- Key update (rekey) process
During operation of the FICON® encryption functions, communication is established from the host to the storage system at each configured key update (rekey) interval, and then the key information is updated.
The key update (rekey) interval is configured on the host. Change the time interval for the following keys as needed. For more information, see the IBM® documentation:
- Device encryption key
- Device authentication key
The default values are 8 hours for the device encryption key and 7 days (168 hours) for the device authentication key.
If an error occurs during the key update (rekey) process, take actions by referring to Troubleshooting FICON® encryption. Even if an error occurs in the encryption function, the FICON® encryption function continues to operate by using the previous keys.
- Mutual authentication and encryption of data-in-flight re-establishment process between the host and the storage system
The mutual authentication and encryption of data-in-flight are re-established with the following triggers. In such cases, if an error occurs in the encryption function, ports that were in the state of "port authentication is enabled" or "both port authentication and encryption of data-in-flight are enabled" for the Fibre Channel Endpoint Security for Mainframe might transition to a different state, resulting in the encryption function becoming unavailable. Take actions by referring to Troubleshooting FICON® encryption:
- Take the channel path offline temporarily, and then bring it back online.
- When automatic recovery occurs after a temporary path error between the host and the storage system.
- Certificate renewal
Each certificate that is registered on the key management servers and the storage system has a defined validity period.
Obtain and configure new certificates before the expiration date is reached during operation.
- For more information about obtaining and configuring the certificates required for the key management servers, see the IBM® documentation.
- For more information about obtaining and configuring the certificates required for the storage system, see Obtaining a client certificate and Establishing connections between the storage system and key management servers.
- If the client certificate configured on the storage system is updated, additional work on the key management servers might be required. For details, see the IBM® documentation.