12.8.6 Restrictions 12.9 Rekeying an encryption-enabled system 12.9.1 Rekeying using a key server Ensure that all the configured key servers can be reached by the system and that service IPs  are configured on all your nodes. To rekey the master access key kept on the key server provider, complete the following steps: No method is available to directly change data encryption keys. If you must change the data  encryption key that is used to encrypt data, the only available method is to migrate that data  to a new encrypted object (for example, an encrypted child pool). Because the data  encryption keys are defined per encrypted object, such migration forces a change of the key  that is used to encrypt that data. Important:  Before you create a master access key, ensure that all nodes are online and  that the current master access key is accessible. If you have both USB and key server enabled, rekeying is done separately for each of the  providers. Changing the master access key is a security requirement.  Rekeying  is the process of  replacing current master access key with a newly generated one. The rekey operation works  whether encrypted objects exist. The rekeying operation requires access to a valid copy of the  original master access key on an encryption key provider that you plan to rekey. Use the rekey  operation according to the schedule defined in your organization’s security policy and  whenever you suspect that the key might have been compromised. The following restrictions apply to encryption: GLYPH<SM590000> You cannot add external non self-encrypting MDisks to encrypted pools unless all control  enclosures in the system support encryption. GLYPH<SM590000> Image mode volumes cannot be in encrypted pools. 1. Click  Settings Security Encryption . Ensure that Encryption Keys shows that all  configured SKLM servers are reported as  Accessible , as shown in Figure 12-82 on  page 666. Click  Key Servers  to expand the section. Chapter 12. Encryption  665