directory can contain a single-line text file named password.txt  containing the password needed to decrypt the key file. 

Both the okvclient.ora  file and ssl  directory with the certificate and key files are required for keyring_okv  to work properly. The procedure used to populate the configuration directory with these files depends on the KMIP back end used with keyring_okv , as described elsewhere. 

The configuration directory used by keyring_okv  as the location for its support files should have a restrictive mode and be accessible only to the account used to run the MySQL server. For example, on Unix and Unix-like systems, to use the /usr/local/mysql/mysql-keyring-okv  directory, the following commands (executed as root ) create the directory and set its mode and ownership: 

cd /usr/local/mysql mkdir mysql-keyring-okv chmod 750 mysql-keyring-okv chown mysql mysql-keyring-okv chgrp mysql mysql-keyring-okv 

To be usable during the server startup process, keyring_okv  must be loaded using the --early- plugin-load  option. Also, set the keyring_okv_conf_dir  system variable to tell keyring_okv where to find its configuration directory. For example, use these lines in the server my.cnf  file, adjusting the .so  suffix and directory location for your platform as necessary: 

[mysqld] early-plugin-load=keyring_okv.so keyring_okv_conf_dir=/usr/local/mysql/mysql-keyring-okv 

For additional information about keyring_okv_conf_dir , see Section 6.4.4.18, “Keyring System Variables” . 

## Configuring keyring_okv for Oracle Key Vault 

The discussion here assumes that you are familiar with Oracle Key Vault. Some pertinent information sources: 

•Oracle Key Vault site 

•Oracle Key Vault documentation 

In Oracle Key Vault terminology, clients that use Oracle Key Vault to store and retrieve security objects are called endpoints. To communicate with Oracle Key Vault, it is necessary to register as an endpoint and enroll by downloading and installing endpoint support files. 

The following procedure briefly summarizes the process of setting up keyring_okv  for use with Oracle Key Vault: 

1. Create the configuration directory for the keyring_okv  plugin to use. 

2. Register an endpoint with Oracle Key Vault to obtain an enrollment token. 

3. Use the enrollment token to obtain the okvclient.jar  client software download. 

4. Install the client software to populate the keyring_okv  configuration directory that contains the Oracle Key Vault support files. 

Use the following procedure to configure keyring_okv  and Oracle Key Vault to work together. This description only summarizes how to interact with Oracle Key Vault. For details, visit the Oracle Key Vault site and consult the Oracle Key Vault Administrator’s Guide. 

