must be accessible.
- IBM Db2 11.5 and higher
- Access to create a certificate for the KMIP Server
- Ensure that the following firewall port is open between the DB2 server and Fortanix DSM:
  - KMIP Port: 5696

## 5.0 Configure Fortanix DSM

A Fortanix DSM service must be configured, and the URL must be accessible. To create a Fortanix DSM account and group, refer to the following sections:

### 5.1 Signing Up

To get started with the Fortanix DSM cloud service, you must register an account at <Your_DSM_Service_URL>. For example, [https://amer.smartkey.io.](https://amer.smartkey.io.) On-premises customers use the KMS URL, and the SaaS customers can use the URLs as listed [*here*](https://support.fortanix.com/hc/en-us/articles/4406135346068-Fortanix-DSM-SaaS-Global-Availability-Map) based on the application region.

*For more information on how to set up the Fortanix DSM, refer to the* [*Sign Up for Fortanix Data Security Manager SaaS*](https://support.fortanix.com/docs/users-guide-sign-up-for-fortanix-data-security-manager-saas)*.*

### 5.2 Creating an Account

Access <Your_DSM_Service_URL> in a web browser and enter your credentials to log in to Fortanix DSM.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/DSM_SaaS_Login_page(15).png)

**Figure 1: Logging in**

*For more information on how to set up an account in Fortanix DSM, refer to the* [*Getting Started with Fortanix Data Security Manager - UI*](https://support.fortanix.com/docs/users-guide-getting-started-with-fortanix-data-security-manager-ui)*.*

### 5.3 Creating a Group

Perform the following steps to create a group in the Fortanix DSM:

1. In the DSM left navigation panel, click the **Groups** menu item, and then click **ADD GROUP** to create a new group.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Add-Group(59).png)

**Figure 2: Add groups**
2. On the **Adding new group** page:
  1. **Title**: Enter a name for your group.
  2. **Description** (optional): Enter a short description of the group.
3. Click **SAVE** to create the new group.

*For more information about groups, refer to* [*Definitions*](/v1/docs/dsm-definitions#40-groups)*.*

> [!NOTE]
> TIP
> 
> It is recommended to configure a **Key undo policy** for groups for the cryptographic keys used by the application before creating or using the keys. Without a configured **Key undo policy**, key deletion is permanent and the deleted key cannot be recovered. Deleting an encryption key may result in permanent loss of access to the protected data and service disruption for applications that depend on the deleted key. *For detailed steps, refer to* [*Key Undo Policy*](/v1/docs/fortanix-dsm-key-undo-policy)*.*

### 5.4 Creating an Application

Perform the following steps to create an application (app) in the Fortanix DSM:

1. In the DSM left navigation panel, click the **Apps** menu item, and then click **ADD APP** to create a new app.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Add-App(56).png)

**Figure 3: Add application**
2. On the **Adding new app** page:
  1. **App name**: Enter the name for your application.
  2. **ADD DESCRIPTION** (optional): Enter a short description of the application.
  3. **Authentication method**: Select the default **API Key** as the authentication method from the drop down menu. *For more information on these authentication methods, refer to the* [*User's Guide: Authentication*](https://support.fortanix.com/docs/users-guide-authentication)*.*
  4. **Assigning the new app to groups**: Select the group created in [*Section 5.3: Creating a Group*](/v1/docs/using-fortanix-data-security-manager-with-ibm-db2#43-creating-a-group)[](/v1/docs/using-data-security-manager-with-idcentral-key-management#43-creating-a-group)from the list.
3. Click **SAVE** to add the new application.

*For more information about applications, refer to* [*Definitions*](https://support.fortanix.com/docs/dsm-definitions#50-applications)*.*

### 5.5 Copying the App UUID

Perform the following steps to copy the app UUID from the Fortanix DSM:

1. In the DSM left navigation panel, click the **Apps** menu item, and then click the app created in [*Section 5.4: Creating an Application*](/v1/docs/using-fortanix-data-security-manager-with-ibm-db2#44-creating-an-application) [](/v1/docs/using-data-security-manager-with-idcentral-key-management#44-creating-an-application)to go to the detailed view of the app.
2. From the top of the app’s page, click the copy icon ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/image-1747062862398.png) next to the app **UUID** to copy it to use in [*Section 6.5: Add Client Certificate and Key to SSL Keystore*](/v1/docs/using-fortanix-data-security-manager-with-ibm-db2#55-add-client-certificate-and-key-to-ssl-keystore) as the value of Common Name (CN) to generate the self-signed certificate and a private key.

## 6.0 Configuration on IBM Db2

> [!NOTE]
> NOTE
> 
> The steps in this section have been validated on Linux systems. The same integration procedure applies to IBM Db2 on Windows platforms; however, some commands and file paths may differ. In such cases, use the appropriate Windows equivalents.

### 6.1 Creating Folders for Certificates and Configuration File

Perform the following steps to create the folder for certificates and configuration files:

1. Log in to the IBM Db2 machine as the DB user.

![3.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/image-1732028944047.png)

**Figure 4: Login to IBM Db2 as a DB user**
2. Create the following two folders:
  1. **KMIP**: to store the configuration files.
  2. **SDKMS_Certs**: to store the certificates.
3. Change directory to `SDKMS_Certs` and run the following command to generate a self-signed certificate:

```bash
openssl req -newkey rsa:2048 -nodes -keyout private.key -x509 -days 365 -out certificate.crt
```

![4.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/360058672251.png)

**Figure 5: Create self-signed certificate**

![5.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/360058672291.png)

**Figure 6: Certificate generated**

### 6.2 Updating the Authentication Method

Perform the following steps to change the authentication method:

1. Go to the detailed view of the app created in [*Section 5.4: Creating an Application*](/v1/docs/using-fortanix-data-security-manager-with-ibm-db2#44-creating-an-application) and then click **Change authentication method** and select **Certificat** to change the authentication method to Certificate.
2. Click **SAVE**.
3. On the **Add certificate** dialog box, click **UPLOAD NEW CERTIFICATE** to upload the certificate file or paste the content of the certificate generated in [*Section 6.1: Create Folders for Certificates and Configuration File*](/v1/docs/using-fortanix-data-security-manager-with-ibm-db2#51-create-folders-for-certificates-and-configuration-file).
4. Select both check boxes to confirm your understanding of the action.
5. Click **UPDATE** to save the changes.

### 6.3 Updating the Certificate in Fortanix DSM

Perform the following steps to update the certificate in the authentication method:

1. Change the configuration from the default **REST API** to **KMIP**.
2. Import the private key and certificate into the SSL keystore. You must combine the private key and certificate into one file.

> [!NOTE]
> NOTE
> 
> - The certificate should come first, followed by the private key.
> - Label this entry; it will be used in the KMIP configuration file. Make a note of the label.
> - Adjust the path of the `sdkms.pem` file based on your setup.

```bash
cat certificate.crt private.key > sdkms.pem
```

![7.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/360058508872.png)

**Figure 7: Combine cert and private key**
3. Run the following command to verify that the private key matches the certificate:

```bash
openssl x509 -noout -modulus -in certificate.crt | openssl md5
```

### 6.4 Creating the SDKMS-KMIP.P12 and Stashed File

Run the following command to create the `.p12` and stashed file:

```bash
gsk8capicmd_64 -keydb -create -db "sdkms-kmip.p12" -pw "sdkms-kmip.pWd" -type pkcs12 -stash
```

In case you get an error as the `gsk8capicmd_64 `command is not found, you need to export the libraries for `gsk8capicmd_64` from `sqllib`.

Linux Environments:

```bash
export LD_LIBRARY_PATH=$HOME/sqllib/lib64/gskit:$LIBPATH
export PATH=$HOME/sqllib/gskit/bin:$PATH
```

Re-run the above command to create `.p12` and stash file.

![8.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/360058672771.png)

**Figure 8: Create .p12 and stash file**

The `sdkms-kmip.p12` and `sdkms-kmip.sth` files are created.

### 6.5 Adding Client Certificate and Key to SSL Keystore

Perform the following steps to add a client certificate and key to the SSL keystore:

1. Run the following command to add the client certificate and key to the SSL keystore:

```bash
gsk8capicmd_64 -cert -add -db "sdkms-kmip.p12" -stashed -label "sdkms_app_cert" -file "sdkms.pem"
```
2. Obtain the CA certificate from your Fortanix DSM installation and copy it to a file named `CA.pem`. If the CA certificate includes a chain, then the complete chain including the DSM TLS cert must be copied into `CA.pem` file. You can download the chain from the Fortanix DSM UI by navigating to the DSM URL and viewing the certificates.
3. Run the following command in the IBM shell to create the `CA.pem` file:

```bash
touch CA.pem
```
4. Perform `vi` on `CA.pem` file and then paste the certificate information. The `CA.pem` file will contain the following:
  - DSM certificate
  - Intermediate CA certificate (if available)
  - Root CA certificate

![9.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/360058509132.png)

**Figure 9: Output of CA.pem**

### 6.6 Importing CA Certificate into SSL Keystore

Run the following command to import CA Certificate into the SSL keystore:

```bash
gsk8capicmd_64 -cert -add -db "sdkms-kmip.p12" -stashed -label "trustedCA" -file CA.pem
```

### 6.7 Listing Certificate in the Keystore

Run the following command to list and verify the certificate in your keystore:

```bash
gsk8capicmd_64 -cert -list -db sdkms-kmip.p12 -stashed
```

![10.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/360058509192.png)

**Figure 10: List certificates**

Create a KMIP configuration file in the KMIP folder. The following is a sample `kmip.cfg` configuration file:

```bash
---------------------------
VERSION=1
PRODUCT_NAME=OTHER
ALLOW_KEY_INSERT_WITHOUT_KEYSTORE_BACKUP=true
SSL_KEYDB=/database/config/db2inst1/SDKMS_Certs/sdkms-kmip.p12
SSL_KEYDB_STASH=/database/config/db2inst1/SDKMS_Certs/sdkms-kmip.sth
SSL_KMIP_CLIENT_CERTIFICATE_LABEL=sdkms_app_cert
MASTER_SERVER_HOST=<fortanix_dsm_hostname>   					
MASTER_SERVER_KMIP_PORT=5696		
------------------------------
```

![11.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/360058672931.png)

**Figure 11: Create a KMIP config file**

> [!NOTE]
> NOTE
> 
> - Update the path of `SSL_KEYDB `and `SSL_KEYDB_STASH` based on your setup.
> - Ensure that `SSL_KMIP_CLIENT_CERTIFICATE_LABEL` matches the label you used for the keystore.
> - Set `MASTER_SERVER_HOST` to the Fortanix DSM cluster’s URL.

### 6.8 Configuring a Db2 Instance to Use a Keystore

Perform the following steps to configure a Db2 instance to use a keystore:

1. Set two database manager configuration parameters: `keystore_type` and `keystore_location`.
2. Run the following command to set the `keystore_type` to `KMIP` for centralized keystore and the `keystore_location` to the absolute path of the keystore configuration file:

```bash
db2 update dbm cfg using keystore_location /mnt/blumeta0/home/db2inst1/KMIP/kmip.cfg keystore_type kmip
```

![12.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/360058673051.png)

**Figure 12: Set keystore type and location**
3. Run the following command to restart the Db2 instance for the changes to take effect:

```bash
db2stop
db2start
```

![13.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/360058673151.png)

**Figure 13: Start and stop the Db2**
4. Run the following command to verify that the Db2 manager configuration. Look at value of keystore type and keystore location:

```bash
db2 get dbm cfg
```

![14.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/360058509452.png)

**Figure 14: Verify database manager configuration**

### 6.9 Renewing the Fortanix DSM Db2 App Certificate

Perform the following steps to renew the Fortanix DSM Db2 app certificate:

1. Run the following command using the existing private key to renew the certificate:

```bash
openssl req -key private.key -new -x509 -days 700 -out renewcertificate.crt
```

![DB2_Certificate_Renewal.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/4983366859668.png)

**Figure 15: Renew certificate**

![DB2_Certificate_generated.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/4983351989140.png)

**Figure 16: Certificate generated**
2. In the DSM left navigation panel, click the **Apps** menu item, and click the app created in [*Section 5.4: Creating an Application*](/v1/docs/using-fortanix-data-security-manager-with-ibm-db2#44-creating-an-application) to go to the detailed view of the app.
3. In the **INFO** tab, click **UPDATE** to upload a new certificate.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/image-1768854432779.png)

**Figure 17: Update application authentication to certificate**
4. Run the following command to import the private key and certificate into the SSL key store. Combine the private key and certificate into one file:

```bash
cat renewcertificate.crt private.key > sdkms.pem
```
5. Optional - Run the following commands to verify that the private key matches the certificate and CSR.

```bash
openssl x509 -noout -modulus -in certificate.crt | openssl md5
openssl x509 -noout -modulus -in renewcertificate.crt | openssl md5
```
6. Optional - Run the following commands to remove the existing `sdkms.pem` entry from the current `p12` file:

```bash
gsk8capicmd_64 -cert -delete -db "sdkms-kmip.p12" -stashed -label "sdkms_app_cert"
```
7. Run the following commands to add the client certificate and key to the SSL keystore:

```bash
gsk8capicmd_64 -cert -add -db "sdkms-kmip.p12" -stashed -label "sdkms_app_cert" -file "sdkms.pem"
```

> [!NOTE]
> NOTE
> 
> The database should be able to communicate with Fortanix DSM using the new certificate. The `db2stop` and `db2start` commands may be needed to apply the changes.
8. Run the following command to delete the existing `CA.pem` from the `p12` file:

> [!NOTE]
> NOTE
> 
> Importing a CA certificate is an optional step and is only needed if there is a change in the Fortanix DSM CA cert.

```bash
gsk8capicmd_64 -cert -delete -db "sdkms-kmip.p12" -stashed -label "trustedCA" -file CA.pem
```
9. Run the following command to list and verify the certificates in your keystore:

```bash
gsk8capicmd_64 -cert -list -db sdkms-kmip.p12 -stashed
```

### 6.10 Updating Certificate in IBM Db2 Keystore

Perform the following steps to update the certificate in IBM Db2 keystore:

1. Run the following command to verify the certificate in the IBM Db2 keystore:

```bash
gsk8capicmd_64 -cert -list -db sdkms-kmip.p12 -stashed
```

Output:

```bash
db2inst1@2407b7a6943b SDKMS_Certs]$ gsk8capicmd_64 -cert -
list -db sdkms-kmip.p12 -stashed
Certificates found
* default, - personal, ! trusted, # secret key
!       CN= <fortanix_dsm_url>
!       "CN=R3,O=Let's Encrypt,C=US"
!       trustedCA
-       sdkms_app_cert
[db2inst1@2407b7a6943b SDKMS_Certs]$
```
2. Run the following command to create a new CSR request:

```bash
gsk8capicmd_64 -certreq -recreate -db sdkms-kmip.p12 -stashed -label "sdkms_app_cert" -target new_cert_request.csr
```
3. **Sign**: Send the resulting `new_cert_request.csr` to be signed by the original Certificate Authority (CA).
4. **Receive**: After the signed certificate has been returned (assuming you got it back as `new_cert_signed.csr`) then receive it back into your server keystore.

```bash
gsk8capicmd_64 -cert -receive -db sdkms-kmip.p12 -stashed -file new_cert_signed.csr
```
5. **Verify**: Verify the new dates on the received certificate.

```bash
gsk8capicmd_64 -cert -details -label "sdkms_app_cert" -db sdkms- kmip.p12 -stashed
```
6. **Restart**: For the new certificate to take effect, the Db2 server instance must be restarted.

```bash
db2stop
db2start
```

### 6.11 Creating an Encrypted Database

Run the following command to create an encrypted database:

```bash
db2 create db mydb1 encrypt
```

![15.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/360058509532.png)

**Figure 18: Create encrypted database**

In the DSM left navigation panel, click the **Security Objects** menu item to view the master key created in Fortanix DSM.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Screenshot (2689).png)

**Figure 19: Master key created**

In the DSM left navigation panel, click the **Apps** menu item, and click the app created in [*Section 5.4: Creating an Application*](/v1/docs/using-fortanix-data-security-manager-with-ibm-db2#44-creating-an-application) to go to the detailed view of the app and view the logs.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/image-1768854452076.png)

**Figure 20: Activity logs**

If you encounter an error in your environment, troubleshoot certificate and network-related issues to ensure successful communication with the Fortanix DSM.

## 7.0 Rotate Master Keys in Fortanix DSM with IBM Db2

Rotating your encryption keys is part of a complete security policy. And as with passwords, how often is a controversial topic. This article is intended to give you information to make an informed decision about how and when to rotate your encryption keys. The focus is the keys that protect your data at rest and do not discuss SSL certificates.

IBM Db2 native encryption uses a 2-tier approach to data encryption where the data is encrypted with a Data Encryption Key (DEK) and the DEK itself is encrypted with a Master Key (MK). The encrypted DEK is stored with the data while the MK is stored in a keystore external to Db2.

As the master key is stored outside of the database manager, the requirement and frequency to rotate the master key depend on the type of keystore in use and the protections provided by the keystore. A local keystore file is protected by a password and operating system file permissions, however, it is owned by the Db2 Instance Owner, which is often a shared service account. In such an environment policy to rotate the master key on a regular basis would be natural. On the other extreme, master keys protected by Hardware Security Modules (HSM) require much less rotation if at all. Master keys protected by an HSM never leave the secure confines of the hardware device and strong controls exist to prevent the key from being extracted. Master keys accessed from a KMIP server fall somewhere in the middle. Strong controls exist within the KMIP server to authorize who has access to the master keys and audit their usage. However, these servers are often deployed as software running on a traditional operating system and servers and are only as secure as the environment in which they are deployed. On the other hand, there are secure HSMs offering KMIP interfaces. A key rotation schedule would be suggested by the security hardening of the KMIP server and the environment in which it is deployed.

Db2 provides routine `SYSPROC.ADMIN_ROTATE_MASTER_KEY()` to rotate the database master key to a new value. This operation decrypts the database DEK and re-encrypts it with the new master key.

The 2-tier approach ensures that the key used to encrypt the data, the DEK, is never exposed outside of the encrypted database, transaction log, or backup and no interfaces exist within Db2 to access the DEK. Since the MK is stored in a different location from the encrypted data, this makes concurrent exposure of the encrypted data and the MK much less likely again reducing risk. Finally, since the DEK is not exposed, there is little reason to rotate it, and rotation of the MK used to protect the DEK, can be done efficiently without the need to decrypt and re-encrypt the data itself.

### 7.1 Rotating Keys in Db2

Perform the following steps to rotate the key in IBM Db2:

1. Run the following command to list your DB directory:

```bash
db2 list db directory
```

![ListDB.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/4407274204948.png)

**Figure 21: List DB directory**
2. Run the following command to connect the DB to the same database:

```bash
db2 connect to mydb1
```

![ConnecttoDB.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/4407274206612.png)

**Figure 22: Connect DB**
3. Run the following command to check the encryption information:

```bash
db2 "select * from table(sysproc.admin_get_encryption_info())"
```

![20.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/360058509892.png)

**Figure 23: Check encryption info**
4. Run the following command to rotate the master key from Db2:

```bash
db2 "CALL SYSPROC.ADMIN_ROTATE_MASTER_KEY (NULL)"
```

![21.1.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/360060177951.png)

**Figure 24: Rotate master key**
5. Once the key is rotated, check on Fortanix DSM end if the Master Key is rotated.

In the DSM left navigation panel, click the **Apps** menu item, and then click the app created in [*Section 5.4: Creating an Application*](/v1/docs/using-fortanix-data-security-manager-with-ibm-db2#44-creating-an-application) to find a new key created in Fortanix DSM.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/image-1768854472722.png)

**Figure 25: Check in Fortanix DSM**

## 8.0 Backup and Restore Encrypted Database

Perform the following steps:

1. Run the following command to take backup of the database:

```bash
db2 backup database mydb1
```

Where, `mydb1` is the database that is encrypted with keys in Fortanix DSM.
2. Move the backup file generated to the destination server.
3. On the destination server, configure Fortanix DSM integration for the new Db2 instance as described in [*Section 5.4: Creating an Application*](/v1/docs/using-fortanix-data-security-manager-with-ibm-db2#44-creating-an-application) to [*Section 6.8: Configure a Db2 Instance to Use a Keystore*](/v1/docs/using-fortanix-data-security-manager-with-ibm-db2#58-configure-a-db2-instance-to-use-a-keystore). This will be a new configuration with a new app.

> [!NOTE]
> NOTE
> 
> The app must be created under the same group as earlier.
4. Run the following command to restore the backup of the encrypted database `mydb1`.

```bash
db2 restore db mydb1 encrypt
```
5. Run the following command to verify that you can query the encrypted data in the restored database:

```bash
db2 list db directory
db2 connect to mydb1
db2 "select * from <table_name>"
```

You should now be able to connect to the database and select data from tables.
6. Run the following query to see the new master key used by the database:

```bash
db2 "select * from table(sysproc.admin_get_encryption_info())"
```
7. Verify from the Fortanix DSM UI that the new Db2 Key from the previous step is seen under the group’s security objects.

## 9.0 Migrate from a Local Keystore to a Centralized KMIP Keystore

If you want to migrate your Db2 local keystore to a centralized keystore that is configured for the Key Management Interoperability Protocol (KMIP), you can copy your master keys to the centralized keystore by issuing the `db2p12tokmip` command.

### 9.1 Prerequisites

Ensure the following:

- Create a KMIP keystore configuration file.
- Configure TLS between the Db2 instance and the centralized key manager.

### 9.2 Procedure

Perform the following steps to migrate from a local keystore to a centralized KMIP keystore:

1. Set up the centralized KMIP keystore.
2. Set the `allow_key_insert_without_keystore_backup` parameter to `TRUE` in the centralized KMIP keystore configuration file.
3. Copy all master keys from the local keystore to the centralized KMIP by issuing the `db2p12tokmip` command.

![mceclip0.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/360097067851.png)

**Figure 26: Copy all master keys**

For example,

```bash
db2p12tokmip -from /home/test/keystores/ne-keystore.p12 -to /database/config/db2inst1/KMIP/kmip.cfg
```

Where,
  - `/home/test/keystores/ne-keystore.p12`: Refers to the `.p12` file for the local keystore.
  - `/database/config/db2inst1/KMIP/kmip.cfg`: Refers to the configuration file for the KMIP keystore.

## 10.0 Remove Fortanix Integration from DB2

This section describes how to remove the Fortanix DSM integration from the DB2 and revert to a local wallet TDE.

Perform the following steps:

1. Run the following command while the database is still connected to Fortanix DSM (KMIP) to obtain the current MK label:

```bash
db2pd -db <db_name> -encryptioninfo
```

Replace `&lt;db_name&gt;` with your actual database name.

Example output:

```bash
DB2_SYSGEN_db2inst1_CRYPTODB_2026-06-16-08.38.29_DC77573E
```

> [!NOTE]
> NOTE
> 
> Record the MK label. You will use it later when adding the MK to the local keystore.
2. Locate the MK in Fortanix DSM and copy its UUID.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/0.png)

**Figure 27: Copy UUID**
3. Run the following command to obtain an access token:

```bash
access_token=$(curl -s -X POST 'https://api.<DSM_ENDPOINT>/sys/v1/session/auth' --cert /path/to/certificate/certificate.crt --key /path/to/privatekey/private.key -u "<app_uuid>:" | grep -Po '"access_token"\s*:\s*"\K[^"]+')
```

Where,

> [!NOTE]
> NOTE
> 
> Retain the trailing colon (:) after the app UUID.
  - `&lt;DSM_ENDPOINT&gt;`: Specifies the Fortanix DSM endpoint.
  - `&lt;app_uuid&gt;`: Specifies the Fortanix DSM app UUID copied in [*Section 5.5: Copying the App UUID*](/v1/docs/fortanix-dsm-with-ibm-db2#55-copying-the-app-uuid).
4. Run the following command to verify that the access token was retrieved successfully:

```bash
echo $access_token
```

Example output:

```bash
[db2inst1@b8e5461b2836 SDKMS_Certs]$ echo $access_token
0fSGwKCYnMB*******u4gbsa4LTgtodYoBHJ-iTz42gdLgyNx-d9jsNHK0fe8PHFZDW6eaYfIw
```

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/1_1(1).png)

**Figure 28: Verify access token**
5. Run the following command to export the MK from Fortanix DSM:

```bash
key_material=$(curl -s --location --request POST 'https://api.<DSM_ENDPOINT>/crypto/v1/keys/export' --header "Authorization: Bearer $access_token" --cert /path/to/certificate/certificate.crt --key /path/to/privatekey/private.key --header 'Content-Type: application/json' --data-raw '{"kid": "<MASTER_KEY_UUID_FROM_DSM>"}' | grep -Po '"value"\s*:\s*"\K[^"]+')
```

Replace the `&lt;MASTER_KEY_UUID_FROM_DSM&gt;` with the UUID of the MK obtained in *Step 2*.

Verify that the key material is successfully retrieved:

```bash
echo $key_material
```

Example output:

```bash
[db2inst1@b8e5461b2836 SDKMS_Certs]$ echo $key_material
ewtQ******OJEX4Q/oMAR/Kb2Km+sxVjeKllANM=
```

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/2(5).png)

**Figure 29: Verify key material**
6. Run the following command to decode the exported Base64-encoded key material and save it as a binary file:

```bash
echo $key_material| base64 -d > /tmp/raw_mek.bin
```
7. Run the following command to add the MK to the local DB2 PKCS12 keystore:

```bash
gsk8capicmd_64 -secretkey -add -db /path/to/local/Keystore/db2_local.ps12 -stashed -label "<MASTER_KEY_LABEL>" -file /tmp/raw_mek.bin
```

Replace `&lt;MASTER_KEY_LABEL&gt;` with the master key label obtained in *Step 1*.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/3(3).png)

**Figure 30: Add master key to local DB2**
8. Run the following command to verify that the MK was added to the local keystore:

```bash
gsk8capicmd_64 -cert -list   -db /path/to/local/db2_local.ps12   -stashed
```
9. Run the following commands to configure DB2 to use the local PKCS12 keystore:

```bash
db2 update dbm cfg using KEYSTORE_TYPE pkcs12
db2 update dbm cfg using KEYSTORE_LOCATION /path/to/local/db2_local.ps12
```
10. Connect to the encrypted database and verify that it is accessible.
11. Disable the Fortanix DSM application to ensure that the connection between DB2 and Fortanix DSM is terminated.
12. Restart the DB2 instance.

After the restart, connect to the database and verify that the encrypted data is still accessible.

Fortanix Data Security Manager (DSM) is the world’s first cloud service secured with Intel® SGX. With Fortanix DSM, you can securely generate, store, and use cryptographic keys and certificates, as well as other secrets such as passwords, API keys, tokens, or any blob of data. Your business-critical applications and containers can integrate with Fortanix DSM using legacy cryptographic interfaces (PKCS#11, CNG, and JCE) or using the native Fortanix DSM RESTful interface.

Fortanix Data Security Manager (DSM) is the world’s first cloud service secured with Intel® SGX. With Fortanix DSM, you can securely generate, store, and use cryptographic keys and certificates, as well as other secrets such as passwords, API keys, tokens, or any blob of data. Your business-critical applications and containers can integrate with Fortanix DSM using legacy cryptographic interfaces (PKCS#11, CNG, and JCE) or using the native Fortanix DSM RESTful interface.

## Related

- [Fortanix DSM with IBM Informix](/fortanix-dsm-with-ibm-informix.md)
- [Port Requirements](/fortanix-data-security-manager-port-requirements.md)
- [Fortanix DSM with HashiCorp Vault Enterprise](/fortanix-dsm-with-hashicorp-vault-enterprise.md)
- [Account Quorum Policy](/fortanix-dsm-account-quorum-policy.md)