Why am I receiving a CKR_IBM_WK_NOT_INITIALIZED error when I use CLI or API?

IBM Cloud® Hyper Protect Crypto Services is deprecated. As of 28 March 2026, you can't create new instances, and access to free instances will be removed. Existing premium plan instances are supported until 28 March 2027. Any instances that still exist on that date will be deleted.

When you use CLI or API, you receive a CKR_IBM_WK_NOT_INITIALIZED error message.

You might got an error message similar to the following message:

ibmcloud kp -i <service_instance_id> wrap <key_id> Wrapping key... FAILED Bad Request: rpc error: code = Unknown desc = GRPC Return Code: [0X434B525F484F53545F4D454D4F5259] GRPC Message: [Got error CKR_IBM_WK_NOT_INITIALIZED, from libep11.so in m_UnwrapKey]

When you ran the ibmcloud tke cryptounit-compare command, you didn't get a Valid confirmation on the CURRENT MASTER KEY REGISTER.

Make sure that the HSM master keyAn encryption key that is used to protect a crypto unit. The master key provides full control of the hardware security module and ownership of the root of trust that encrypts the chain keys, including the root key and standard key. is properly set.