The MySQL Keyring jar xf okvclient.jar ssl tar zxvf csr_w_pk_pkcs8.gz SERVER=198.51.100.20:9002 STANDBY_SERVER=198.51.100.20:9002 SERVER= host_ip : port_num STANDBY_SERVER= host_ip : port_num 11. Copy the Oracle Key Vault support files (the  okvclient.ora  file and the  ssl  directory) into the configuration directory. 12. (Optional) If you wish to password-protect the key file, use the instructions in Password-Protecting the keyring_okv Key File. 1. Create the configuration directory that contains the KeySecure support files, and make sure that the keyring_okv_conf_dir  system variable is set to name that directory (for details, see General keyring_okv Configuration). 2. In the configuration directory, create a subdirectory named  ssl  to use for storing the required SSL certificate and key files. 3. In the configuration directory, create a file named  okvclient.ora . It should have following format: 4. Connect to the KeySecure Management Console as an administrator with credentials for Certificate Authorities access. 5. Navigate to Security >> Local CAs and create a local certificate authority (CA). 6. Go to Trusted CA Lists. Select Default and click on Properties. Then select Edit for Trusted Certificate Authority List and add the CA just created. 7. Download the CA and save it in the  ssl  directory as a file named  CA.pem . 8. Navigate to Security >> Certificate Requests and create a certificate. Then you can download a compressed  tar  file containing certificate PEM files. 9. Extract the PEM files from in the downloaded file. For example, if the file name is csr_w_pk_pkcs8.gz , decompress and unpack it using this command: 1414 Two files result from the extraction operation:  certificate_request.pem  and private_key_pkcs8.pem . For example, if KeySecure is running on host 198.51.100.20 and listening on port 9002, the okvclient.ora  file looks like this: After completing the preceding procedure, restart the MySQL server. It loads the  keyring_okv  plugin and keyring_okv  uses the files in its configuration directory to communicate with Oracle Key Vault. Gemalto SafeNet KeySecure Appliance uses the KMIP protocol (version 1.1 or 1.2). The  keyring_okv keyring plugin (which supports KMIP 1.1) can use KeySecure as its KMIP back end for keyring storage. Use the following procedure to configure  keyring_okv  and KeySecure to work together. The description only summarizes how to interact with KeySecure. For details, consult the section named Add a KMIP Server in the KeySecure User Guide. Configuring keyring_okv for Gemalto SafeNet KeySecure Appliance