PS-11074 [DOCS] - Update the KMIP information based on library update 8.4

	modified:   docs/keyring-components-plugins-overview.md
	modified:   docs/using-kmip.md

Author: patrickbirch

docs/keyring-components-plugins-overview.md

@@ -14,6 +14,6 @@ Percona Server supports the following keyring components:
 
 [Use the keyring vault component](use-keyring-vault-component.md){.md-button}
 
-[Use the Key Management Interoperability Protocol (KMIP)](using-amz-kms.md){.md-button}
+[Use the Key Management Interoperability Protocol (KMIP)](using-kmip.md){.md-button}
 
-[Use the Amazon Key Management Service (AWS KMS)](using-kmip.md){.md-button}
+[Use the Amazon Key Management Service (AWS KMS)](using-amz-kms.md){.md-button}

docs/using-kmip.md

@@ -53,8 +53,46 @@ The configuration settings are either in a global configuration file or a local
       "server_port": "5696",
       "client_ca": "client_certificate.pem",
       "client_key": "client_key.pem",
-      "server_ca": "root_certificate.pem"
+      "server_ca": "root_certificate.pem",
+      "object_group": "",
+      "kmip_timeout_ms": 5000,
+      "tls_peer_verification": false,
+      "tls_hostname_verification": false
      }
      ```
 
+### Configuration options
+
+The following options are supported in the KMIP keyring configuration file:
+
+| Option | Type | Default | Description |
+|---|---|---|---|
+| `server_addr` | string | _(required)_ | Hostname or IP address of the KMIP server. |
+| `server_port` | string | _(required)_ | TCP port of the KMIP server (for example, `"5696"`). |
+| `client_ca` | string | _(required)_ | Path to the client certificate (PEM) presented to the KMIP server. |
+| `client_key` | string | _(required)_ | Path to the client private key (PEM) that matches `client_ca`. |
+| `server_ca` | string | _(required)_ | Path to the CA certificate (PEM) used to verify the KMIP server. |
+| `object_group` | string | `""` | Optional KMIP object group. When set, the backend registers new objects into this group and limits enumeration to it. An empty value means "no group". |
+| `kmip_timeout_ms` | integer | `5000` | KMIP connection timeout, in milliseconds. |
+| `tls_peer_verification` | boolean | `false` | When `true`, verifies the KMIP server's TLS certificate against `server_ca`. Defaults to `false` for backward compatibility. |
+| `tls_hostname_verification` | boolean | `false` | When `true`, verifies that the hostname in `server_addr` matches the KMIP server certificate (SAN or CN). Defaults to `false` for backward compatibility. |
+
+#### TLS verification
+
+Both `tls_peer_verification` and `tls_hostname_verification` default to `false` to preserve the behavior of earlier releases. In production deployments, enable both so the server rejects KMIP endpoints presenting an untrusted or mismatched certificate. For peer verification to succeed, `server_ca` must point to the certificate authority that signed the KMIP server certificate. For hostname verification to succeed, the value of `server_addr` must match the Subject Alternative Name (or Common Name) in the KMIP server certificate.
+
+### KMIP object state requirements
+
+!!! important
+
+    The KMIP keyring backend loads and uses only KMIP objects (keys and secret data) in the `ACTIVE` state. Objects in `PRE_ACTIVE`, `DEACTIVATED`, `COMPROMISED`, or `DESTROYED` states are ignored.
+
+    If you are upgrading from an earlier release and some of your keys are still in `PRE_ACTIVE` state, activate them on the KMIP server before starting the server; otherwise Percona Server for MySQL will not be able to see them. New keys and secrets that the backend registers are activated automatically.
+
+### AES key size restriction
+
+!!! important
+
+    Only standard AES key sizes are accepted: **128, 192, and 256 bits** (16, 24, or 32 bytes). Attempts to generate or store an AES key of any other length through the keyring interface (for example, via the `keyring_udf` plugin) fail with a keyring service error. Review any scripts or tooling that relied on non-standard AES key sizes before upgrading.
+
 For more information, see [Keyring Component installation :octicons-link-external-16:](https://dev.mysql.com/doc/refman/{{vers}}/en/keyring-component-installation.html).