DB2 Native Encryption - restarting the DB2 instance

Question

We are investigating using native encryption with our DB2 v11.1 instance. I have read the documentation available but have been advised by a team member that once native encryption is enabled on a database, when the database instance is restarted the DBAs would need to re-enter the password for the encryption key before any application could access the database. We are not planning to stash the password.

Can anyone advise if this is the case? The reference I have found is here on this IBM KB article and says:

However, this additional security must be weighed against any requirements that the DB2 instance can start without human intervention . If the password is not stashed, you cannot access an encrypted database until you provide the keystore password.

Does that include a web application that connects to the DB2 instance to access the encrypted database? Or is this just for DBAs connecting to maintain/run queries?

Thanks in advance!

Answer 1

Without stashing you can use

db2start open keystore using <Keystore-Passwort>

or

db2start open keystore passarg filename:<file>