Error using KMIP key provider

PostgreSQL PG_TDE – Transparent Data Encryption (TDE)
1

Hello all,

I am trying to setup PG_TDE with KMIP. For this I ran this query:

SELECT pg_tde_add_key_provider_kmip(‘kmip’, ‘10.0.0.59’, 5696, ‘/home/postgres/okvssl/CA.pem’, ‘/home/postgres/okvssl/priv.pem’);

This returns one row and also I see that in
$ strings pg_tde_16481_keyring
kmip
{“type” : “kmip”, “host” : “10.0.0.59”, “port” : 5696, “caPath” : “/home/postgres/okvssl/CA.pem”, “certPath” : “/home/postgres/okvssl/priv.pem”}

Next when I try to set the key I get an error:

dvdrental=# SELECT pg_tde_set_principal_key(‘postgresKey’,‘kmip’);
ERROR: KMIP server reported error on register symmetric key: -1

How can I debug what caused this error -1

1 Like
2

Hello!
Currently pg_tde have following limitation that it accepts combine client key & client certificate. See the following note.

pg_tde_add_key_provider_kmip currently accepts only a combined client key + client certificate for the last parameter of this function named as `client key`
  • KMIP server and client machine should have same set of certificates
  • Also make sure that certificates are not expired and having proper permissions.
1 Like