Re-encrypting sensitive information with configuration encryption keys
You can use the configkeymgr command-line utility to re-encrypt sensitive configuration information and OAuth client secrets.
About this task
You should re-encrypt sensitive information after you rotate the configuration encryption keys.
To re-encrypt sensitive configuration information:
Steps
-
Stop the PingFederate console node.
-
Run the configkeymgr utility on the console node:
-
If PingFederate is running on Windows, open a command prompt, go to
<pf_install>/pingfederate/bin
, and runconfigkeymgr.bat
. -
If PingFederate is running on Linux, open a terminal window, go to
<pf_install>/pingfederate/bin
, and runconfigkeymgr.sh
.Result:
The utility displays its usage help.
-
-
Run the
reencrypt
command.The utility offers optional arguments for the
reencrypt
command.Example:
For example, to perform a dry run of the
reencrypt
command in a Linux environment, enter the following command../configkeymgr.sh --reencrypt --dry-run
-
Restart the PingFederate console node.
-
If PingFederate is running in a cluster:
-
Replicate the configuration to the engine nodes.
-
Run the configkeymgr utility on the engine nodes to re-encrypt data that is not included in the replication archive, such as sensitive data defined in the
run.properties
file.You can run the utility on engine nodes without stopping them.
-