PKA master keys and the PKDS

The step-by-step procedure for changing the PKA master keys is documented in this topic. The procedure assumes that SMK=KMMK. It is recommended that the KMMK=SMK to maximize the routing capability to the PCICC and to enable PKDS reencipher. Once that is completed, it is necessary to reencipher and activate the PKDS.

Attention: If you do not have a PCICC, you should not change the PKA Master Keys. Changing the PKA master keys will make all internal tokens in the current PKDS unusable. You will need to reencipher and activate the PKDS in order to use them with the changed master key. This requires a PCICC on your system. See Steps for reenciphering and refreshing the PKDS for more information.

When the PKDS is shared by multiple images in a sysplex environment, the PKA master key must also be changed on all the sharing systems. See Running in a Sysplex Environment.