[389-users] How to disable attribute encryption

Hello,

is it possible to disable attribute encryption in 389 DS? I'm running
1.4.0.21 @ Debian Buster.

After replacing TLS certificate I'm receiving errors:

> [18/Aug/2020:10:25:16.099482453 +0200] - ERR - attrcrypt_unwrap_key - Failed to unwrap key for cipher 3DES
> [18/Aug/2020:10:25:16.099670006 +0200] - ERR - attrcrypt_cipher_init - Symmetric key failed to unwrap with the private key; Cert might have been renewed since the key is wrapped. To recover the encrypted contents, keep the wrapped symmetric key value.

I found:
https://access.redhat.com/documentation/en-us/red_hat_directory_server/10/html/administration_guide/updating_the_tls_certificates_used_for_attribute_encryption


But, I do not use any encrypted attribute so dumping and restoring
database is not nice way how to deal witch such error.

Just, deleting all keys and server restart works too:

ldapsearch -H ldap://localhost -D "cn=Directory Manager" -W -LLL -o
ldif-wrap=no -b "cn=ldbm database,cn=plugins,cn=config"
"(nsSymmetricKey=*)" dn | sed "s/^$/changetype: delete\n/" | ldapmodify
-H ldap://localhost -D "cn=Directory Manager" -W
Enter LDAP Password: Enter LDAP Password:
***
deleting entry "cn=3DES,cn=encrypted attribute keys,cn=xxx,cn=ldbm
database,cn=plugins,cn=config"
deleting entry "cn=AES,cn=encrypted attribute keys,cn=xxx,cn=ldbm
database,cn=plugins,cn=config"
deleting entry "cn=3DES,cn=encrypted attribute keys,xxx,cn=ldbm
database,cn=plugins,cn=config"
deleting entry "cn=AES,cn=encrypted attribute keys,xxx,cn=ldbm
database,cn=plugins,cn=config"
...

The best option would be config option to disable attribute encryption
for all databases but I failed to find if it is possible.

Thanks
--
-----------------------
Jan Tomasek aka Semik
http://www.tomasek.cz/