Unlocking the operating system drive
There are two supported mechanisms for securing and unlocking operating system drives:
User‑managed key
EKMS‑managed key
During a system reboot, the appliance attempts to unlock the operating system drives automatically. If it cannot, what you are prompted for depends on why the automatic unlock did not succeed:
If the key database has been cleared, the appliance prompts you to enter the key at the console. This applies whether the appliance uses the internal KMS or an external KMS. Enter the key in hex-encoded format if the appliance uses an external KMS, or in plain text if it uses the internal KMS.
If the appliance uses an external KMS and cannot reach it - for example, the KMS is shut down or unreachable, or there is a network error - the appliance prompts you to enter the key at the console. The key must be entered in hex-encoded format. The key is not case-sensitive, and leading and trailing spaces are ignored.
If the appliance uses an external KMS and cannot obtain the key because the KMS client certificates on the appliance have expired, the appliance prompts you to choose one of the following recovery options:
Retrieve a temporary certificate bundle from a remote host with SCP. The appliance uses the temporary certificates to obtain the encryption key from the external KMS and then unlocks the drives. The appliance continues to use the external KMS.
See Unlocking the operating system drive with a certificate bundle.
Enter the encryption key manually.
In case of transient failures, you may retry the process by performing an IPMI power cycle.
Note:
Avoid using power reset. A power reset after an incorrect key entry is counted as a failed unlock attempt. After two failed attempts combined with power resets, the disks become permanently locked, even if the correct key is entered later.
A power cycle (full off → on) is the recommended method for retrying after any incorrect key entry. This prevents the system from counting the failed attempt toward disk lockout.