Managing Encryption Keys

Open your SAP HANA Studio and connect to your database as the SYSTEM user. Open an SQL console and run the following:

SELECT * FROM SYS.M_SECURESTORE;
SELECT * FROM SYS.CREDENTIALS;
SELECT * FROM SYS.P_DPAPI_KEY_ WHERE caller = 'XsEngine';
SELECT * FROM PSE_CERTIFICATES WHERE certificate_usage = 'OWN';

You receive four results pages. The first page will give you the reset count to three encryption logs. If this is your first attempt to reset the encryption keys, the RESET_COUNT column will read 0.

The next three result pages should not contain any entries. If one of these pages has an entry, you may want to contact your HANA administrator before proceeding as you will lose access to the files listed.

Using your preferred web browser, go to the SAP HANA Academy GitHub page and enter the HXE repository. Click the SSFS folder and select changeSSFSMasterKeys.sh. Click Raw.

Press Ctrl + a to select all, and then Ctrl + c to copy the code.

Log into your SAP HANA, express edition installation using a your preferred command prompt. Log in as hxeadm. In the /usr/sap/HXE/home directory, create the changeSSFSMasterKey.sh file.

su -l hxeadm

cd /usr/sap/HXE/home

vi changeSSFSMasterKeys.sh

In the editor, paste the code from the SAP HANA Academy page. Press Esc to exit then :wq to write and quit the editor.

Give changeSSFSMasterKeys.sh execute permissions.

chmod u+x changeSSFSMasterKeys.sh

Execute the changeSSFSMasterKeys.sh script.

./changeSSFSMasterKeys.sh

Follow the on-screen prompts to reset your encryption keys. This process will take some time.

Return to SAP HANA Studio and run this part of the previous SQL command:

SELECT * FROM SYS.M_SECURESTORE;

The RESET_COUNT for the KEY_TYPE DPAPI will increase by 1.