Migrate Existing Server Key to HSM

To migrate the existing server key to Utimaco HSM:

1. Complete the steps given in 5.1 Configure CyberArk Vault to use Utimaco HSM.

2. Stop the PrivateArk Server service.

Stop services of PrivateArk Server

3. Navigate to the C:\Program Files (x86)\PrivateArk\Server folder, then open cmd as administrator.

4. Using CAVaultManager, run the LoadServerKeyToHSM command to upload the server key to store in the Utimaco HSM.

›_ Console

CAVaultManager.exe LoadServerKeyToHSM /WrapKey

Migrate Server Key to HSM

Ensure that the result confirms that the server key has been uploaded to the HSM:

1. Verify that the keys have been uploaded to Utimaco HSM using p11tool2.

›_ Console

p11tool2 slot=0 LoginUser=ask ListObjects

Key list

2. Open the DBParm.ini file located at C:\Program Files (x86)\PrivateArk\Server\Conf.

3. Set the ServerKey=HSM parameter.

4. Save the file.

5. Start the PrivateArk Server service and verify that there are no errors in the console.

6. Verify that you can log on to the Vault using CyberArk authentication.

Logon to Vault using CyberArk authentication