Note the following when using transparent data encryption in environments that use streaming replication, or database multiplexing with streaming replication.

Because the master encryption key is encrypted with the HSM master key, you must load the same HSM master key on all servers that will be part of the database multiplexing operation.

For instructions on loading the primary server's HSM master key on the standby server, refer to the IBM documentation.

Place a copy of the primary server keystore file on the standby server.

This is required as the keystore file cannot be shared, and both servers may need to access it simultaneously.

Execute the following operations as the system administrator (root).

1. On source machine

   1. Backup the token directory of the source machine (retain file owners and groups) in the backup

2. On target machine

   1. Update the opencryptoki.conf file

      Add new Slot/tokname to use on the target machine

   2. Restart Slot Manager daemon (pkcsslotd)

      This will create the openCryptoki token folders including a new one for new slot

   3. Copy all the backed-up token directory files into this new token directory (preserving the file owners and groups)

   4. Be sure to remove any shared memory files in /dev/shm which are associated with the new tokname

   5. Restart Slot Manager daemon (pkcsslotd)

   6. New token should be ready to use.

      (The SO PIN and User PIN are same as they were on the source machine)

You must enable automatic opening of the keystore.

To do this, enable automatic opening of the keystore in all servers that make up database multiplexing.

Before using the pg_basebackup command or pgx_rcvall command to build a standby server, copy the keystore file and the entire opencryptoki token directory of the slot assigned to Fujitsu Enterprise Postgres from the primary server to the standby server.

Open the keystore each time you start the standby server. This step is necessary for decrypting and restoring encrypted WAL received from the primary server. To open the keystore, specify the --user-pin option in the pg_ctl command or pgx_rcvall command and enter the user pin, or use an automatically opening keystore.

Change the master encryption key on the primary server. You need not copy the keystore from the primary server to the standby server. You need not even restart the standby server or reopen the keystore. Changes to the master encryption key are reflected in the keystore on the standby server.