Creating an empty KMS database
An empty KMS database can be created by executing the command nbkms -createemptydb.
This command prompts you for the following information:
HMK pass phrase (leave empty for a random HMK)
HMK ID
KPK pass phrase (leave empty for a random KPK)
KPK ID
The KMS database backup and disaster recovery procedures vary for random and pass phrase-generated KPK and HMK as described below.
To recover when the HMK and KPK were generated randomly
- Restore the keystore file from a backup.
- Execute the command nbkms -info to find out the KPK ID and HMK ID of the KPK and HMK needed to decrypt this keystore file. The output should also inform you that the HMK and KPK for this keystore file were generated randomly.
- Restore the HMK file corresponding to the HMK ID from a secure backup.
- Restore the KPK file corresponding to the KPK ID from a secure backup.