Migrating an existing CyberArk Vault server key to a ProtectServer 3 HSM

This section describes how to migrate an existing CyberArk Vault top-level encryption key (server key) to a ProtectServer 3 HSM. Before beginning the integration, make sure that the Vault has been configured and the Vault Server has been shut down. For more information about configuring the Vault, refer to step 6 of To set up your environment for the integration.

To migrate an existing CyberArk Vault server key to the ProtectServer 3 HSM

1. Run the following command to load the server key onto the ProtectServer 3 HSM:

   CAVaultManager.exe LoadServerKeyToHSM /WrapKey

   CyberArk Vault Manager generates a new key pair. The public key is used to encrypt the server key and the private key decrypts the server key on the HSM device. The private key is deleted from HSM when the server key is unwrapped.

2. Verify that the server key was migrated to the HSM slot by running the following command:

   ctkmu l -s<slot> [-v] [-n<name>]

3. Open dbparam.ini and set the value of the ServerKey parameter to HSM.

4. Start the PrivateArk Server and log on.

This completes the integration of CyberArk Vault with a ProtectServer 3 HSM.