# Error using KMIP key provider

**URL:** <https://forums.percona.com/t/error-using-kmip-key-provider/37336>\
**Category:** PG\_TDE – Transparent Data Encryption (TDE)\
**Created:** [March 24, 2025, 3:48pm UTC](https://forums.percona.com/t/error-using-kmip-key-provider/37336 "2025-03-24T15:48:54Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![fborden](https://avatars.discourse-cdn.com/v4/letter/f/fbc32d/32.png) [@fborden](https://forums.percona.com/u/fborden)\
**Post date:** [March 24, 2025, 3:48pm UTC](https://forums.percona.com/t/error-using-kmip-key-provider/37336/1 "2025-03-24T15:48:54Z")

</div>

Hello all,

I am trying to setup PG\_TDE with KMIP. For this I ran this query:

SELECT pg\_tde\_add\_key\_provider\_kmip(‘kmip’, ‘10.0.0.59’, 5696, ‘/home/postgres/okvssl/CA.pem’, ‘/home/postgres/okvssl/priv.pem’);

This returns one row and also I see that in  
$ strings pg\_tde\_16481\_keyring  
kmip  
{“type” : “kmip”, “host” : “10.0.0.59”, “port” : 5696, “caPath” : “/home/postgres/okvssl/CA.pem”, “certPath” : “/home/postgres/okvssl/priv.pem”}

Next when I try to set the key I get an error:

dvdrental=# SELECT pg\_tde\_set\_principal\_key(‘postgresKey’,‘kmip’);  
ERROR: KMIP server reported error on register symmetric key: -1

How can I debug what caused this error -1

---

<div class="post-metadata">

**Author:** ![Shahid\_Ullah](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/shahid_ullah/32/18935_2.png) [@Shahid\_Ullah](https://forums.percona.com/u/Shahid_Ullah)\
**Post date:** [March 25, 2025, 5:54pm UTC](https://forums.percona.com/t/error-using-kmip-key-provider/37336/2 "2025-03-25T17:54:23Z")

</div>

Hello!  
Currently pg\_tde have following limitation that it accepts combine client key & client certificate. See the following note.

```auto
pg_tde_add_key_provider_kmip currently accepts only a combined client key + client certificate for the last parameter of this function named as `client key`

```

- KMIP server and client machine should have same set of certificates
- Also make sure that certificates are not expired and having proper permissions.