The following steps will take you through the process of migrating keys from one appliance to another.

1. To start this tool on skles01 appliance, log into the appliance as the 'strongauth' user and start the X Windows environment by typing in 'startx' from the command-prompt
2. Execute the '/usr/local/strongauth/bin/KMTool.sh' shell script from a terminal window. This will display the following window:
   
   
   
   
3. Configure the KMTool with the URL of the source appliance by selecting 'Preferences' from the 'File' menu. The following screen is displayed. Additionally, the TPM, cryptographic module must be selected. You may, optionally, configure the KC role and the location of their keystore, but since KCs will not normally use this tool, this is not necessary.
   
   
   The table below provides an explanation for the different fields:
   

   Parameter	Explanation
   Key Custodian Role	Select the appropriate key custodian to be validated.
   Keystore Location	Select the location of the key for the user selected. It should either be in a flash drive or in the keystore folder on the appliance.
   SKLES URLs	Enter the URLs of all the appliances in the cluster. The format is: https://<domain name>:8181

4. Each of the three Key Custodians and the Domain Administrator must now authenticate themselves to the appliance in the “Validate Credentials” panel of the KMTool.
5. Select the appropriate Custodian role from the pull-down option.
6. The KC inserts their USB token into the appliance.
7. Using the Browse button, select the appropriate KC's credential file – it will have a file-name that matches their role.
8. The KC types in their secret password to the credential file in the Password field.
9. Click the “Verify” button to ensure that the password unlocks the credential file correctly. If the password is correct a message will appear on the bottom of the tool as shown below:
   
   
   
   
10. If the password verification is successful, select the Validate button to send the credential to the appliance for validation. If the process works correctly, a “success” message will appear on the bottom of the screen as shown below:
    
    
    
    
11. Have all three Key Custodians authenticate themselves to the appliance in this manner.
12. Next, the Domain Administrator authenticates him/herself, but additionally, supplies the Domain ID in the panel. This field is activated only for the Domain Administrator. Once all four roles have successfully authenticated themselves, the remaining panels become available.
    
13. 13. Generate the migration key object in the second panel titled “Migrate a key from this appliance” . The following figure shows this panel and Table 2 explains the parameters:
    
    
    

    Parameter	Explanation
    Test Token	A unique Pseudo-Number (Token) that was created on the Primary appliance, and which will be used for a decryption test on the new appliance. The standard “ well known token” is 9999000000000001 that was created during the installation wizard and which returns the standard “ well known plaintext” (1235711131719230).
    Mask Location	Location of the MASK file of theskles03 appliance. In a production environment, this file is on the black-colored flash drive.

14. After selecting the file, click on “ Migrate” button; this generates the migration key file (on the same black-colored USB drive as the target-machine's MASK file) with a file-name that has the following format:
    <source-appliance-FQDN>-<sarget-appliance-FQDN>-<domain Id>.migkey.xml
    
    where FQDN is the fully-qualified domain name of the appliance. In this example, the file-name is:
    skles01.strongauth.com-skles03.strongauth.com-1.migkey.xml
15. Now, the process switches over to the target appliance – skles03.
16. 16. After starting KMTool on the target appliance, all Key Custodians and the Domain Administrator must authenticate themselves to the appliance with their USB flash-drives.
17. Once successfully validated the the Domain Administrator imports the migration key file from the black-colored USB drive to this target machine using the third panel titled “Import a migrating key to this appliance”. The figure below shows this panel and Table 3 explains the parameters.
    
    
    

    Parameter	Explanation
    Key File	The file-name of the migrating key that was generated on the source appliance (step 14)
    Domain Id	The encryption domain identifier for which the key has to be migrated
    Key UUID	The UUID created while generating the key; this is automatically filled out by the tool and helps verify the unique ID of the migrating EDK

18. Click on “Import” button to import this key onto the target appliance. If the process works correctly, you will see a message indicating success.
19. This concluded the key-migration process and you can exit KMTool. The new target appliance is now capable of decrypting objects encrypted by other appliances within the trusted-cluster.