- 30 Jun 2022
- 1 Minute to read
Storing Encryption Keys
- Updated on 30 Jun 2022
- 1 Minute to read
Encryption keys encrypt sensitive database information such as connection strings for integrations, passwords including AD connection info settings, and any custom, encrypted data structures.
Users may restore old encryption keys to allow new installations access to their respective database's secured data. This is recommended when upgrading or installing a new server in a cluster.
Encryption keys support the following encryption methods:
Encryption Keys are intentionally stored on the Application Server outside the database so the secured data is not stored next to its key. Keys are stored as Keys.dat in the following locations depending on the version:
- v.8Keys.dat resides in C:\Program Files\Decisions\FileStorage\Settings.
- v.6-v.7Keys.dat resides in C:\Program Files\Decisions\Decisions Services Manager.
- v.6 Keys.dat resides in C:\Program Files\Decisions\Decisions Server\Instances\Control.
Installing With/Without Encryption Keys
New Installation or Upgrade With No Keys Found
When installing to a machine with no previous installation passwords or data or to a server with no found encryption keys, the installer prompts the Encryption Keys screen. The user may enter a previous encryption key file and then select Restore Key File to locate its respective Kay.dat file and apply it to the installation.
If no keys are found, then the database contains no encrypted data. The Keys.dat file only generates once an encryption event occurs.
Upon generating a new encryption key, the Keys.dat file can be found via the installbackup folder found via C:\Program Files\Decisions\installbackup once installed.
The screenshot below represents a new installation's Encryption Keys screen.
The screenshot depicts the Encryption Keys window during installation with a pre-existing server without Encryption Keys.
Upgrade Installation With Keys
If configured and saved keys are found during installation, then the installer can restore or reuse them with no additional action needed.
A different key file would only need to be used if the found key file is incorrect and thus needs to be replaced.
Saving Encryption Keys After Uninstalling
Key files are automatically placed in the installbackup folder after uninstalling. When reinstalling, the installer will search this directory to recover any key files if there remains no existing keys.