Configuring InfoScale to enable transfer of keys

Last published : Jun 12, 2026
You must configure InfoScale to enable a connection with the Key Management Server (KMS) to transfer and save rest certs.
If you have created multiple InfoScale clusters, ensure you run steps 23 to 28 for every cluster.
The rest certs are renewed every three months and the renewed certs must be uploaded to the KMS server. Run steps 23 to 28 every three months for encryption to work.
Note: After a client rest cert is renewed, ensure that you add the renewed client cert to the client group on the KMS server.
Complete the following steps:
Note: The following steps inform you how to configure IBM Key Management Server. As an administrator, you can configure any KMIP-compliant server. Refer to the procedure of that KMIP-compliant server.
  1. Be ready with the IP address and port number of the Key Management Server (KMS).
  2. Run echo "<IP address of the server >"| base64
Verify the output as under
Server output for base64
  1. Run echo "<Port number of the server >"| base64
Verify the output as under
Port number output for base64
  1. Copy the following content into a file and save it as infoscale-kmip-secret.yaml.
    apiVersion: v1
    data:
      host: <Server output for base64>
      port: <Port number output for base64>
    kind: Secret
    metadata:
      name: infoscale-kmip-encrypt
      namespace: infoscale-vtas
    type: Opaque
    1. Run oc apply -f infoscale-kmip-secret.yaml to deploy the InfoScale secret.
    2. From another terminal, logon to
    https://www.ibm.com/docs/en/sgklm/&4.1.1?topic=objects-registering-client-by-using-graphical-user-interface.
    1. Select Advanced Configuration > Server Certificate. Click** Add**. The Add SSL/KMIP Certificate screen opens.
    2. Select Request certificate from a third-party provider and enter values forCertificate labelandCertificate description.
    3. Click Add Certificate. The certificate is listed as Administer Server Certificates.
    4. Review the Status of the certificate. The status is Certificate is pending.
    5. From the bastion node, run ssh root@<IP address of the KMS >. Enter the password and login.
    6. The certificate you just created is listed under /opt/IBM/WebSphere/AppServer/products/sklm/data/ as <Time stamp>_<Certificate name>.csr.
      Note: The path might vary depending on the KMS version.
    7. Copy content of /opt/IBM/WebSphere/Liberty/products/sklm/data/<Time stamp>_<Certificate name>.csr into another file <Copy of server cert content>.pem.
    8. Run openssl x509 -req -in <Time stamp>_<Certificate name>.csr -CA infoscale-ca.pem -CAkey infoscale-ca-key.pem -CAcreateserial -out <server-certificate-name> -days 1024 -sha256
    9. Review the output for the following message.
    Signature ok
  2. Copy <Certificate name>.crt to the root directory of the Key Management server.
  3. On the Welcome screen of KMS, click Third-party certificates pending import.
  4. In the Import Certificate screen, click Browse and navigate to the certificate you saved. ClickSelect.
  5. Run oc get secret -n infoscale-vtas.
  6. Review the output for the following
    NAME
    infoscale-ca
    1. Run oc get secret -n infoscale-vtas.
    2. Review the output for the following
    NAME
    infoscale-kmip-encrypt
  7. Run oc -n <namespace where cr is deployed> get secret infoscale-sds-rest-tls-cert-<cluster-id> -o jsonpath="{.data['tls\.crt']}" | base64 --decode > <kmip-device-client-cert>,
  8. Copy <kmip-device-client-cert> to the root directory of the KMS.
  9. On the KMS, select Advanced Configuration > Client Device Certificates. Click** Import**.
  10. In the Import SSL/KMIP Certificate for Clients window, assign a name and click Browse to select <device-certificate>.crt from the root directory.
  11. Select the checkbox next to Allow the server to trust this certificate with the associated client device.
  12. Click Import.
After a successful configuration, data is more secure and a need to back up keys required during Disaster Recovery is eliminated.
For a DR configuration
  1. Complete steps 1 to 24 on one of the DR sites to configure infoscale-kmip-encrypt and the server certificate. Ensure that you configure infoscale-kmip-encrypt on all the sites. See steps 4 and 5.
  2. Run the following command on the primary site to get the client certificate.
oc -n infoscale-vtas get secret infoscale-sds-rest-tls-cert-<cluster-id> -o jsonpath="{.data['tls\.crt']}" | base64 --decode > <kmip-primary-cert>
  1. Run the following command on the secondary site to get the client certificate.
oc -n infoscale-vtas get secret infoscale-sds-rest-tls-cert-<cluster-id> -o jsonpath="{.data['tls\.crt']}" | base64 --decode > <kmip-secondary-cert>
  1. Log on to the below URL and perform the following steps to register client and create client group.
https://www.ibm.com/docs/en/sgklm/4.1.1?topic=&objects-registering-client-by-using-graphical-user-interface
  • Navigate to Clients > Clients (subsection) > Create > fill details. Enter \<kmip-primary-cert\> to register client.
  • Similarly, enter \<kmip-secondary-cert\> to register client.
  1. Log on to
https://www.ibm.com/docs/en/sgklm/4.1.1?&topic=mcgctco-creating-managing-client-group-by-using-graphical-user-interface
Navigate to Clients > Client Groups (subsection) > Add > Provide Client Group Name > Create. Select clients from the list and click Save.
  1. Run steps from 23 to 28 again.