Skip to main content
NetApp Knowledge Base

Error: command failed: The key server at "x.x.x.x" contains volume encryption keys that are currently in use and not available

  1. Last updated
  2. Save as PDF
Views:
523
Visibility:
Public
Votes:
0
Category:
ontap-9
Specialty:
core
Last Updated:

Applies to

  • ONTAP 9
  • External Key Manager (EKM)
  • NetApp Volume Encryption (NVE)

Issue

  • While attempting to migrate external key manager servers to new servers you cannot delete the last key server.
Cluster-01::*> security key-manager external remove-servers -vserver cluster-1 -key-servers 10.28.XX.XX
 
Error: command failed: The key server at "10.28.XX.XX" contains volume encryption keys that are currently in use
and not available from any other configured key server.
  • The certificates and keys have been copied to the new KMIP servers, but the cluster does not pull the keys from those servers. 
  • In the following example 10.28.XX.XX is the last of the old key servers. The new key servers show as available but are not present in the key query:
Cluster-01::> security key-manager key query
Node: Cluster-01-01
Vserver: Cluster-01
Key Manager: 10.28.XX.XX:5696
Key Manager Type: KMIP
 
Key Tag Key Type Restored
------------------------------------ -------- --------
2170bf6c-998b-11eb-b2a8-d039ea061535 VEK true
Key ID: 00000000000000000200000000000500d3a552b209a7265eb531e4cf5adb21c50000000000000000
38bc9422-998b-11eb-b2a8-d039ea061535 VEK true
Key ID: 00000000000000000200000000000500e32ca6a0c308f850c51120b47334869f0000000000000000
27696c31-998b-11eb-b2a8-d039ea061535 VEK true
Key ID: 00000000000000000200000000000500fefbd8470e63a8877d53509b9cd708e40000000000000000
 
Node: Cluster-01-02
Vserver: Cluster-01
Key Manager: 10.28.XX.XX:5696
Key Manager Type: KMIP
 
Key Tag Key Type Restored
------------------------------------ -------- --------
2170bf6c-998b-11eb-b2a8-d039ea061535 VEK true
Key ID: 00000000000000000200000000000500d3a552b209a7265eb531e4cf5adb21c50000000000000000
38bc9422-998b-11eb-b2a8-d039ea061535 VEK true
Key ID: 00000000000000000200000000000500e32ca6a0c308f850c51120b47334869f0000000000000000
27696c31-998b-11eb-b2a8-d039ea061535 VEK true
Key ID: 00000000000000000200000000000500fefbd8470e63a8877d53509b9cd708e40000000000000000
6 entries were displayed.
  • Key servers are available:
Cluster-01::*> key-manager show -status
security key-manager show)
 
Node Port Registered Key Manager Status
---------------------- ------ --------------------------- ---------------
Cluster-01-01 5696 10.28.XX.XX available                    
Cluster-01-01 5696 10.36.XX.XX available
Cluster-01-02 5696 10.28.XX.XX available
Cluster-01-02 5696 10.36.XX.XX available

 

Sign in to view the entire content of this KB article.

New to NetApp?

Learn more about our award-winning Support

NetApp provides no representations or warranties regarding the accuracy or reliability or serviceability of any information or recommendations provided in this publication or with respect to any results that may be obtained by the use of the information or observance of any recommendations provided herein. The information in this document is distributed AS IS and the use of this information or the implementation of any recommendations or techniques herein is a customer's responsibility and depends on the customer's ability to evaluate and integrate them into the customer's operational environment. This document and the information contained herein may be used solely in connection with the NetApp products discussed in this document.