In the fourth step of the process, which occurs on the New StrongKey Tellaro node, the process completes the key-migration process for the domain keys migrated in the previous step.

1. Login as 'strongauth' into the StrongKey Tellaro
2. Startup 2 shell windows
3. In Window2, go the /usr/local/strongauth/<payara-version>/glassfish/domains/domain1/logs directory

   shell> aslg

   Or

   shell> cd /usr/local/strongauth/<payara-version>/glassfish/domains/domain1/logs

4. In Window2, run the tail -f command on the server.log file

   shell> tail -f server.log

5. In Window1, change directory to /usr/local/strongauth/bin

   shell> cd ~/bin

6. In Window1, execute the KMTool.sh

   shell> ./KMTool.sh

7. Using KeyCustodian flash-drives, set the PINs for the required minimum number of Key Custodians to authorize access to the TPM.
   
   Select a domain to migrate the key to and use the Domain Administrator's Credentials to authorize the migration of the Encryption Domain Key.
   
   Using the MigKey file generated in Step #3, import the Migration Key Blob.
   
   Repeat these steps for each domain key to be imported.
8. Please generate JWT Signing Keys to add certificates for new DR node:

   shell> /usr/local/software/saka/keygen-jwt.sh <JWT_KEYGEN_DN> <COUNT OF SERVERS> <JWT_CERTS_PER_SERVER> <DID> <JWT_KEYSTORE_PASSWORD> <JWT_KEY_VALIDITY>

9. Import the OpenLDAP users and groups using the backup taken during the Step #1 and copied over in the step N-1-14:

   shell> /usr/local/strongauth/bin/restore-backup.sh <backup-directory> <backup_configFile> <backup_databaseLDIF>

10. In Window 1, restart the Glassfish application server

    shell> sudo service glassfishd restart

11. In Window1, execute the KC-SetPINTool.sh

    shell> ./KC-SetPINTool.sh

12. Using the KeyCustodian flash-drives, set the PINs for the required minimum number of Key Custodians to activate the cryptographic hardware module on the appliance, ensuring there are no errors in Window1 or Window2
13. Now that the Encryption Domain Keys have been imported, the node is ready to accept cryptographic requests. In order for Ping requests to function properly, a first dummy record must be encrypted on this node for each domain.
    
    In Window1, change directory to the /usr/local/strongauth/topaz directory:
    

    shell> cd ~/topaz

14. In Window1, execute the sakaclient.jar client application as follows for every domain-id (DID). This command will encrypt one credit-card number (with a dummy number of 1111222233334444) and then attempt to decrypt the returned value immediately:

    shell> java -jar /usr/local/strongauth/topaz/sakaclient.jar https://<FQDN>:8181 <domain-id> <username> <password> B 33334444 1

    Ensure the token returned is the first token for SID of the new server.
15. In Window1, verify Ping requests work for every domain-id (DID):

    shell> java -cp /usr/local/strongauth/topaz/sakamclient.jar ping https://<FQDN>:8181 <DID> <'pinguser' password>

16. In Window1, verify Authentication requests work for every domain using the user registered in Step #1.

    shell> java -jar /usr/local/strongauth/topaz/skfsclient.jar A <hostport> <did> <wsprotocol> <authtype> [ <accesskey> <secretkey> | <svcusername> <svcpassword> ] <username> <origin> <authcounter> <crossorigin>

17. This concludes the installation and configuration of Data Recovery StrongKey Tellaro node. Now, this new node should be shutdown and stored at a safe location accessible only with certain privileges.