Backing up data with password-based encryption

You must specify an encryption password to back up IBM Security Key Lifecycle Manager data. Use the same password to decrypt and restore the backup files.

1. Go to the appropriate page or directory.

   Graphical user interface

   1. Log on to the graphical user interface.
   2. On the Welcome page, click Administration > Backup and Restore.

   Command-line interface

   1. Go to the WAS_HOME/bin directory. For example,

      Windows

      cd drive:\Program Files\IBM\WebSphere\AppServer\bin

      Linux

      cd /opt/IBM/WebSphere/AppServer/bin

   2. Start the wsadmin interface by using an authorized user ID, such as SKLMAdmin. For example,

      Windows

      wsadmin.bat -username SKLMAdmin -password mypwd -lang jython

      Linux

      ./wsadmin.sh -username SKLMAdmin -password mypwd -lang jython

   REST interface

   Open a REST client.

2. Create a backup file.
   You can run only one backup or restore task at a time.

   Graphical user interface

   1. On the Backup and Restore table, the Backup repository location field displays the default <SKLM_DATA> directory path, where the backup file is saved, for example, C:\Program Files\IBM\WebSphere\AppServer\products\sklm\data. For the definition of <SKLM_DATA>, see Definitions for HOME and other directory variables. Click Browse to specify a backup repository location under <SKLM_DATA> directory.

      Directory path in the Backup repository location field changes based on the value that you set for the tklm.backup.dir property in the SKLMConfig.properties file.

   2. Click Create Backup.
   3. On the Create Backup page, specify information such as a value for the encryption password and backup description. A read-only backup file location is displayed in the Backup location field. Ensure that you retain the encryption password for future use in case you restore the backup.
   4. Click Create Backup.

   Command-line interface

   Type tklmBackupRun, the backup location, encryption password, and any other necessary information to create a backup file. For example:

   print AdminTask.tklmBackupRun ('[-password myBackupPwd]')

   REST interface

   1. Obtain a unique user authentication identifier to access IBM Security Key Lifecycle Manager REST services. For more information about the authentication process, see Authentication process for REST services.
   2. To run Backup Run REST Service, send the HTTP POST request. Pass the user authentication identifier that you obtained in Step a along with the request message as shown in the following example.

      POST https://localhost:<port>/SKLM/rest/v1/ckms/backups
      Content-Type: application/json
      Accept : application/json
      Authorization: SKLMAuth authId=139aeh34567m
      Accept-Language : en
      {"backupDirectory":"/sklmbackup1","password":"myBackupPwd"}

3. A message indicates that the backup file was created, or that the backup operation succeeded.

   The time stamp on a backup file has a Greenwich Mean Time (GMT) offset represented in RFC 822 format. The file name contains a +hhmm or -hhmm element to specify a timezone ahead of or behind GMT. For example, a file name might be sklm_v3.0.1.0_20170123144220-0800_backup.jar, where -0800 indicates that the timezone is eight hours behind GMT.