External Key Manager Menu

Powertech Encryption for IBM i can use keys from External Key Managers to use for encryption and decryption processes. The locations and credentials to these Key Managers must be predefined to the product before they can be used. Currently, the supported External Key Managers are Powertech Encryption for IBM i, Key Management Interoperability Protocol (KMIP), Safenet, and Vormetric.

NOTE: If you intend to use KMIP, you will need a Client Certificate (used instead of a user ID and password), which will need to be added to your External Key Manager. See Appendix C: Adding a Client Certificate to an External Key Manager.

How to Get There

From the Main Menu, choose option 20. Or, submit the command GO CRYPTO/CRYPTO15.

Options

1. Work with External Key Manager (WRKEKM)

Choose this option to open the Work with External Key Managers (WRKEKM) panel, which allows an organization to work with the external key managers in the environment.

2. Add External Key Manager Entry (ADDEKM)

Choose this option to open the Add External Key Manager (ADDEKM) panel, which allows an organization to work with the external key managers in the environment.

3. Change External Key Manager Entry (CHGEKM)

Choose this option to open the Change External Key Manager (CHGEKM) panel, which allows authorized users to change the properties for an EKM entry.

4. Display External Key Manager Entry (DSPEKM)

Choose this option to open the Display External Key Manager (DSPEKM) panel, which allows authorized users to display the properties for an External Key Manager.

5. Remove External Key Manager Entry (RMVEKM)

Choose this option to open the Remove External Key Manager Entry (RMVEKM) panel, which allows authorized users to remove an external key manager entry.

6. Validate External Key Manager Entry (VLDEKM)

Choose this option to open the Validate External Key Manager Entry (VLDEKM) panel, which allows users to test the connection to an existing key manager.

7. Export Public Certificate to the IFS (EXPCLNTCRT)

Choose this option to open the Export Client Certificate (EXPCLNTCRT) panel, which allows authorized users to export a public client certificate from the Digital Certificate Manager into the IFS.