If the source database is enabled for HSM, then the source database keystore file is incompatible with the target database, prior to applying the notes for the EnableHSM operation. In this case, the target database may fail to open the keystore for the roll-forward operation. The roll-forward command line accepts the HSM arguments to identify the HSM and open the keystore.

For example, if the keystore file is from a database that was enabled for HSM, use the following RFUTIL syntax:
rfutil targetDB -C roll forward -ailist listFile 
[-HSMLibrary <path_to_HSM_client_library> -Pin
{-HSMSlotID <slot_number> | -HSMLabel <token)label> } ]

The roll-forward operation uses these HSM arguments to open the keystore for the duration of the process.

For more information, see Enable HSM support for a TDE enabled database and RFUTIL ROLL FORWARD qualifier.