content_image/981478.jpg
12.Confirm that encryption is enabled by clicking Settings → Security → Encryption , as shown in Figure 13-40. The “Online” state indicates which SKLM servers are detected as available by the system. 

<img src='content_image/981478.jpg'>

## Enabling encryption using SafeNet KeySecure 

IBM Spectrum Virtualize V8.2.1 introduces support for Gemalto SafeNet KeySecure, which is a third-party key management server. It can be used as an alternative to IBM Security Key Lifecycle Manager (SKLM). 

IBM Spectrum Virtualize supports Gelmato SafeNet KeySecure version 8.3.0 and later, and only using KMIP protocol. It is possible to configure up to four SafeNet KeySecure servers in IBM Spectrum Virtualize for redundancy, and they can coexist with USB flash drive encryption. 

It is not possible to have both SafeNet KeySecure and SKLM key servers configured at the same time in IBM Spectrum Virtualize. It is also not possible to migrate directly from one type of key server to another (from SKLM to SafeNet KeySecure or vice versa). If you want to migrate from one type to another, first migrate to USB flash drives encryption, and then, migrate to the other type of key servers. 

KeySecure uses an active-active clustered model. All changes to one key server are instantly propagated to all other servers in the cluster. 

Although KeySecure uses KMIP protocol as IBM SKLM does, an option is available to configure user name and password for IBM Spectrum Virtualize and KeySecure server authentication, which is not possible when performing the configuration with SKLM. 

The certificate for client authentication in SafeNet KeySecure can be self-signed or signed by a Certificate Authority. 

