Steps

C. Configuring the IBM Security Guardium Key Lifecycle Manager server

1.     Create the ncipher config file (nCipher.cfg).
Default location of the directory:

Windows - C:\Program Files\IBM\WebSphere\Liberty\products\sklm\configLiberty

UNIX - /opt/IBM/WebSphere/Liberty/products/sklm/config

Sample nCipher.cfg file:
-----------
name = TKLM
library=/opt/nfast/toolkits/pkcs11/cknfast.so
# library=C:/nCipher/nfast/cknfast.dll
description= nCipher sample config for TKLM

slotListIndex=1

attributes(*, CKO_SECRET_KEY, *) = {
CKA_ENCRYPT=true
CKA_DECRYPT=true
CKA_SENSITIVE=true
CKA_TOKEN=true
}

attributes(*, CKO_PRIVATE_KEY, *) = {
CKA_SIGN=true
CKA_SENSITIVE=false
# CKA_DERIVE=true
# when using KeyAgreement CKA_DERIVE should
# set to true and CKA_SIGN should set to false
}

attributes(GENERATE, CKO_PUBLIC_KEY, *) = {
CKA_VERIFY=true
}

attributes(GENERATE, CKO_PRIVATE_KEY, CKK_RSA) = {
CKA_DECRYPT=true
CKA_UNWRAP=true
CKA_EXTRACTABLE=true
}

attributes(*, CKO_PUBLIC_KEY, CKK_RSA) = {
CKA_ENCRYPT=true
CKA_WRAP=true
CKA_VERIFY=true
}
attributes(IMPORT, CKO_PRIVATE_KEY, CKK_RSA) = {
CKA_EXTRACTABLE=true
CKA_DECRYPT=true
CKA_UNWRAP=true
CKA_DERIVE=true
}

2.  Only for UNIX, change the ownership of the nCipher.cfg file to db user. For example, klmdb42.     
chown klmdb42:klmdb42 nCipher.cfg                     

3.  In the nCipher.cfg file, change the library parameter to point to the path of the nCipher library, as follows.
For Windows:
library=C:/nCipher/nfast/cknfast.dll
For UNIX:
library=/opt/nfast/toolkits/pkcs11/cknfast

4.     Add the following parameters in the SKLMConfig.properties file:

       On a clean IBM Security Guardium Key Lifecycle Manager server without any data, add the following parameters.      

       pkcs11.config=/opt/IBM/WebSphere/Liberty/products/sklm/config/nCipher.cfg
pkcs11.pin=passphrase
useMasterKeyInHSM=true

      On a IBM Security Guardium Key Lifecycle Manager server with pre-created data, add the following parameters.

      pkcs11.config=/opt/IBM/WebSphere/Liberty/products/sklm/config/nCipher.cfg
pkcs11.pin=passphrase

      Default location of the properties file:
Windows - C:\Program Files\IBM\WebSphere\Liberty\products\sklm\config\
UNIX - /opt/IBM/WebSphere/Liberty/products/sklm/config

Run Master Key REST Service to move the master key from local Java keystore to HSM.
For more information, see: https://www.ibm.com/docs/en/sgklm/4.2?topic=services-master-key-rest-service#ref_ic_rest_master_key

     To update the properties file, use the IBM Security Guardium Key Lifecycle Manager REST API or commands.
Sample REST API request:
PUT https://localhost:port/SKLM/rest/v1/configProperties
{" pkcs11.config” : “SKLM_HOME/data/nCipher.cfg”, “pkcs11.pin”: “passphrase"}

Sample commands:
print AdminTask.tklmConfigUpdateEntry(’[-name pkcs11.config -value hsm_config_file]’)
print AdminTask.tklmConfigUpdateEntry(’[-name pkcs11.pin -value passphrase]’)

   where, passphrase is the "pass phrase" value that you configured in step #7 of B. Configuring the nCipher HSM client.

      Note:

      The parameter pkcs11.pin=passphrase automatically changes to pkcs11.pin.obfuscated after you restart IBM Security Guardium Key Lifecycle Manager and perform a key operation.

      The IBM Security Guardium Key Lifecycle Manager command-line interface is not available from V4.1.1.0. 

5.    Restart WebSphere Liberty.

          a.      Log in as the Db2 user (for example klmdb42).

          b.   Go to the bin directory under the WebSphere Application Server Liberty home directory.

               Windows - drive:\Program Files\IBM\WebSphere\Liberty\bin
         Linux - path/IBM/WebSphere/Liberty/bin

           c. Restart the server by using the restartLibertyServer script.

               Windows

              restartLibertyServer.bat C:\Program Files\IBM\WebSphere\Liberty\bin