Encryption and Application Failover

To make encryption configuration changes for application failover (for example, changing an encryption algorithm or key length) do the following:

1. Stop NNMi and nnmcluster processes by running the ovstop command on both nodes. Note that when you use the ovstop command on an NNMi management server configured for application failover, NNMi automatically runs the following command:

   nnmcluster -disable -shutdown

2. Edit the nnmcluster-crypto-config.xml file as desired.

   Note Application failover uses only symmetric encryption, so adding asymmetric or digest does not have any effect, and removing symmetric causes a failure.

3. Save your changes to the nnmcluster-crypto-config.xml file.

4. Remove the old key file.

   Tip The file location is defined in the nnmcluster-crypto-config.xml file.

5. Generate a new key file by running the following command:

   nnmcluster -genkey

6. Copy the edited nnmcluster-crypto-config.xml file and the new key file to the other node in the cluster (in the same folders).

   Now the nnmcluster-crypto-config.xml file, which defines the encryption algorithms and keys, is the same on both nodes. Also, the key itself is the same on both nodes.

7. Start the cluster again by running nnmcluster on the active and standby nodes:

   Run nnmcluster -daemon on the active node

   Note Wait until the node becomes active

   Run nnmcluster -daemon on the standby node

Warning: Generating a new encryption key will require the NNMi Cluster to be shutdown.

Do you wish to continue (y/n)?

y

Error: The attempt to generate a new encryption key failed.

The most likely cause is that the keysize was increased 
and the current key is invalid.

Please remove the existing key and try again.