content_image/1011899.jpg
12.Confirm that encryption is enabled in Settings → Security → Encryption , as shown in Figure 12-40. Note the Online  state, which indicates which SKLM servers are detected as available by the system. 

<img src='content_image/1011899.jpg'>

## Enabling encryption by using Gemalto SafeNet KeySecure 

IBM Spectrum Virtualize V8.2.1 introduces support for Gemalto SafeNet KeySecure, which is a third-party key management server. It can be used as an alternative to IBM SKLM. 

IBM Spectrum Virtualize supports Gelmato SafeNet KeySecure V8.3.0 and later that uses only the KMIP protocol. It is possible to configure up to four Gemalto SafeNet KeySecure servers in IBM Spectrum Virtualize for redundancy, and they can coexist with USB flash drive encryption. 

It is not possible to have both Gemalto SafeNet KeySecure and SKLM key servers that are configured concurrently in IBM Spectrum Virtualize, and it is also not possible to migrate directly from one type of key server to another (from SKLM to Gemalto SafeNet KeySecure or vice versa). If you want to migrate from one type to another, first migrate to USB flash drives encryption, and then migrate to the other type of key servers. 

Gemalto SafeNet KeySecure uses an active-active clustered model. All changes to one key server are instantly propagated to all other servers in the cluster. 

Although Gemalto SafeNet KeySecure uses the KMIP protocol just like IBM SKLM does, there is an option to configure the user name and password for IBM Spectrum Virtualize and Gemalto SafeNet KeySecure server authentication, which is not possible when performing the configuration with SKLM. 

The certificate for client authentication in Gemalto SafeNet KeySecure can be self-signed or signed by a certificate authority. 

