# Unable to seal migrate autoseal to autoseal

**URL:** <https://discuss.hashicorp.com/t/unable-to-seal-migrate-autoseal-to-autoseal/30291>\
**Category:** Vault\
**Created:** [October 5, 2021, 3:16pm UTC](https://discuss.hashicorp.com/t/unable-to-seal-migrate-autoseal-to-autoseal/30291 "2021-10-05T15:16:44Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![gkiran.ch](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/gkiran.ch/32/22815_2.png) [@gkiran.ch](https://discuss.hashicorp.com/u/gkiran.ch)\
**Post date:** [October 5, 2021, 3:16pm UTC](https://discuss.hashicorp.com/t/unable-to-seal-migrate-autoseal-to-autoseal/30291/1 "2021-10-05T15:16:44Z")

</div>

I am using vault 1.82 enterprise hsm package. I am able to integrate with HSM using pkcs11

I try to seal migrate from one masterkey to another master key in the same HSM

I have shutdown vault app  
i have used disabled = “true” in the first code block and used new AES keys in the second code block  
when i try to start vault, it gives below error message; i have tried to change the slot number but no luck.

[ec2-user@ip-172-31-20-118 ~]$ ./vault server -config=vault.hcl -log-level=debug  
Error parsing Seal configuration: error creating HSM context: error initializing PKCS#11 library: pkcs11: 0x191: CKR\_CRYPTOKI\_ALREADY\_INITIALIZED  
2021-10-05T14:58:33.032Z [INFO] proxy environment: http\_proxy= https\_proxy= no\_proxy=

---

<div class="post-metadata">

**Author:** ![aram](https://avatars.discourse-cdn.com/v4/letter/a/a183cd/32.png) [@aram](https://discuss.hashicorp.com/u/aram)\
**Post date:** [October 5, 2021, 3:28pm UTC](https://discuss.hashicorp.com/t/unable-to-seal-migrate-autoseal-to-autoseal/30291/2 "2021-10-05T15:28:07Z")

</div>

I have never worked with an HSM but I also have never seen any documentation on it being able to be migrated.

For migration you need two new block, a pkcs11\_from and pkcs11\_to blocks that you can pass in so vault knows what it copies from and to. I have not seen anything like that in the documentation.

See this for storage … so you would need something similar for pcks blocks:

> **[Storage Migration tutorial - Consul to Integrated Storage | Vault - HashiCorp...](https://learn.hashicorp.com/tutorials/vault/raft-migration?in=vault%2Fraft)**
>
> Explore the steps that are necessary to migrate the Vault data from Consul to
> integrated storage if an organization decides to do so.

---

<div class="post-metadata">

**Author:** ![mikegreen](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/mikegreen/32/3160_2.png) [@mikegreen](https://discuss.hashicorp.com/u/mikegreen)\
**Post date:** [October 5, 2021, 3:30pm UTC](https://discuss.hashicorp.com/t/unable-to-seal-migrate-autoseal-to-autoseal/30291/3 "2021-10-05T15:30:07Z")

</div>

> [@gkiran.ch](#):
>
> vault 1.82 enterprise hsm

File a support ticket… HSM is complicated.