Configure Encryption Keys panel

This section is where you generate and manage secure keys for both server administrators and users. Click Generate to generate the public and private key files. The key files are automatically registered to the SQLite database.

Engine encryption uses an asymmetric key encryption algorithm and supports two categories of public/private key pairs:

  • A default key pair that is hardcoded and cannot be changed by users.
  • Three types of user-specified key pairs that can be generated and registered with the Server Administration tool for administrative, configuration, and message data.

The engine encrypts data using the currently active public key of the specified type. The engine decrypts data with the private key corresponding to the public key that is used for the original encryption.

Engine encryption uses the OpenSSL RSA algorithm, and generates key files in PEM format.

Engine encryption keeps a history of key pairs in a SQLite database, so engine encryption can decrypt data that is encrypted with previously registered keys. The SQLite database is automatically by the system.

To support migration, engine encryption supports importing keys from another SQLite database.

This table shows the available options on the Encryption tab:

Option Description
Configuration Files Key This key is used to encrypt sensitive information in Cloverleaf configuration files, including:
  • All passwords (including, but not limited to, NetConfig protocols, alert emails, database connections, and web services security configurations).
  • Masked fields in lookup tables and global variables.
Administration Files Key This key is used to encrypt the security settings file and is reserved for use in encrypting administrative configurations and the audit log.

The original server.ini is divided into server.ini and hssecurity.ini. All security server-related upgrades and the enable/disable audit log setting are moved to hssecurity.ini.

  • hssecurity.ini is encrypted.
  • server.ini is not encrypted.
Messages Key This key is used to encrypt data, the SMAT database, and error and internal Raima databases.

Data is encrypted with the current public key, and decrypted with the private key that corresponds with the public key used for the original encryption.

Changes do not require a host server restart.

The default key is installed with the software. If the configuration files, administration files, or messages keys are not specified, then the default key is used to encrypt or decrypt the sensitive data. It can be overridden with user-defined keys. For example, separate user-defined keys can be configured for data versus configuration.

If an encryption key is not configured, then the default key is used for encryption.