# Adding KMIP Global Key Providers for Standby KMIP Keystores **URL:** \ **Category:** PG\_TDE – Transparent Data Encryption (TDE)\ **Created:** [July 2, 2026, 7:59am UTC](https://forums.percona.com/t/adding-kmip-global-key-providers-for-standby-kmip-keystores/41020 "2026-07-02T07:59:52Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![NatashaLR](https://avatars.discourse-cdn.com/v4/letter/n/ecd19e/32.png) [@NatashaLR](https://forums.percona.com/u/NatashaLR)\ **Post date:** [July 2, 2026, 7:59am UTC](https://forums.percona.com/t/adding-kmip-global-key-providers-for-standby-kmip-keystores/41020/1 "2026-07-02T07:59:52Z")
Hi All. Two questions regarding Percona Postgresql V18 pg\_tde:- 1. Can you add more X1 KMIP key provider IP for KMIP redundancy/ standby server tests ? Primary KMIP Keystore IP SELECT pg\_tde\_add\_global\_key\_provider\_kmip( ‘kmip’,‘127.0.0.1’, 5696, ‘/tmp/server\_certificate.pem’, ‘/tmp/client\_cert\_jane\_doe.pem’, ‘/tmp/client\_key\_jane\_doe.pem’ ); Standby KMIP Keystore IP SELECT pg\_tde\_add\_global\_key\_provider\_kmip( ‘kmip’,‘127.0.0.1’, 5696, ‘/tmp/server\_certificate.pem’, ‘/tmp/client\_cert\_jane\_doe.pem’, ‘/tmp/client\_key\_jane\_doe.pem’ ); I am currently testing this and will test failover if one KMIP keystore is not available? Has anyone implemented a similar solution before. 1. On Certificate renewal, How do you rotate new Certs and keys ? Kind Regards Natasha ---
**Author:** ![NatashaLR](https://avatars.discourse-cdn.com/v4/letter/n/ecd19e/32.png) [@NatashaLR](https://forums.percona.com/u/NatashaLR)\ **Post date:** [July 6, 2026, 2:45pm UTC](https://forums.percona.com/t/adding-kmip-global-key-providers-for-standby-kmip-keystores/41020/2 "2026-07-06T14:45:41Z")
Hi Everyone. I could add more than one provider. Now using the function (when online) or utility pg\_tde\_change\_key\_provider (when offline) to Change the IP’s for Key providers to test redundancy on KMIP keystores. error: could not open tde file “/db pool/0\_providers”: No such file or directory The file under pg\_tde directory is called 5\_providers (same file name for V17 and V18). Where can I fix this in order to run the command Offline as per Method 2 of Changing Key Providers? I appreciate your feedback. Tx. ---
**Author:** ![zsolt.parragi](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/zsolt.parragi/32/16648_2.png) [@zsolt.parragi](https://forums.percona.com/u/zsolt.parragi)\ **Post date:** [July 7, 2026, 10:21am UTC](https://forums.percona.com/t/adding-kmip-global-key-providers-for-standby-kmip-keystores/41020/3 "2026-07-07T10:21:55Z")
Hello! > Can you add more X1 KMIP key provider IP for KMIP redundancy/ standby server tests ? Unfortunately that’s currently not supported. > On Certificate renewal, How do you rotate new Certs and keys ? If you mean the kmip certificates, since those are files on the disk, you can simply overwrite them on disk. > Where can I fix this in order to run the command Offline as per Method 2 of Changing Key Providers? Can you show me the exact commands you are executing for this test scenario? ---
**Author:** ![NatashaLR](https://avatars.discourse-cdn.com/v4/letter/n/ecd19e/32.png) [@NatashaLR](https://forums.percona.com/u/NatashaLR)\ **Post date:** [July 7, 2026, 1:04pm UTC](https://forums.percona.com/t/adding-kmip-global-key-providers-for-standby-kmip-keystores/41020/4 "2026-07-07T13:04:09Z")
Hellos! Thank you for the response. I could add X2 kmip key providers but not 3. The function allows more than X1 kmip provider however the encryption key links to one kmip provider. pg\_tde\_add\_database\_key\_provider\_kmip The change-provider function allows me to change the IP of the current provider to a new one. pg\_tde\_change\_database\_key\_provider\_kmip > **[Percona Transparent Data Encryption for PostgreSQL - pg\_tde\_change\_key\_provider](https://docs.percona.com/pg-tde/command-line-tools/pg-tde-change-key-provider.html)** > > A tool for modifying the configuration of a key provider, possibly also changing its type. Method 1 Online Command ( Function) Method 2 Command to run it as offline utility is below. pg\_tde\_change\_key\_provider -D /var/lib/postgresql/18/main 0 “current\_provider\_name” kmip “[kmip-server.example.com](http://kmip-server.example.com)” 5696 “/etc/ssl/certs/client.pem” “/etc/ssl/private/client.key” “/etc/ssl/certs/ca\_root.pem” Gettting error pg\_tde\_change\_key\_provider: error: could not open tde file “/var/lib/postgresql/18/main/pg\_tde/0\_providers”: No such file or directory The file is named 5\_providers in Postgres V17 and V18. ---
**Author:** ![Jan\_Wieremjewicz](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/jan_wieremjewicz/32/7324_2.png) [@Jan\_Wieremjewicz](https://forums.percona.com/u/Jan_Wieremjewicz)\ **Post date:** [July 8, 2026, 2:50pm UTC](https://forums.percona.com/t/adding-kmip-global-key-providers-for-standby-kmip-keystores/41020/5 "2026-07-08T14:50:20Z")
Hi Natasha! Thanks for reaching out! As Zsolt mentioned this is currently not supported. Though something we’ve already been investigating was the possibility of providing fallback KMSs for handling KMS unavailability and your request could fall into the rework planned due to that. Please share if you would be open to join a call to have some more discussion regarding your needs for such capability as we would like to make sure we understand them well. The more requirements we get the better the first version can be 🙂 ---
**Author:** ![NatashaLR](https://avatars.discourse-cdn.com/v4/letter/n/ecd19e/32.png) [@NatashaLR](https://forums.percona.com/u/NatashaLR)\ **Post date:** [July 9, 2026, 11:20am UTC](https://forums.percona.com/t/adding-kmip-global-key-providers-for-standby-kmip-keystores/41020/6 "2026-07-09T11:20:08Z")
Good day Jan. I’ll be happy to join a call. Let me know when. Kind Regards Natasha